I was reading the Privacy Policy and I must note that paragraph:

Safe Harbor Overview

We have chosen to comply with the principles of the Safe Harbor Framework developed by the U.S. Department of Commerce in consultation with the European Commission and the Federal Data Protection and Information Commissioner of Switzerland, except where limited by any legal, regulatory, ethical or public interest considerations. More information about the principles that make up the Framework, as well as other frequently asked questions relating to Safe Harbor can be found at: http://www.export.gov/safeharbor.

In the linked page it states that (emphasis mine):


On October 6, 2015, the European Court of Justice issued a judgment declaring as “invalid” the European Commission’s Decision 2000/520/EC of 26 July 2000 “on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce.” According to that decision, the U.S.-EU Safe Harbor Framework is not a valid mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States. Please note that, pursuant to the Safe Harbor Frequently Asked Question on Self-Certification, the commitment to adhere to the Safe Harbor Principles is not time-limited, and a participating organization must continue to apply the Principles to data received under the Safe Harbor.

On July 12, U.S. Secretary of Commerce Penny Pritzker joined European Union Commissioner Věra Jourová to announce the approval of the EU-U.S. Privacy Shield Framework, which will replace the U.S.-EU Safe Harbor. Secretary Pritzker announced that the Department will start accepting certifications on August 1st.

As of August 1, the Department of Commerce will stop accepting new submissions for self-certification to the U.S.-EU Safe Harbor Framework. As of October 31, the Department will stop accepting U.S.-EU Safe Harbor re-certifications. The Department will maintain the U.S.-EU Safe Harbor List of participants.

Please note that this advisory does not apply to the U.S.-Swiss Safe Harbor Framework, which the Department will continue to administer.

For more information on the EU-U.S. Privacy Shield Framework, please visit https://www.privacyshield.gov .

Shouldn't the privacy policy be under the new Privacy Shield?

It has been already a year since the resolution of the European Court of Justice, and I haven't heard of any change.

What is doing Stack Exchange to ensure my privacy as an European user under the Privacy Shield?

About Privacy Shield (again emphasis mine):

The EU-U.S. Privacy Shield Framework was designed by the U.S. Department of Commerce and European Commission to provide companies on both sides of the Atlantic with a mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States in support of transatlantic commerce

See the new requirements.

  • Why should SE update their legal statement? The current legal statement is still okay, regardless of 'new and improved' regulations. The SHF is not down as you say. And why just European users? The privacy policy applies to US citizens too, and the rest of the world. Commented Nov 15, 2016 at 9:22
  • 2
    @Patrick It should be updated because it doesn't protect the European users according to the law! No the current legal statement is not okay for countries like Spain, Greece, Italy, Germany... See the first question of the FAQ of the Privacy Shield and the first emphasized section. I just pointed that the regulation have changed and my privacy is not being respected, if your privacy isn't respected explain it so I can add it to the question or open a new one.
    – llrs
    Commented Nov 15, 2016 at 9:45
  • 2
    AFAIK (and I may be wrong, IANAL, etc.) there is no legal requirement to (self-)certify with any of these privacy schemes. There is nothing anywhere here saying that SE doesn't comply with EU privacy law, all there is is a decision that a scheme that SE certifies with no longer sufficiently guarantees compliance with EU law. That doesn't mean that SE isn't complying with EU law of its own accord.
    – Cai
    Commented Nov 15, 2016 at 11:02
  • @Cai Yes, I hope SE is doing everything right :D, but the Privacy Shield, specifically requires notifying the users, so at least this hasn't been done even if it fulfills all other requirements... (which I doubt, hence my question). It is required to transfer data from EU to USA to be under the Privacy Shield, see my edit
    – llrs
    Commented Nov 15, 2016 at 11:15
  • 4
    Ok, but it does sound from your post that your conflating Privacy Shield with EU law—they are not the same thing... i.e. "regulation have changed and my privacy is not being respected" I see no evidence of that.
    – Cai
    Commented Nov 15, 2016 at 11:26
  • It is worded a little blunt as I haven't seen evidence, but I haven't seen any effort to comply with the Privacy Shield neither.
    – llrs
    Commented Nov 15, 2016 at 11:34
  • Despite the lack of compliance I still think my personal data is more safe in the hands of SE then it is within any government system ... your mileage may vary ...
    – rene
    Commented Dec 2, 2016 at 21:56
  • Your milage may vary but I don't want that the information a company has from me to be used or scanned by a goverment agency like NSA.
    – llrs
    Commented Dec 2, 2016 at 23:00

1 Answer 1


It's not quite as simple as simply slapping Privacy Shield into all the places where Safe Harbor used to be. We are actively working towards becoming compliant with Privacy Shield. We do not mention it anywhere because we did not pre-certify with the new Privacy Shield before the deadline of September 30, 2016. Since we are not pre-certified, we can only gain any sort of self-certification with full compliance, whereas any companies that did pre-certify before that cut-off date receive a nine month grace period to bring their third-party relationships into compliance with the new standards.

We anticipate to be fully compliant and certified before that nine month grace period is up, which would put us alongside many other companies currently working towards compliance with the new standards. The only difference between us and many of them is that we did not get pre-certification and do not actively advertise ourselves as being compliant yet, because we can't. As per the Notice Principle of the Privacy Shield, we will notify all users of our participation within Privacy Shield once we self-certify.

  • 1
    Many thanks for your answer. However part of my concerns is that SE didn't post anything about how would it deal with the new privacy agreement, this makes me think privacy is not one of your main concerns...
    – llrs
    Commented Dec 3, 2016 at 15:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .