Publications

The United States Department of Commerce has recently published draft international safe harbor principles in response to European Union legislation relating to transfers of personal data. If officially adopted, the international safe harbor principles may have the effect of reducing the potential burden placed upon U.S.-EU trade and commerce by the EU legislation.

On April 14, 1999, Bob Langer, a Vice-chair of the Consumer Protection Committee of the Antitrust Section of the American Bar Association, co-moderated an ABA program in Washington, D.C., examining these and related issues, entitled Consumer Privacy Evaluating the Approaches of the FTC and the European Union. The EU Privacy Directive
To combat threats to individual privacy brought about by modern information technologies and to facilitate uniform data transfers within the European Union, the EU adopted the Directive on Data Protection on October 25, 1998. The Directive establishes strict guidelines for the processing, storage, and transfer of personal data. Significantly, from the U.S. perspective, the Directive requires that EU members not transfer personal data to nonmember countries which fail to ensure an adequate level of privacy protection. This privacy legislation applies to all Member States of the EU Belgium, France, Germany, Italy, Luxembourg, the Netherlands, the United Kingdom, Ireland, Denmark, Greece, Portugal, Spain, Austria, Finland, and Sweden. Each country must enact regulations to comply with the Directive.

The Directive provides that the adequacy of the data protection offered by a recipient country shall be assessed in light of all of the circumstances surrounding a data transfer. The factors considered include:

1. the nature ofthe data;
2. the purpose and duration of the processing mechanism;
3. the country of origin or final destination;
4. the laws of the destination country; and
5. the professional rules and security measures that apply within the recipient country.

Given the different approaches taken by the United States and the EU with respect to personal data privacy, the potential exists for the emergence of adequacy issues, which may result in barriers to U.S.-EU trade and commerce. A significant burden imposed by the Directive is that companies engaging in intra-organizational cross-border transfers must comply with the Directive.

The Draft Safe Harbor Principles
In order to diminish uncertainty and provide a more predictable framework for such data transfers, on April 19, 1999, the United States Department of Commerce published seven draft safe harbor principles. The draft safe harbor principles detail procedures which, if adhered to, will create a presumption of adequacy for the lawful receipt of data by U.S. organizations from the EU. The principles provide procedures for:

1. Notice;
2. Choice;
3. Onward Transfer;
4. Security;
5. Data Integrity;
6. Access; and
7. Enforcement.

Of particular interest are provisions which provide that those organizations wishing to transfer data allow individuals to opt in or out of disclosure in certain circumstances. Furthermore, the safe harbor will shield only those entities which provide individuals with reasonable access to their personal data. Additionally, in order to qualify for the safe harbor, entities receiving data may transfer that data only to third party organizations providing similar privacy protections.

If the safe harbor principles are officially adopted, organizations will qualify for safe harbor protection if they are subject to a rule making body that adheres to the principles, or if they join a private sector privacy program that adheres to the principles. The principles are intended for use solely by U.S. organizations receiving personal data from the European Union for the purpose of qualifying for the safe harbor and the presumption of adequacy it creates. However, it must be emphasized that the safe harbor principles are not yet effectivethey remain in draft form. The U.S. and EU issued a joint report on June 21, which notes that the two sides plan to finalize the safe harbor principles this Fall.