In 2011, Israel became one of a handful of countries to obtain “adequacy” status under the EU Data Protection Directive. This has meant that personal data of European individuals could flow freely from the EU to Israel without relying on legal mechanisms such as standard contractual clauses or binding corporate rules. As part of its data protection regime, Israel restricts data transfers to third countries that are not part of the EU or receive data from the EU under a valid legal arrangement. In the past, ILITA opined that these provisions authorized data transfers to Safe Harbor companies in the U.S. Yet the invalidation of Safe Harbor by the ECJ has undercut the legal basis for such transfers.
Maybe it’s about time for the U.S. to step up to the plate with a national-level solution (of course, that would require making near-absolute guarantees about privacy, even against the federal government, which remains a big sticky point).