As has been widely reported (see Baker & McKenzie client alert), the European Court of Justice
(ECJ) invalidated the EU/US Safe Harbor Program which allowed transfers of personal data of
EU/EEA residents to U.S. companies that registered under the program. Generally, such
transfers are allowed only if a permissible ground exists, and the Safe Harbor Program was a
convenient ground for many U.S. companies doing business in the EU/EEA. By invalidating the
program, these companies are now forced to rely on other grounds, such as the data subject's
express consent or Model Agreements between the transferring and receiving entity.