Outside counsel drafts a 2026 transfer clause that still relies on the US–EU Safe Harbor framework as the transfer mechanism. What historical point should the privacy team raise?
Select an answer to reveal the explanation.
Short Explanation
Safe Harbor is a museum piece, not a living transfer tool. The CJEU knocked it down in Schrems, so sticking it in a 2026 contract is like citing a revoked driver’s licence. Point counsel to current mechanisms instead of that retired framework.
Full Explanation
The US–EU Safe Harbor framework was invalidated by the Court of Justice of the European Union in Schrems (Schrems I) and is not a live transfer mechanism in 2026 drafting. Privacy teams must reject clauses that still treat Safe Harbor as operative history rather than historical artefact. Controllers responsible for residents’ and employees’ data—whether municipal contractors or private startups—need current Article 45–49 tools, not retired frameworks.
Safe Harbor does not remain valid for employee data after Schrems I; the invalidation was not an HR carve-out. Displaying a privacy seal does not resurrect Safe Harbor. The framework was precisely a commercial transfer mechanism, so claiming it was “only for law-enforcement requests” reverses the history.
Exam caveat: sequence matters—Safe Harbor fell, Privacy Shield fell, and newer mechanisms (including the EU–US Data Privacy Framework where applicable) must be assessed on their own terms with Schrems II transfer-impact discipline still in mind for non-adequate paths.
Operational check: purge Safe Harbor references from templates and vendor paper, map each US flow to adequacy participation, SCCs/BCRs, or a rare derogation, and train procurement to flag legacy clauses automatically.