The organizations on this list have notified the Department of Commerce that they adhere to the safe harbor framework developed by the Department of Commerce in coordination with the European Commission. The safe harbor provides guidance for U.S. organizations on how to provide "adequate protection" for personal data from Europe as required by the European Union's Directive on Data Protection.
An organization's self-certification to the safe harbor list, and its appearance on this list pursuant to the self certification, constitute a representation to the Department of Commerce and the public that it adheres to a privacy policy that meets the safe harbor framework.
There are benefits to firms who join the safe harbor, but participation in the safe harbor framework and self certification to the list are entirely voluntary. An organization's absence from the list does not mean that it does not provide effective protection for personal data or that it does not qualify for the benefits of the safe harbor.
In order to keep this list current, a notification will be effective for a period of twelve months. Therefore, organizations need to notify the Department of Commerce every twelve months to reaffirm their continued adherence to the safe harbor framework.
Organizations should notify the Department of Commerce if their representation to the Department is no longer valid. Failure by an organization to so notify the Department could constitute a misrepresentation.
An organization may withdraw from the list at any time by notifying the Department of Commerce. Withdrawal from the list terminates the organization's representation of adherence to the safe harbor, but this does not relieve the organization of its safe harbor obligations with respect to personal information received during the time the organization is on the safe harbor list.
If a relevant self-regulatory or government enforcement body finds an organization has engaged in a persistent failure to comply with the principles, then the organization is no longer entitled to the benefits of the safe harbor. In this case, the organization must promptly notify the Department of Commerce of such facts either by email or letter. Failure to do so may be actionable under the False Statements Act (18 U.S.C. 1001). That organization must also provide the Department of Commerce with a copy of the decision letter from the relevant self-regulatory or government enforcement body.
In maintaining the list, the Department of Commerce does not assess and makes no representations to the adequacy of any organization's privacy policy or its adherence to that policy. Furthermore, the Department of Commerce does not guarantee the accuracy of the list and assumes no liability for the erroneous inclusion, misidentification, omission, or deletion of any organization, or any other action related to the maintenance of the list.
- Click on the organization's name to view its detailed safe harbor participation information.
- Click on "persistent failure to comply" to view an organization's non-compliance letter.
