approaches to regulating personal data collected by private enterprises. The European Union has the world’s most comprehensive legal data protection regime, the Data Privacy Directive (DPD) adopted in 1995, which it plans to develop further.<sup>21</sup> The DPD makes it illegal to transfer personal data outside the European Union unless the European Commission has found that the third country receiving the personal data provides adequate protection. In the absence of an adequacy decision, data can be transferred to a third country under so-called derogations, the main ones being consent of the data subject, when the transfer is necessary for the performance of a contract between the data subject and the controller or is necessary on important public interest grounds. The DPD also allows for a cross-border transfer pursuant to a contract between the controller and the processor that guarantees the same protection of the personal data as under the DPD. A global conglomerate can transfer data among its units where it has implemented binding corporate rules that also ensure data protection consistent with the DPD.

The U.S.-EU Safe Harbor Framework (SHF), recently supplanted by the so called Privacy Shield Agreement, was developed in response to the absence of a finding that the United States provides adequate data protection.<sup>22</sup> The European Commission recognized the SHF Privacy Principles as providing adequate protection for personal data transfers from the European Union to approximately 3,000 companies in the United States that have signed up to the principles.<sup>23</sup> A key difference between the SHF and the EU DPD adequacy standards is that the SHF recognizes the self-regulatory approach with U.S. government enforcement as an effective means of guaranteeing that personal data from the European Union will be accorded privacy protection consistent with the data privacy principles agreed under the SHF. Under the SHF, U.S. organizations can either join a self-regulatory privacy program that adheres to the safe harbor principles or self-certify (most common) to the U.S. Department of Commerce that they are complying with these principles. The US Department of Commerce reviews every SHF self-certification and annual recertification submission it receives from companies. The U.S. Federal Trade Commission enforces the SHF against companies that self-certify as being in compliance.<sup>24</sup> The exporting country commitments embodied in the SHF have played a crucial role in allowing data flows between the European Union and the United States even though some concerns were expressed about its operation and effectiveness. Some of these have been addressed in the recent Privacy Shield Agreement, but some shortcomings remain (Hufbauer and Jung 2016). A major remaining problem that

> 21 As a directive, implementation of the DPD is left to EU member states, which vary widely in their enforcement. The European Commission is seeking to update the DPD as a regulation.

> 22 According to a 1999 Opinion from the Article 29 Working Party, the U.S. approach was seen as not providing adequate protection in all cases for personal data transferred from the European Union.

23 The SHF consists of seven principles that reflect mainly the key elements of the EU Data Protection Directive. The main ones are commitments to give European data subjects notice that a U.S. entity is processing their data; to limit onward transfers of data to countries that also subscribe to the Safe Harbor principles or are subject of an adequacy finding; to take reasonable steps to protect personal data from loss or misuse; to process personal data only for the expressed purposes the organization intends to use it; to give European data subjects access to their personal information and the ability to correct, amend, or delete inaccurate information; and to commit to enforce the principles and give European data subjects access to affordable enforcement mechanisms.

24 To date, the U.S. Federal Trade Commission (FTC) has brought 10 Safe Harbor-related enforcement actions. The FTC acts on referrals from EU data protection authorities and from third-party private dispute resolution providers, as well as on its own.

24