1. Forum INFOBALT 2002 Vilnius, October 21, 2002 Current ICC Initiatives Relating to Data Protection Christopher Kuner Hunton & Williams, Brussels Vice-Chair, ICC Special Advisory Group on E-Related Issues ckuner@hunton.com

2. What is ICC? The world business organization: Tens of thousands of member companies from over 140 countries Headquarters in Paris ICC Task Force on the Protection of Personal Data Participates in Council of Europe meetings Accomplishments include 1992 Model Contracts for Transborder Data Flows (with European Commission and Council of Europe), alternative model contracts for data transfer (with six other business groups)

3. Give an overview of several ICC activities pertaining to data protection: Paper on review of the General DP Directive Model Contracts for Data Transfer Spamming Data retention

4. Review of General DP Directive Commission solicited input from business groups on problems that have been identified in practice ICC submitted comments to Commission, participated in Brussels conference Sept. 30-Oct. 1

5. Issues Identified by ICC Major conclusions: –Differing implementations create unnecessary barriers to trade and the internal market –Many differences in implementation go beyond what one would expect as a result of Member State discretion

6. Issues Identified by ICC (2) Example: applicable law –Confusion between this issue and international data transfers –Differences in what is considered an “establishment” (FIN and S) –At a minimum, notification by non-EU data controllers should be possible in a single MS –International element in DP has become the rule, and Art 4 treats it as the exception

7. Issues Identified by ICC (3) Example: differing notification requirements –Some MSs allow it for free (FIN), some require moderate fee (UK) –Procedures can be lengthy and antiquated –Many DPAs admit that notifications are filed away and never looked at again –Not enough MSs provide legal incentives for company privacy officers

8. Issues Identified by ICC (4) Example: Transborder data flows –Some MSs still require a license even when using the Commission-approved model contracts (NL) –Some MSs allow controller to reach his own adequacy determination (UK), others have substantial bureaucratic requirements (E) –Urgent need for EU-wide mechanism allowing transfers which sidesteps national requirements (codes of conduct?)

9. Conclusions re General Directive Differing implementations are a problem for business and an unnecessary interference with the internal market Uniformity is not necessary, but differences should be kept to a minimum Since adequate protection exists throughout the Community, compliance with a single MS law should be sufficient barring exceptional circumstances Need for increased transparency regarding WP 29 and Committee 31 processes

10. Model Contracts for Data Transfer ICC has already published model contract jointly with Commission and Council of Europe (1992) Commission’s model controller-to-controller contracts not used in practice, since too onerous ICC and six other business groups have proposed an alternative model contract for approval Currently in negotiation with the Commission

11. Model Contracts for Data Transfer (2) Approach: same level of protection through different mechanisms Some major differences: –No joint and several liability –Realistic regime for onward transfers –Ability to use contract for global transfers within a company

12. Spamming Spamming is a huge problem for business –Increases costs –Irritates consumers Issue demonstrates limits of national and regulatory approaches ICC working on best practices and codes of practice for business to tackle the issue of spam

13. Data Retention Law enforcement authorities seeking increased access to communications data Dangers for business and human rights New ICC position paper: –Data preservation rather than data retention –Need for precise definition of traffic data –Retention and access should be kept to a minimum

14. For more information: ckuner@hunton.com www.iccwbo.org