Safe Harbor: what it was, why it was struck down and what replaces it today
From Safe Harbor to the Data Privacy Framework: what changed and what to check in your providers
The Safe Harbor was an agreement between the European Union and the United States for transferring personal data. From 2000 to 2015, it allowed data to be sent to US companies that committed to following a set of privacy principles.
It is no longer in force today. The Court of Justice of the EU struck it down in 2015, and its successor, the Privacy Shield, met the same fate in 2020. Since July 2023, transfers to the United States have relied on the EU-US Data Privacy Framework.
If you use US tools for your email marketing, your CRM or your website, this affects you more than you might think.
What is the Safe Harbor and how did it work?
The European Commission approved it in July 2000. The idea was simple: US privacy laws offered less protection than European ones.
So American companies could voluntarily commit to meeting a similar level of protection.
To join, a company self-certified with the US Department of Commerce. From then on, it could receive data from the EU without further formalities. More than 4,000 companies signed up, including almost all the big tech firms.
There were seven principles they had to follow:
- notice: state what data is collected and for what purpose;
- choice: let people opt out of other uses;
- onward transfer: not pass the data on to third parties without the same safeguards;
- security: protect the data against loss or unauthorized access;
- data integrity: use the data only for the stated purpose;
- access: let each person view and correct their data;
- enforcement: have mechanisms to resolve complaints and impose penalties.
Why was the Safe Harbor struck down?
In 2013, Edward Snowden’s revelations showed that US intelligence agencies had mass access to data stored by tech companies.
Austrian lawyer Max Schrems then filed a complaint against Facebook with the Irish data protection authority. The case reached the Court of Justice of the EU.
On October 6, 2015, the court struck down the Safe Harbor in the ruling known as Schrems I. It concluded that the agreement did not protect Europeans against that mass access and that they had no real way to seek redress.
Safe Harbor, Privacy Shield and Data Privacy Framework: differences
After it was struck down, the EU and the United States negotiated two more agreements. This table sums up all three:
| Agreement | In force | What it provided | What happened |
|---|---|---|---|
| Safe Harbor | 2000-2015 | Self-certification by companies under 7 principles | Struck down by the CJEU (Schrems I) |
| Privacy Shield | 2016-2020 | Stricter principles and an ombudsperson for complaints | Struck down by the CJEU on July 16, 2020 (Schrems II) |
| EU-US Data Privacy Framework | Since July 2023 | Limits on intelligence agencies’ access and a review court for Europeans | In force, but challenged before the CJEU |
The Privacy Shield fell for the same reason as its predecessor: the court found that US surveillance still lacked sufficient limits.
What is the EU-US Data Privacy Framework?
It is the framework that governs data transfers from the EU to the United States today. The European Commission approved it on July 10, 2023.
Beforehand, the United States used an executive order to limit its intelligence agencies’ access and created a review court that Europeans can turn to.
It works in a similar way to the Safe Harbor. US companies certify with the Department of Commerce, renew that certification every year and appear on a public list at dataprivacyframework.gov.
If your provider is on that list with an active certification, you can send it data without signing additional safeguards.
Is it final? Not yet. The EU General Court upheld it in September 2025, but that decision has been appealed to the Court of Justice. It’s worth keeping an eye on how it develops.
Worried about where your subscribers’ data ends up?
With Mailrelay, you work with a service established in the European Union. Create your free account and get started today.
How does it affect your company if you use US tools?
Using a US tool, such as Mailchimp or another SaaS, is not illegal. What the GDPR requires is that the data transfer is covered. Today you have three options:
- The provider is certified under the Data Privacy Framework. This is the simplest option: check the official list before signing up.
- It isn’t certified, but you both sign the European Commission’s standard contractual clauses. These are a standard contract, in their 2021 version, usually accompanied by a transfer risk assessment.
- Specific GDPR exceptions, such as the person’s explicit consent. They are not valid for regular transfers.
In every case, remember two things. Your provider processes data on your behalf, so you need a data processing agreement.
And your privacy policy must state that there are international transfers, as required by the GDPR and the current LOPD.
If you have questions about a specific case, consult a lawyer or a data protection officer.
What does the Safe Harbor have to do with email marketing?
A lot. Your subscriber list is a database of personal data, and the platform you send your newsletter from stores and processes it.
That’s why, before choosing an email marketing platform, it’s worth asking four questions:
| Question | Why it matters |
|---|---|
| Where is the company established and where does it store the data? | If the data leaves the EU, there is an international transfer |
| Is it certified under the Data Privacy Framework? | If it’s a US company, this is the simplest way to cover the transfer |
| Does it sign a data processing agreement? | The GDPR requires one from any provider that processes your data |
| What security measures does it apply? | You are responsible for choosing a provider that protects the information |
It’s the same logic we explain in our guide to legal email marketing, along with consent, information and unsubscribes.
Other meanings of safe harbor
Outside data protection, “safe harbor” is used in law for any safe harbor clause: a rule that shields from liability anyone who meets certain conditions.
The best-known example is internet platforms. In the United States, the DMCA exempts them from liability for what their users upload if they remove the content when notified.
How Mailrelay helps you
Mailrelay is a service established in the European Union, so you can work with your list without depending on agreements with the United States.
It also helps you comply with the other rules. You get subscription forms with double opt-in to prove permission.
And automatic unsubscribe management and the suppression list keep you from writing again to people who have left.
With the free account you can send up to 80,000 emails a month to 20,000 contacts.
Send your newsletters with Mailrelay
Up to 80,000 free emails a month to 20,000 contacts, with double opt-in and automatic unsubscribes.
Frequently asked questions about the Safe Harbor
These are the most common questions about the agreement and what came after it.
What is the Safe Harbor?
It was an agreement between the EU and the United States, in force from 2000 to 2015, that allowed personal data to be transferred to US companies that signed up to a set of privacy principles.
Is the Safe Harbor still in force?
No. The Court of Justice of the EU struck it down on October 6, 2015. Today the EU-US Data Privacy Framework, approved in July 2023, applies.
What is the difference between Safe Harbor and Privacy Shield?
The Privacy Shield was the Safe Harbor’s successor, from 2016 to 2020. It had stricter principles and an ombudsperson for Europeans’ complaints, but it was also struck down.
Is it spelled safe harbor or safe harbour?
Both spellings are correct. “Harbor” is the US spelling and “harbour” the British one. The official agreement was called “Safe Harbor”.
Can I use a US email marketing tool?
Yes, as long as the transfer is covered. The simplest way is to check that the provider is certified under the Data Privacy Framework and sign a data processing agreement with it.