#Safe harbor how to#

Individuals must have access to personal information about them that an organization holds and be able to correct or amend that information where it is inaccurate. To the extent necessary for those purposes, an organization should take reasonable steps to ensure that data is accurate, complete, and current.

Organizations creating, maintaining, using or disseminating personal information must take reasonable measures to assure its reliability for its intended use and reasonable precautions to protect it from loss, misuse and unauthorized access, disclosure, alteration and destruction.Ĭonsistent with these principles, an organization may only process personal information relevant to the purposes for which it has been gathered. Where an organization has not provided choice because a use is compatible with the purpose for which the data was originally collected or which was disclosed in a notice and the organization wishes to transfer the data to a third party, it may do so if it first either ascertains that the third party subscribes to the safe harbor principles or enters into a written agreement with such third party requiring that the third party provide at least the same level of privacy protection as is required by the relevant safe harbor principles.(5) For sensitive information, such as medical and health information, information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information concerning the sex life of the individual they must be given affirmative or explicit (opt in) choice.(4)Īn organization may only disclose personal information to third parties consistent with the principles of notice and choice. They must be provided with clear and conspicuous, readily available, and affordable mechanisms to exercise this option.

This notice must be provided in clear and conspicuous language when individuals are first asked to provide personal information to the organization or as soon thereafter as is practicable, but in any event before the organization uses such information for a purpose other than that for which it was originally collected or discloses it to a third party.Īn organization must offer individuals the opportunity to choose (opt out) whether and how personal information they provide is used or disclosed to third parties (where such use is incompatible with the purpose for which it was originally collected or with any other purpose disclosed to the individual in a notice).

#Safe harbor how to#

The process was developed by the US Department of Commerce in consultation with EU.Īn organization must inform individuals about the purposes for which it collects information about them, how to contact the organization with any inquiries or complaints, the types of third parties to which it discloses the information, and the choices and means the organization offers individuals for limiting its use and disclosure. self-certify) as long as they adhere to the 7 principles and 15 frequently asked questions. organizations that process personal data collected in the EU, the Safe Harbor Principles are designed to assist eligible organizations to comply with the EU Data Protection Directive and maintain the privacy and integrity of that data. Safe Harbor is no longer available and has been superceeded by the Privacy Shield program. US-EU Safe Harbor is a streamlined process for US companies to comply with the EU Directive 95/46/EC on the protection of personal data, and the General Data Protection Regulation (GDPR)