The Federal Trade Commission (FTC) has reached agreement with 12 US companies that falsely claimed to comply with the EU-US safe harbor agreement. The safe harbor agreement enables US companies to transfer consumer data from the EU to the US in compliance with the European Data Protection Directive (95/46/EC). To participate, a company must self-certify annually to the US Department of Commerce that it is willing to adhere to seven safe harbor principles. A participant may highlight to consumers its compliance with the safe harbor agreement by displaying the safe harbor certification mark on its website. The FTC charged each company with representing, through statements in their privacy policies or display of the safe harbor certification mark, that they held current safe harbor certifications, even though the companies had allowed their certifications to lapse. The FTC alleged that this conduct violated section 5 of the FTC Act. The FTC stated however, that this does not necessarily mean that the companies committed any substantive violations of the safe harbor agreement. Under the proposed settlement agreements (which are open to public comment until 20 February 2014), the companies are prohibited from misrepresenting the extent to which they participate in any privacy or data security program sponsored by the US government or any other self-regulatory or standard-setting organisation. The FTC stated that enforcement of the safe harbor agreement is a priority.

This, however, is unlikely to placate European Commission Vice-President Viviane Reding, who has recently threatened to suspend the agreement this summer unless the US strengthens the functioning of safe harbour, based on 13 European Commission recommendations. The need to restore trust follows revelations last year about US intelligence agencies illegal mass surveillance of EU citizens' data.

Source: FTC press release, 21 January 2014, European Commission press release (MEMO/14/60), 27 January 2014 and European Commission speech (SPEECH/14/62), 28 January 2014.