On October 6, 2009, in one fell swoop, the Federal Trade Commission (“FTC”) announced proposed settlements of charges against six companies for violations under the US/EU Safe Harbor Program. Specifically, these companies (World Innovators, Inc.; ExpatEdge Partners LLC; Onyx Graphics, Inc.; Directors Desk LLC; Collectify LLC; and Progressive Gaitways LLC) were alleged to have continued to represent in their online privacy policies that they were self-certified under the Safe Harbor Program when in fact they had allowed their certifications to lapse, and thus had engaged in deceptive practices.

The six proposed settlements follow right on the heels of the first ever Safe Harbor enforcement action taken by the FTC (as reported in Proskauer’s Privacy Blog here), against a California company, Balls of Kryptonite, which had falsely represented that it had self-certified to the Safe Harbor Program, when apparently in fact it never had.

The US/EU Safe Harbor program was negotiated between the U.S. and EU governments as a way to reconcile the fact that under the EU’s Data Protection Directive (with some exceptions) organizations may only transfer personally identifiable information from the EU to countries that the European Commission has deemed to have adequate data protection laws—and the U.S. is not one of those countries. Therefore, the EU/US Safe Harbor program was created in 2001 as a way for U.S. companies to receive personal data from the EU.

To participate in the program, a U.S. company self-certifies to the U.S. Department of Commerce (and commits in a publicly–facing policy) that it will follow the Safe Harbor Privacy Principles (the “Principles”), which mirror the core requirements of the EU Data Protection Directive.

The FTC’s enforcement action should serve as a wake-up call to U.S. companies that have been lulled, during the eight years since the Safe Harbor program was put into place, into the mindset that the FTC is not enforcing the program. Although for almost a decade U.S. companies have been able to take a “wait and see” approach as to the FTC’s enforcement appetite, that era certainly seems to have come to an end. All U.S. companies that import personally identifiable information from Europe under the Safe Harbor should review their safe harbor policies now, and re-affirm their compliance with the Principles.