Find out how the invalidation of Safe Harbour affects business

Baroness Neville-Rolfe, the minister responsible for data protection and nuisance calls, asked the DMA to survey its members on how they were adjusting in the wake of the decision. The Government wanted a clearer idea of what was happening on the ground.

72% of respondents used Safe Harbour to ease their transatlantic data flows prior to the CJEU decision, as close to one third of US organisations were registered under it.

43% of businesses have not stopped transferring data to the US since the ruling, and so have not suffered a large material loss. However, this a compliance risk. From January, European data protection authorities may seek enforcement action against companies still transferring data to the US. But, 9% of businesses had suffered losses as a result of halting data transfers to the US.

However, businesses are now making use of alternative arrangements with 30% using model contract clauses and 10% binding corporate rules.

Two-fifths of respondents (40%) have not put alternative arrangements in place. This was because most felt that the alternative arrangements were not satisfactory.

Model contract clauses and binding corporate rules are not suitable for SMEs owing to the cost of implementing them. Furthermore, these alternatives are open to same challenge in court that struck down Safe Harbour.

36% of respondents estimated that the cost of implementing changes to be greater than £10,000. In some cases the cost was between £50,001-100,000.

The situation will not be rectified until there are changes in US law [are you certain - Safe Harbour II talks said to be at an advanced stage. The US must be able to offer adequate protection to EU citizens and safeguard their fundamental rights. Data protection is considered a fundamental right by the EU.

You can read the results here.