```

[House Hearing, 107 Congress]
[From the U.S. Government Publishing Office]

  THE EU DATA PROTECTION DIRECTIVE: IMPLICATIONS FOR THE U.S. PRIVACY 
                                 DEBATE

=======================================================================

                                HEARING

                               before the

                            SUBCOMMITTEE ON
                COMMERCE, TRADE AND CONSUMER PROTECTION

                                 of the

                    COMMITTEE ON ENERGY AND COMMERCE
                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED SEVENTH CONGRESS

                             FIRST SESSION

                               __________

                             MARCH 8, 2001

                               __________

                           Serial No. 107-19

                               __________

      Printed for the use of the Committee on Energy and Commerce

 Available via the World Wide Web: http://www.access.gpo.gov/congress/
                                 house

                               __________

                   U.S. GOVERNMENT PRINTING OFFICE
71-497                     WASHINGTON : 2001

_______________________________________________________________________
 For sale by the Superintendent of Documents, U.S. Government Printing 
                                 Office
Internet: bookstore.gpo.gov  Phone: (202) 512-1800  Fax: (202) 512-2250
               Mail: Stop SSOP, Washington, DC 20402-0001

                    COMMITTEE ON ENERGY AND COMMERCE

               W.J. ``BILLY'' TAUZIN, Louisiana, Chairman

MICHAEL BILIRAKIS, Florida           JOHN D. DINGELL, Michigan
JOE BARTON, Texas                    HENRY A. WAXMAN, California
FRED UPTON, Michigan                 EDWARD J. MARKEY, Massachusetts
CLIFF STEARNS, Florida               RALPH M. HALL, Texas
PAUL E. GILLMOR, Ohio                RICK BOUCHER, Virginia
JAMES C. GREENWOOD, Pennsylvania     EDOLPHUS TOWNS, New York
CHRISTOPHER COX, California          FRANK PALLONE, Jr., New Jersey
NATHAN DEAL, Georgia                 SHERROD BROWN, Ohio
STEVE LARGENT, Oklahoma              BART GORDON, Tennessee
RICHARD BURR, North Carolina         PETER DEUTSCH, Florida
ED WHITFIELD, Kentucky               BOBBY L. RUSH, Illinois
GREG GANSKE, Iowa                    ANNA G. ESHOO, California
CHARLIE NORWOOD, Georgia             BART STUPAK, Michigan
BARBARA CUBIN, Wyoming               ELIOT L. ENGEL, New York
JOHN SHIMKUS, Illinois               TOM SAWYER, Ohio
HEATHER WILSON, New Mexico           ALBERT R. WYNN, Maryland
JOHN B. SHADEGG, Arizona             GENE GREEN, Texas
CHARLES ``CHIP'' PICKERING,          KAREN McCARTHY, Missouri
Mississippi                          TED STRICKLAND, Ohio
VITO FOSSELLA, New York              DIANA DeGETTE, Colorado
ROY BLUNT, Missouri                  THOMAS M. BARRETT, Wisconsin
TOM DAVIS, Virginia                  BILL LUTHER, Minnesota
ED BRYANT, Tennessee                 LOIS CAPPS, California
ROBERT L. EHRLICH, Jr., Maryland     MICHAEL F. DOYLE, Pennsylvania
STEVE BUYER, Indiana                 CHRISTOPHER JOHN, Louisiana
GEORGE RADANOVICH, California        JANE HARMAN, California
CHARLES F. BASS, New Hampshire
JOSEPH R. PITTS, Pennsylvania
MARY BONO, California
GREG WALDEN, Oregon
LEE TERRY, Nebraska

                  David V. Marventano, Staff Director

                   James D. Barnette, General Counsel

      Reid P.F. Stuntz, Minority Staff Director and Chief Counsel

                                 ______

        Subcommittee on Commerce, Trade, and Consumer Protection

                    CLIFF STEARNS, Florida, Chairman

NATHAN DEAL, Georgia                 EDOLPHUS TOWNS, New York
  Vice Chairman                      DIANA DeGETTE, Colorado
ED WHITFIELD, Kentucky               LOIS CAPPS, California
BARBARA CUBIN, Wyoming               MICHAEL F. DOYLE, Pennsylvania
JOHN SHIMKUS, Illinois               CHRISTOPHER JOHN, Louisiana
JOHN B. SHADEGG, Arizona             JANE HARMAN, California
ED BRYANT, Tennessee                 HENRY A. WAXMAN, California
STEVE BUYER, Indiana                 EDWARD J. MARKEY, Massachusetts
GEORGE RADANOVICH, California        BART GORDON, Tennessee
CHARLES F. BASS, New Hampshire       PETER DEUTSCH, Florida
JOSEPH R. PITTS, Pennsylvania        BOBBY L. RUSH, Illinois
GREG WALDEN, Oregon                  ANNA G. ESHOO, California
LEE TERRY, Nebraska                  JOHN D. DINGELL, Michigan,
W.J. ``BILLY'' TAUZIN, Louisiana       (Ex Officio)
  (Ex Officio)

                                  (ii)

                            C O N T E N T S

                               __________
                                                                   Page

Testimony of:
    Aaron, David L., Senior International Advisor, Dorsey & 
      Whitney LLP................................................    42
    Henry, Denis E., Vice President, Regulatory Law, Bell Canada.    80
    Lawler, Barbara, Customer Privacy Manager, Hewlett Packard...    76
    Reidenberg, Joel R., Professor of Law, Fordham University 
      School of Law..............................................    66
    Rodota, Stefano, Chairman, EU Data Protection Working Party..     8
    Smith, David, Assistant Commissioner, Office of the UK 
      Information Commissioner...................................    14
    Winer, Jonathan M., Counsel, Alston and Byrd LLP.............    45

                                 (iii)

  

 
  THE EU DATA PROTECTION DIRECTIVE: IMPLICATIONS FOR THE U.S. PRIVACY 
                                 DEBATE

                              ----------                              

                        THURSDAY, MARCH 8, 2001

              House of Representatives,    
              Committee on Energy and Commerce,    
                       Subcommittee on Commerce, Trade,    
                                   and Consumer Protection,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 10 a.m., in 
room 2123, Rayburn House Office Building, Hon. Cliff Stearns 
(chairman) presiding.
    Members present: Representatives Sterns, Deal, Shimkus, 
Bryant, Buyer, Radanovich, Pitts, Bono, Walden, Bass, Tauzin 
(ex officio), Towns, DeGette, Doyle, Markey, and Gordon.
    Staff present: Ramsen Betfarhad, majority counsel; Yong 
Choe, legislative clerk; and Bruce M. Gwinn, minority counsel.
    Mr. Stearns. Subcommittee on Commerce, Consumer Protection, 
and Trade will convene.
    I like to start as much as possible right on time, so I 
hope we will start a precedent, so that members will understand 
that if we arrive early then we get things moving, and then we 
don't have to spend as much time here waiting.
    I welcome you all to the second hearing of the Subcommittee 
on Commerce, Trade, and Consumer Protection of the Energy and 
Commerce Committee. I especially want to acknowledge our 
distinguished guests from Europe, Professor Stefano Rodota, the 
president of the Italian Data Protection Commission and 
chairman of an EU Data Protection Working Group; and Mr. David 
Smith, Assistant UK Information Commissioner.
    I thank you for making the long journey and am pleased to 
have distinguished European officials such as yourself 
addressing our subcommittee. So thank you.
    My colleagues, the purpose of today's hearing is twofold. 
First, we seek to learn more about the European approach to 
information privacy. Second, we wish to consider the impact of 
the European Data Protection Directive on international 
commerce in general and e-commerce specifically.
