1.2 Normative references reads in part:

*****
U.S.-EU Safe Harbor

http://export.gov/safeharbor/eu/eg_main_018365.asp
*****

The link resolves to a website, something that looks unlikely to be something an implementer will conform to while implementing MQTT.

I suspect it was meant as general information and the only cite in the MQTT draft seems to support that reading. (Section 5)

Suggest moving this into 1.3 Non-normative references