The social networking operator said it depends on the agreement, which facilitates transfers of personal data from the EU to US-based servers, and suggested that it could be forced to build a new data centre in Europe or otherwise rearrange its IT infrastructure arrangements if the agreement is suspended.
"We rely upon the EU–US Safe Harbour framework to transfer certain personal information of European Union residents to the United States, and revocation of the Safe Harbour framework could require us to create duplicative, and potentially expensive, information technology infrastructure and business operations in Europe or limit our ability to collect and use personal information collected in Europe," Twitter said in its annual report for 2014 (113-page / 1.54MB PDF) filed to the Securities and Exchange Commission (SEC) in the US. "Any of these could disrupt our business."
EU data protection laws prevent companies from sending personal data outside of the European Economic Area (EEA) unless "adequate protections" have been put in place or in circumstances where the destination country has been pre-approved as having adequate data protection. Only a handful of countries, including Argentina, Canada and Switzerland, but not including the US, are deemed by the European Commission to provide adequate protection.
The European Commission and the US Department of Commerce have negotiated a separate Safe Harbour framework to facilitate personal data transfers between the EU and US. More than 3,000 US businesses are currently signed up to the framework.
However, MEPs have issued calls for the suspension of the Safe Harbour framework amidst concerns that the privacy of EU citizens is not adequately accounted for. A review by the European Commission, carried out following revelations about US intelligence gathering practices leaked to the media by whistleblower Edward Snowden, found "deficiencies in transparency and enforcement" in how the Safe Harbour framework works.
The Commission made 13 recommendations that it said would address its concerns and called on the US government to take steps to safeguard the privacy of EU citizens. It too has threatened to suspend the Safe Harbour framework if those measures are not implemented.