    In highlighting the EU Data Protection Directive for 
consideration today, I hope we can get answers to the following 
questions. What is the directive? How is it implemented? How is 
it enforced? What, if anything, can we in the United States 
involved in the information privacy debate learn from the 
directive which encapsulates the European approach to 
information privacy? What implications does the directive 
harbor with relation to international commerce; specifically, 
transatlantic commerce? And what is the import of safe harbors 
and model contracts?
    My colleagues, the answers to these questions have 
significant implications for companies who want to do business 
in and with Europe. This hearing not only represents the 
subcommittee's second in a series of privacy hearings, but also 
represents the first hearing under the subcommittee's trade 
jurisdiction.
    In a coming week or 2, I expect to unveil the topic and 
time table of as many as five subcommittee hearings addressing 
the information privacy issue. Moreover, the subcommittee, as 
part of its trade jurisdiction, will begin to examine legal and 
regulatory measures that may impede the growth of e-commerce 
globally.
    I rely on the words of one of our witnesses in highlighting 
the significance of our inquiry today when he said, ``The EU 
privacy directive is probably the most important law by which 
the EU is writing the rules of cyberspace.''
    Mr. Winer is not alone in his concern. Many large 
transnational and even U.S. businesses with modest 
international operations have expressed the same concerns to me 
and other members in private.
    Raising issues of significant import to our increasing 
knowledge and information-based economy in my office is one 
thing. Raising those issues in a congressional hearing is a 
totally different matter. I encourage all companies and 
interested parties to engage and speak their views openly on 
this issue while we are still defining the parameters.
    I am concerned about the potentially regressive impact of 
the directive and its implementing statute now in effect in 11 
out of the 15 member states on international commerce, and more 
specifically on commerce between the European community and the 
United States. I am not convinced, nor is corporate U.S. 
America, that the safe harbor provisions negotiated by 
Ambassador Aaron in the previous administration will help 
mitigate the concern over regressive effects.
    The Ambassador has accurately noted, ``While we and the 
Europeans share many basic values, the European Union directive 
comes from a different legal tradition and historical 
experience.'' The safe harbor principles are reflective of 
those European traditions and experiences, and as such at times 
don't harmonize well with our American legal tradition and 
historical experiences.
    I encourage President Bush and the administration to begin 
the examination of this important issue on an expedited basis. 
By way of holding this hearing, we, as members of both the 
subcommittee and the full Energy and Commerce Committee, want 
to stress our keen interest in the trade ramifications of the 
directive. We will follow this issue carefully, and if need be 
we will make our wishes known in more definitized ways.
    And with that, I am pleased to recognize the ranking 
member, Mr. Towns.
    Mr. Towns. Thank you very much, Mr. Chairman, for holding 
this hearing. I think this is a very, very important hearing, 
and I want to salute you for that. And I would also like to ask 
permission to put my entire statement in the record.
    Mr. Stearns. Without objection, so ordered.
    Mr. Towns. We have all heard the terrible abuses that have 
occurred when personal information is misused. A person's job 
can be lost, their creditworthiness can be destroyed, and their 
personal peace of mind can also be destroyed.
    But privacy is not only a problem for consumers; it is a 
major issue for business as well. While privacy policies can 
limit business marketing opportunities, the effect of privacy 
policies on consumer confidence is a far more important fact in 
the future success of e-commerce.
    Today we will hear how the European Union has chosen to 
balance commercial and consumer privacy interests. And as in so 
many cases, we will learn how regulations in one country can 
threaten the ability of U.S. firms to engage in foreign 
commerce. Compliance with the EU Privacy Directive is not 
optional.
    In order to transfer personal data on any type out of the 
EU, a U.S. firm will soon be forced to comply. A firm that 
fails to comply can be blocked from transferring data out of 
the European Union.
