1. Transborder dataflows Flow of information across national borders Much of this data involves personal information

2. Examples of transborder personal data An American buys a book from a bookstore in England –Information on the sale and payment cross two national borders A Spaniard does contract work with a company in Canada –Information regarding payment crosses two national borders and earnings information is registered with two internal revenue agencies

3. National Differences Definition –US, Canada and France Define protections of personal data in terms of privacy –Most of the European countries Define it as data protection Omnibus legislation versus sectoral rules

4. More national differences US –Privacy issues are driven by consumerism and free trade—stress on free flow of information and often cite the First Amendment for support European and some other countries –Privacy issues and data protection policies protect fundamental rights of citizens— reflects belief that governments have a duty to protect privacy of citizens

5. Harmonization efforts Council of Europe adopted recommendations that information should be accurate, timely and relevant; confidentiality and security should be protected; individuals should have rights of access, notice, consent, correction—and went on to draft an international treaty— US did not sign it OECD adopted non-binding guidelines

6. Negotiations between US and EU Three key issues –Degree of individual control: opt-in versus opt-out for secondary uses—expectation in Europe is that personal information will not be exchanged; it is the opposite in the US –“Equivalent” or “Adequate” to the EU Directive before information can be transferred to or from an EU country –What type of government authority was necessary to enforce and oversee—most European countries have privacy commissions

7. Options First method: show that US policies were indeed adequate to the EU Directive—two US lawyers conducted study—no clear cut verdict Second method: individual contracts— didn’t have the force of law and didn’t involve sovereign nations Third method: negotiate an arrangement between EU and US—a “safe harbor”

8. Safe Harbor Principles Notice: notify individuals about purpose; any third party disclosures; contact information Choice: must provide opt-out as far as third party disclosure or incompatible use; opt-in for sensitive information Onward Transfer (third party): assure that the third party also follows notice and choice

9. Access: individuals must have access to personal information and right to amend or delete if inaccurate Security: reasonable precautions to protect information Data Integrity: personal information must be relevant for the purpose it is to be used; ensure data is reliable for intended use Enforcement: independent recourse mechanism

10. Private Sector Enforcement Must have dispute resolution system in place Must remedy problems arising out of noncompliance –Remedies have to be strong enough to encourage compliance –Must include publicity for findings of noncompliance

11. Government Enforcement Federal Trade Commission –Counts as unfair and deceptive trade practice Department of Transportation –Airlines and ticket agents

12. List of companies http://export.gov/safeharbor/