Safe Harbour leaves Irish businesses guessing over data transfer rules

There is widespread confusion among Irish firms over data transfer rules following the demise of the Safe Harbour arrangement and concerns over its replacement.

A study of almost 140 senior IT decisionmakers in Irish businesses showed that six in 10 businesses do not understand the regulations governing the transfer of users’ data between the EU and US.

Safe Harbour is the arrangement that set down rules for the transfer of data to the US.

It was put in place in 2000 but subsequently invalidated by the European Court of Justice in October 2015.

The ruling has particular relevance to Ireland given the number of US multinational tech companies such as Facebook, Twitter and Google based here.

Some 60% of respondents to the research undertaken by data centre company Equinix claim not to understand the regulations that are currently in place.

The figure rises to 80% for overseas companies with operations in Ireland.

Earlier this week, the waters were muddied even further when the European Data Protection Supervisor Giovanni Buttarelli criticised Safe Harbour’s replacement.

The newly established ‘Privacy Shield’ pact agreed between the EU and US in February was described as “not robust enough” by Mr Buttarelli.

Under the agreement, the US was to give written commitments that EU citizens’ data would not be subject to mass surveillance while the US was also to establish an ombudsman to handle complaints.

“I appreciate the efforts made to develop a solution to replace Safe Harbour, but the Privacy Shield as it stands is not robust enough to withstand future legal scrutiny,” Mr Buttarelli said, adding that “significant improvements” would be needed.

Despite the confusion over data transfer regulations, Irish data-protection laws are seen as strong and are increasingly acting a ‘pull-factor’ for multinationals.

According to Equinix Ireland managing director, Maurice Mortell: “Ireland is continuing to showcase itself as a prime location to host data and our data protection laws are adding to that story.”