What&#39;s the difference between &quot;GDPR&quot; &quot;Privacy Shield&quot; and &quot;Safe Harbor&quot;?
<p>I'm getting confused on the differences between "GDPR", "Privacy Shield", and "Safe Harbor".  Can someone please elaborate?  I <em>think</em> Privacy Shield replaces "Safe Harbor" but I still don't understand why GDPR wouldn't just apply to everything. </p>

<p>EU privacy laws has specific requirements regarding the transfer of data out of the (European Economic Area) EEA. One of these requirements is that the transfer must <em>only</em> happen to countries deemed as having adequate data protection laws. GDPR Article 45:</p>

<blockquote>
  <p>A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.</p>
</blockquote>

<p>The European Comission does <em>not</em> list the US as one of the countries that <em>by default</em> meets this requirement.</p>

<p>This means that by default, according to the <strong>GDPR</strong>, it is <em>illegal</em> to transfer personal data from the EEA to the USA.</p>

<p>That is a letdown to the transatlantic trade in digital services, which amounts to 260 billion dollars per year (source: <a href="https://www.reuters.com/article/us-eu-dataprotection-usa-idUSKCN0WH2PN" rel="nofollow noreferrer">Reuters</a>). So the problem that faced the legislators drafting the GDPR is to both keep personal data and money flowing across the Atlantic, but at the same time pretending that the personal data is safe from surveillance.  I.e. they had to come with some <em>loophole</em>.</p>

<p>And there is!  In the GDPR such a loophole it provisioned in Article 47, which states that companies outside the EEA that adopt "binding corporate rules" for data protection are <em>exempt</em> from GDPR Article 45, if their adoption is "approved by a competent supervisory authority".</p>

<p>Such "binding corporate rules" was first laid down in the <strong>EU-US Safe Harbour Principles</strong> (from 2000-2015), which is now rebranded (with minor changes) as the <strong>EU-US Privacy Shield Framework</strong> (2016-).</p>

<p>The reason for the re-branding was that the European Court of Justice i 2015 declared the EU-US Safe Harbour Principles <em>invalid</em>, following the revelations by Edward Snowden regarding indiscriminate mass surveillance carried out by the US government, so in 2016, they had to think up a new name to keep the loophole open. There is not much difference between the two, and neither protects European citizen's personal data from indiscriminate mass surveillance carried out by the US government.</p>

privacy international gdpr