You're kidding right?
Export.gov requires safe harbor companies to self certify. - The companies state every year that they provide adequate protection.
Self-certifying to the U.S.-EU Safe Harbor Framework will ensure that EU organizations know that your organization provides "adequate" privacy protection
That's all. No checks are made. No audit performed. There's noting to stop them lying, and companies HAVE lied - in their droves.