Safe Harbour: Data Protection Authorities Start Imposing Fines

The Hamburg Commissioner for Data Protection has imposed fines in the amount of EUR 8,000, EUR 9,000 and EUR 11,000 on three companies with seat in Hamburg. The reason for the imposition of the fines was the companies’ continued transfer of personal data to the US on the basis of the Safe Harbour Agreement, despite this agreement having been declared invalid by the ECJ in October 2015 (for further details on the ruling, please see here). A final resolution with regard to the planned new regulation of transatlantic transfers of data (see: here) is not yet in sight.

Furthermore, the Hamburg data protection authorities have announced the imposition of further fines. The amounts of the recently imposed fines were relatively moderate (the maximum possible fine is EUR 300,000) in consideration of the companies concerned having amended their procedures for the transfer of data to the US during the course of the proceedings for the imposition of the fines. According to the data protection authorities, the amount of any further fines imposed will be higher.

Other German data protection authorities are now expected to also start imposing fines. Companies transferring data to the US (including the use of IT services, for example cloud solutions provided by US entities) should therefore already start subjecting their procedures for such data transfers to intense scrutiny. Should a company attract the attention of the data protection authorities, it will face not only the possibility of fines, but also the considerably greater (and potentially also costlier) issue of finding a new basis on which its data transfers may be effected under considerable time pressure. The risk of this situation arising may at least be minimised by companies directing their attention to this issue at an early stage.