    In conclusion, Mr. Chairman, let me say I am not interested 
in defending either the EU Privacy Directive or the safe harbor 
agreement. That is not my interest. However, I do believe that 
privacy protections need to be uniform, and they need to be 
transparent. Consumers should not have to hire law firms and 
investigators and negotiators to identify privacy protections 
that companies have agreed to provide in private contracts.
    Furthermore, no consumer, no matter where they live, is due 
any less than the highest privacy protection a company provides 
to any other consumer. When a company agrees to a particular 
privacy policy, it should provide everyone it serves with those 
same benefits.
    Finally, any privacy policy is meaningless unless it is 
enforceable. Therefore, government has an important part to 
play in making privacy enforceable.
    Mr. Chairman, I look forward to working with you on these 
matters. Consumers all over the world are demanding greater 
control over their personal data. This Congress has an 
important role to play in making sure consumers get the privacy 
protection they deserve, and I am certain that you will provide 
leadership in that regard.
    I yield back.
    [The prepared statement of Hon. Edolphus Towns follows:]

PREPARED STATEMENT OF HON. EDOLPHUS TOWNS, A REPRESENTATIVE IN CONGRESS 
                       FROM THE STATE OF NEW YORK

    Mr. Chairman, I want to thank you for holding this important 
hearing. Privacy is clearly one of the highest priority consumer 
protection issues we face. We have all heard the terrible abuses that 
have occurred when personal information is misused. A person's job can 
be lost. Their creditworthiness can be destroyed, as can their peace of 
mind.
    But privacy is not only a problem for consumers; it is a major 
issue for business. While privacy policies can limit business marketing 
opportunities, the effect of privacy policies on consumer confidence is 
a far more important factor in the future success of e-commerce.
    A survey conducted by AT Kearney management consultants and 
reported in November of last year in the publication ``BizReport'' 
confirms this point. Let me quote, ``E-retailers worldwide lose $6.1 
billion in sales, due to an 80 percent failure rate among online 
purchase attempts . . .'' and that ``Invasive information requests are 
blamed for 52 percent of sales that fall apart, followed by reluctance 
to enter credit card data (46 percent) . . '' Clearly, business is 
paying a big price for the confidence consumers lack in the privacy and 
security of their online transactions.
    Today, we will hear how the European Union (EU) has chosen to 
balance commercial and consumer privacy interests. And, as in so many 
cases, we will learn how regulations in one country can threaten the 
ability of U.S. firms to engage in foreign commerce. Compliance with 
the EU privacy directive is not optional. In order to transfer personal 
data of any type out of the EU, a U.S. firm will soon be forced to 
comply. A firm that fails to comply can be blocked from transferring 
data out of the EU.
    Because the U.S. has no comprehensive national privacy policy, much 
less one that is comparable to the EU directive, the EU has decided 
that all American firms lack adequate privacy protections for personal 
data. The privacy provisions of the recently enacted financial 
modernization legislation do not, according to the EU and many others, 
provide adequate privacy protection. U.S. firms, therefore, are in a 
bind.
    Recognizing this fact, the EU and the U.S. entered into a Safe 
Harbor Agreement last year. The Safe Harbor has one purpose. It allows 
certain U.S. firms to declare their compliance with agreed upon privacy 
protections that the EU does consider to be ``adequate,'' so that U.S. 
data firms can continue doing business in Europe.
    The way it works is that U.S. firms, and I am happy to say that one 
such firm--Hewlett Packard--is represented here today at this hearing, 
must certify to the Department of Commerce that they comply with the 
privacy protections in the Safe Harbor. Everything is public and is 
open for consumers and all to see. The Commerce Department's web site 
has both the privacy principles as well as the names of the 27 entities 
who, so far, have certified they comply with the Safe Harbor.
    Certain firms cannot take advantage of the Safe Harbor's 
protection. Financial institutions--banks, securities firms, and 
insurance companies--do not have safe harbor protection at this time. 
In fact, some financial and other firms have actually organized in an 
effort to convince the EU and the U.S. to terminate the Safe Harbor 
altogether.
    Instead, the only way for financial firms currently to comply is 
through the negotiation of private contracts either with their EU 
customers directly or with EU privacy officials in each country where 
they operate. It is unfortunate that we do not have a U.S. financial or 
other firm with us today who can tell us about the privacy contracts 
that have been negotiated. Although we may assume, we do not actually 
know the extent to which these contracts comply with the privacy 
directive. We also do not know the extent to which U.S. firms are 
offering EU consumers privacy protections they deny their U.S. 
consumers. Hearing from someone in the financial services industry 
could have helped clarify these matters.
    In conclusion Mr. Chairman, let me say, I am not interested in 
defending either the EU privacy directive or the Safe Harbor Agreement. 
However, I do believe that privacy protections need to be uniform, and 
they need to be transparent. Consumers should not have to hire law 
firms and investigators to identify privacy protections that companies 
have agreed to provide in private contracts.
    Furthermore, no consumer, no matter where they live, is due any 
less than the highest privacy protection a company provides to any 
other consumer. When a company agrees to a particular privacy policy, 
it should provide everyone it serves with those same benefits. Finally, 
any privacy policy is meaningless unless it is enforceable. Government, 
therefore, has an important part to play in making privacy enforceable 
and uniform.
    Mr. Chairman, I look forward to working with you on these important 
matters. Consumers all over the world are demanding greater control 
over their personal data. This Congress has an important role to play 
in making sure consumers get the privacy protection they deserve.

    Mr. Stearns. I thank my colleague.
    Mr. Shimkus, gentleman from Illinois?
    Mr. Shimkus. Thank you, Mr. Chairman. We appreciate this 
hearing, and I think it has great implications, as everyone has 
said.
    The UE Privacy Directive has important implications for 
U.S. companies who are doing or want to do business with Europe 
and with our largest trading partner. But I want to put on 
record my concern, after hearing the decision rendered by the 
European Court of Justice earlier this week, that allows the 
European Union to lawfully suppress political criticism of 
institutions and of leading figures.
    In this country, in the history of our country, we have 
basically had some distrust of national government, 
symbolically, in the creation of the Bill of Rights to our 
Constitution over 200 years ago. In so doing, the first one 
being the First Amendment, freedom of speech, what the 
implication is here is that our--probably our strongest allies 
and democratic countries may not have that faith and trust in 
the freedom of expression, of political expression.
    This decision is very disturbing, one that could have major 
implications on the privacy issue and an impact on future 
business relations between the U.S. and EU companies. And I 
hope that we will have some addressing of this issue in this 
hearing.
    I do appreciate the long distance you all have traveled. I 
just did the same trip 3 weeks ago as a member of the NATO 
Parliamentary Assembly. We visited the UE Commission, and I 
think next year we're going to have a chance to visit the UE 
Parliament with discussions on transatlantic issues of great 
importance to us. But I think this hearing is very, very 
important, and I look to be a full participant.
    And I thank the Chairman and yield back my time.
    Mr. Stearns. I thank my colleague.
    The gentleman from New Hampshire, Mr. Bass?
    Mr. Bass. No statement.
    Mr. Stearns. The gentleman from Indiana, Mr. Buyer?
    Mr. Buyer. No statement.
    [Additional statements submitted for the record follow:]

 PREPARED STATEMENT OF HON. W.J. ``BILLY'' TAUZIN, CHAIRMAN, COMMITTEE 
                         ON ENERGY AND COMMERCE

    I want to start by thanking Subcommittee Chairman Stearns for 
calling the first ever Congressional hearing, in either the House or 
Senate, specifically focused on the EU Privacy Directive. The topic of 
today's hearing is extremely relevant to the Committee's consideration 
of privacy and information exchange issues.
    The development of electronic commerce has accentuated the fact 
that the U.S. economy is interdependent on the rest of the world. The 
Internet and other electronic networks expand the ability of businesses 
to reach new or untapped markets worldwide. These technologies 
fundamentally shrink the size of the globe. Policies affecting 
electronic commerce made by the world's largest trading block--the 
European Union--have an impact on the U.S. It also has an impact on how 
the U.S. Congress will approach the debate over privacy.
    The U.S. and EU Member States approach the issue of privacy from 
different perspectives. Europeans are instilled with the belief that 
privacy is a fundamental human right. There are a number of reasons for 
this belief, including the vast and traumatic experiences of the Nazi 
regime during the 1940's. Another reason for this perspective is the 
simple fact that many EU countries are relatively new democracies. It 
was not long ago that Kings and Queens ruled throughout Europe. In the 
U.S., we take a different approach towards privacy as we have 
fundamental protections to free expression provided in the U.S. 
Constitution, including the First Amendment. By in large, we also rely 
heavily on the private sector to protect consumer privacy.
    I believe that the EU Privacy Directive may act as a de-facto 
privacy standard on the world. It may or may not be permissible under 
the WTO because of the technical structure and specific carve-outs, but 
it certainly is an effort to impose the EU's will on the U.S. While I 
recognize that similar charges have been laid against certain U.S. 
policies, the EU Privacy Directive could be the imposition of the one 
of the largest free trade barriers ever seen and is a direct reversal 
of the efforts we have made in various free trade agreements. It 
certainly provides for extraterritorial enforcement of EU principles on 
Americans and American companies.
    I have serious reservations about the real impact of the EU Privacy 
Directive on commerce and trade. I am very concerned that U.S. 
companies, which have been the creators and the leaders of E-commerce, 
will be forced to deal with such a restrictive concept. I would love 
for someone to provide some type of compliance cost analysis for the 
Privacy Directive but that simply hasn't been done. I suspect the costs 
would be in the multi-billions, and are all costs that will be passed 
onto consumers.
    One of the many drawbacks of imposing something like the Privacy 
Directive on the entire world is that one-size does not fit all. 
Europeans do not view lawsuits as an answer to problems. In the U.S., 
lawsuits are filed at the drop of a hat. A stock dropped too much or 
too fast, a lawsuit gets filed. A neighbor's dog barks too loud, a 
lawsuit gets filed. That is a reality that we have to deal with. 
However, such lawsuits could cripple the beneficial exchange of 
information that is a cornerstone of American business practices today.
    Compliance and enforcement of the Privacy Directive has, at best, 
been spotty in European nations. In fact, a number of nations have not 
even bothered to required enact implementing legislation. This lax 
attitude is something that Americans are not used to. We do not build 
elaborate restrictions with a wink and a nod so they can be ignored. 
Given this, we need to know whether enforcement of the Privacy 
Directive on U.S. companies represent a double standard when compared 
to enforcement of European firms. We also need to know the consequences 
for competition if this occurs.
    I must admit that I take a dim view about the way that the EU went 
about enacting this new privacy regime. The EU designed the rules and 
told the U.S. companies to abide by them or risk losing the transfer of 
any data from European nations. In essence, do it or suffer the 
consequences. There was no international negotiations. The U.S. was 
allowed to participate in negotiations resulting in the so-called 
``Safe Harbor'' but it is interesting to note that very few firms have 
signed up for it.
    The Safe Harbor raises a whole host of issues in and of itself. For 
instance, the legal status of the Safe Harbor is highly questionable. 
Further, the Safe Harbor doesn't cover financial firms. Indications are 
that privacy provisions of the ``Gramm-Leach-Bliley'' Financial 
Services Modernization Act are not ``adequate'' for purposes of the 
Privacy Directive. This is non-sense, as many people make a compelling 
case that these provisions are too strong. More importantly, what are 
global financial firms to do? They don't qualify for the Safe Harbor 
and U.S. law, which they must obey, is being overrun by the Privacy 
Directive.
    Recently, the EU has been designing so-called ``model contracts'' 
that can be used to meet the stringent requirements of the Privacy 
Directive. Many experts have suggested that the model contracts will be 
imposed on U.S. firms as a way to ``top-off'' or strengthen the Safe 
Harbor. This seems to directly contradict the purpose of the Safe 
Harbor and the negotiations that took place. Was the Department of 
Commerce duped into supporting the Safe Harbor? Are the Europeans 
really trying to find ways to strengthen the Privacy Directive?
    I am hopeful that this hearing will provide some insight and 
provide some comfort regarding the EU Privacy Directive. Unless or 
until that occurs, I think it only appropriate to consider all the 
options this Committee can take. Many have asked for our assistance in 
steering the new Administration towards the proper perspective on this 
issue. I think we should give serious consideration to doing just that.
                                 ______
                                 
  PREPARED STATEMENT OF HON. MIKE DOYLE, A REPRESENTATIVE IN CONGRESS 
                     FROM THE STATE OF PENNSYLVANIA

    Mr. Chairman, thank you for calling this hearing to discuss the 
issue of personal data privacy as it relates to international e-
commerce and trade. E-commerce transcends global boundaries at light-
speed, literally bringing the world to individual consumers and 
industries and offering an unprecedented opportunity for advancement 
and economic growth.
    During last week's hearing, I voiced my concerns that in the past, 
over-zealous federal regulations sometimes created unnecessary burdens 
on business. I firmly believe that it is the responsibility of the 
federal government to find the most appropriate balance that ensures we 
do not unintentionally choke out our emerging high-technology e-
commerce sector while at the same time providing floor requirements 
relating to basic privacy protections for consumers and industry alike.
    And while I find the European Union approach towards personal data 
protection noble insofar as they recognize the importance of an 
individual's control over the sharing of personal information, it goes 
without saying that applying such government actions here in the United 
States would raise some troublesome issues and almost surely conflict 
with the Constitution.
    But, if we in America do not act to establish some general 
requirements to ensure the integrity of personal privacy for our 
citizens and global consumers, both Americans and Europeans may very 
well risk losing out on vast economic opportunities.
    Here in the United States, the Safe Harbor provisions represent a 
good start, but lack they comprehensive application to all sectors of 
our economy. In my view, it is important that the same, uniform minimum 
standards are applied to all transactions involving online personal 
privacy, regardless of the particular economic sector they may fall.
    While the European Union Privacy Directive is a source of concern 
to me on various levels, I do believe that it serves, as does this 
hearing, as a catalyst for discussion and implementation of real online 
personal privacy protections.
    No doubt that several US firms, separate from the Safe Harbor 
principles, have negotiated with the European Union to ensure the 
security of personal data is maintained when conducting transatlantic 
e-commerce. Such aggressive industry self-regulation is just the type 
of proactive, responsible action that assuages consumer unease and 
concern with e-commerce privacy.
    In my view, an effective blend of industry self-regulation within a 
comprehensive framework of federal minimum standards must become the 
new standard for 21st century e-commerce in the United States if our 
industries and consumers are to continue to capitalize on high-
technology sector growth.
    Mr. Chairman, I am eager to work with you and my colleagues of the 
Subcommittee on ways to facilitate the prosperity global e-commerce.
                                 ______
                                 
PREPARED STATEMENT OF HON. BOBBY L. RUSH, A REPRESENTATIVE IN CONGRESS 
                       FROM THE STATE OF ILLINOIS

    Mr. Chairman, thank you for holding this important hearing on the 
European Union Privacy Directive. I particularly want to thank 
Professor Rodota and Mr. Smith for traveling such a long distance to 
discuss this important topic. This hearing is significant for two 
reasons.
    First, ensuring an ongoing dialogue between the European Union and 
the United State regarding the EU's Privacy Directive and its 
underlying purpose is critical for ensuring continued and uninterrupted 
trade between our nation and the countries which make up the European 
Union. The European Union is one of our most valued trade partners. 
However, it is clear that the United State's privacy laws in many 
sectors of our economy do not meet the strict standards of the European 
Union Privacy Directive. Only by working together can we ensure that 
the inadequacy of U.S. privacy laws and strength of the European 
Union's Privacy Directives do not lead to disruption in our strong 
trade relationship.
    Second, we in the United States can learn a great deal from the 
European Union's Privacy Directive. The United States does not have a 
comprehensive privacy policy. Some sectors of our economy have no 
protections what so ever. Also, in some cases, information is 
susceptible to misappropriation and misuse. Also, in many cases 
enforcement is limited to government action because no private cause of 
action is provided. The European Union's Privacy Directive represents 
an example of a strong law covering many different types of information 
which provides extensive enforcement mechanisms.
    However, the European Union's Privacy Directive is not without its 
faults. Some would argue that it covers information which is clearly 
public. We in Congress need to learn from the European Union's efforts 
what works and what doesn't. It provides one of the clearest examples 
of what is feasible and infeasible.
    I commend the witnesses from Europe for their work in this area and 
those witnesses who have worked with the European Union to ensure their 
is no disruption in the trade relationship between the United States 
and the European Union.

    Mr. Stearns. With that, we will have the first panel, 
Professor Stefano Rodota, Chairman, European Union Data 
Protection Working Group, and Mr. David Smith, Office of the UK 
Information Commissioner.
    I want to thank, again, both of you for your coming the 
long distances, and I look forward to your opening statement. 
So you can give your opening statement right now if you would. 
Professor, we will start with you.

   STATEMENTS OF STEFANO RODOTA, CHAIRMAN, EU DATA PROTECTION 
WORKING PARTY; AND DAVID SMITH, ASSISTANT COMMISSIONER, OFFICE 
               OF THE UK INFORMATION COMMISSIONER

    Mr. Rodota. Thank you, Mr. Chairman. Thank you for inviting 
me to testify today at this important hearing.
    I am Stefano Rodota. I am the Chairman of the Italian Data 
Protection Commission. I am also a professor of law, and I have 
been for several years a member of the Italian Parliament and 
of the European Parliament. So I shared the same responsibility 
you have now.
    So I am chairman of the Data Protection Working Group 
established by the European directive of data protection passed 
by the European Parliament, as you know, and the Council in 
1995. And I must say that when compared to other pieces of 
European legislation, the directive presents a prominent 
feature. It aims at protecting fundamental rights and freedoms, 
although this objective is twinned with the free movement of 
services.
    This approach has been recently stressed by a major 
development in the charter of fundamental rights of the 
European Union signed in December of last year by the European 
Parliament, the Council----
    Mr. Stearns. Professor, could I have you pull the speaker 
up just a little closer to you?
    Mr. Rodota. Oh, yes.
    Mr. Stearns. Yes. That will be fine.
    Mr. Rodota. Yes, sorry.
    Mr. Stearns. No, no. That is fine. Thanks.
    Mr. Rodota. It is better.
    Mr. Stearns. Yes, that is better.
    Mr. Rodota. Oh, thank you.
    So I was saying that I would like to stress that the same 
approach was shared by the charter of the fundamental rights of 
the European Union passed in December of last year by the 
European Parliament, the Council, and the Commission. And two 
specific provisions are devoted to privacy and data protection.
    So now data protection must be considered a fundamental 
human right, and the same chart makes reference to the 
necessity of an independent authority.
    These independent authorities, existing in all 15 countries 
in Europe, meet together in the Data Protection Working Party, 
which is also called Article 29 Group. And this group has an 
advisory status and acts independently, and since its creation 
has adopted several recommendations and opinions.
    In Italy, the directive was implemented by the Data 
Protection Act in 1996, and then complemented by secondary 
legislation and, I would like to stress, by a number of codes 
of conduct which represent an important factor of flexibility.
    I can leave you an English version of the Act, together 
with the articles of the European chart.
    Mr. Stearns. By unanimous consent, we will make that part 
of the record.
    Mr. Rodota. