On October 6, 2015, the Court of Justice of the European Union (CJEU) delivered a judgment that invalidated the Safe Harbor Agreement between the United States and the 28-member European Union (EU). Safe Harbor was a 15-year-old accord, under which personal data could legally be transferred between EU member countries and the United States for commercial purposes. The negotiation of Safe Harbor was largely driven by the EU's 1995 Data Protection Directive (DPD) and European concerns that the U.S. approach to data privacy did not guarantee a sufficient level of protection for European citizens' personal data. The Safe Harbor Agreement applied to a wide range of businesses and organizations that collect and hold personal data. When the parties concluded the Safe Harbor Agreement in 2000, however, the Internet was still in its infancy, and the range of public and private actors engaged in the mass processing of personal data, including across borders, was much more limited than today. The CJEU's decision gave added impetus to U.S.-EU negotiations underway since late 2013 aimed at "making Safe Harbor safer." These discussions were part of several initiatives seeking to restore transatlantic trust in the security of U.S.-EU data flows following the so-called "Snowden leaks." On February 2, 2016, U.S. and EU officials announced an agreement, "in principle," on a replacement to Safe Harbor—the U.S.-EU Privacy Shield, which would allow companies to continue to transfer EU citizen's personal data to the United States while complying with the requirements outlined by the CJEU when it declared Safe Harbor invalid in October 2015. The text of the new agreement was released on February 29, 2016; it must still be approved by the European Commission. U.S. and EU officials claim that Privacy Shield will contain significantly stronger privacy protections and oversight mechanisms, multiple redress possibilities, and new safeguards related to U.S. government access to personal data. Nevertheless, questions exist about whether Privacy Shield will go far enough in addressing broader EU data privacy and protection concerns, and whether it will be able to stand up to future legal challenges against it that will likely be brought before the CJEU. Many U.S. officials and business leaders hope that the recently concluded (but not yet finalized) U.S.-EU Data Privacy and Protection Agreement (DPPA)—an "umbrella" accord aimed at better protecting personal information exchanged in a law enforcement context—and the newly enacted U.S. Judicial Redress Act ( H.R. 1428 / S. 1600 , P.L. 114-126 )—which extends the core of the judicial redress provisions in the U.S. Privacy Act of 1974 to EU citizens—could help ameliorate European concerns about U.S. data protection standards and bolster confidence in the newly proposed Privacy Shield Agreement. Both the United States and EU assert that they are committed to upholding individual privacy rights and ensuring the protection of personal data, including electronic data. Nevertheless, data privacy and data protection issues have long been sticking points in U.S.-EU economic and security relations, in large part due to fundamental differences between the United States and EU in their approaches to data protection and data privacy laws. For instance, in the United States, what the European Commission (the EU's executive) refers to as the "collecting and processing of personal data" is allowed unless it causes harm or is expressly limited by U.S. law. In Europe, by contrast, processing of personal data is prohibited unless there is an explicit legal basis that allows it. The EU considers the privacy of communications and the protection of personal data to be fundamental human rights, as incorporated into Articles 7 and 8 of the 2000 Charter of Fundamental Rights of the European Union and made binding on all EU members through the 2007 Treaty of Lisbon (which took effect in 2009). Europe's past history with fascist and totalitarian regimes clearly informs its views on data protection and contributes to the demands from European politicians and publics for strict data privacy controls. In October 1995, the EU agreed on a Data Protection Directive (DPD) to harmonize differing national legislation on data privacy protection and establish a comprehensive EU-wide framework. The DPD sets out common rules for public and private entities in all EU member states that hold or transmit personal data. The DPD governs how information about European citizens may be collected and used across all industries, with each EU member state responsible for implementing the Directive through its own national laws. The EU hoped that the DPD would facilitate information flows within the EU, strengthen the EU's internal market, and foster the development of an information-based economy. EU member states were given three years to implement the DPD. The DPD provides that the transfer of personal data to a country outside of the EU may occur only if the European Commission determines that the country provides an adequate level of protection of personal data. The adequacy of the level of protection is assessed in the light of all the circumstances surrounding the data transfer; with particular consideration given to the nature of the data, the purpose and duration of the proposed processing operations, the countries of origin, and final destination of the data, and that country's laws, rules, and security measures. The DPD applies to all organizations, public and private, operating in the EU, including affiliates of U.S. corporations. It covers the processing of all personal data, whether done automatically or manually. There is no exception for public records, such as telephone directory listings. Only information compiled for private, personal household use is excluded. Under the DPD, data may be collected and used only for specified, explicit, and legitimate purposes. Security and accuracy must be guaranteed. Individuals not only have the right to access their personal information and the right to correct errors, but also the right to seek remedial measures and compensation, if necessary. The transfer of data to third parties may occur only under similarly strict requirements. More stringent rules apply to the processing of sensitive data, including data relating to race; ethnic origin; political, religious, or philosophical beliefs; and health status or sex life. The DPD requires the creation of "Data Protection Agencies" (DPAs) in each EU member state, registration of databases with these authorities, and, sometimes, prior DPA approval before organizations or firms may begin data processing. Although the 1995 Data Protection Directive has since been complemented by other EU legal instruments (such as the 2002 "e-Privacy" Directive for the communications sector), the DPD currently remains the EU's main data protection instrument. In 2012, the European Commission proposed a new legislative package aimed at modernizing the DPD and introducing other data protection reforms in order to take into account the changes in data processing brought about by the widespread use of the Internet. In December 2015, EU member states (acting in the Council of the European Union) and the directly-elected European Parliament (which represents the citizens of the EU) reached political agreement on new data protection rules; these were formally adopted in April 2016 and will take effect in 2018. In the United States, respect for privacy is broadly enshrined in our Constitution. Unlike the EU, however, the United States does not have a single, overarching data privacy and protection framework. Many describe U.S. data privacy laws as a "patchwork" of federal and state statutes. For example, concerns about how the federal government manages personal information in its possession led to the enactment of the U.S. Privacy Act of 1974 , while the Electronic Communications Privacy Act of 1986 , extended government restrictions on telephone wire taps to include computer transmissions of electronic data. Meanwhile, federal consumer privacy laws in the United States are largely industry specific and vary by sector, with different laws governing the collection and disclosure of financial data, health-related data, student information, and motor vehicle records. U.S. states have also enacted a variety of digital privacy and data protection laws over the years. Many U.S. officials and industry representatives maintain that the U.S. approach to data privacy is more nimble than what they view as the EU's "one-size-fits-all" approach. They also contend that the U.S. approach helps to promote and sustain U.S. technological innovation. Nevertheless, some U.S. privacy advocates argue that there are significant gaps in this "patchwork" approach, especially in terms of data collection online, and have long urged Congress to enact comprehensive data protection legislation. The transatlantic flow of data is a form of international trade and is of critical importance for the U.S. and European economies. The United States and the EU remain each other's largest trade and investment partners. In 2013, total U.S.-EU trade in goods and services amounted to $1 trillion and U.S. FDI in EU totaled $2.4 trillion (or about 56%) of total U.S. direct investment abroad. Conversely, EU companies accounted for $1.7 trillion (or about 62%) of direct investment in the United States. According to a 2014 study, cross-border data flows between the United States and Europe are the highest in the world—almost double the data flows between the United States and Latin America and 50% higher than data flows between the United States and Asia. Reports indicate that data protection standards are not part of the ongoing negotiations for the Transatlantic Trade and Investment Partnership (T-TIP), because the EU views its data privacy laws and protection standards as fundamental rights that are nonnegotiable. However, both U.S. and European officials recognize that a successful T-TIP agreement requires the ability to transfer data between the United States and EU member countries in a legally sound and cost-effective manner. As noted by U.S.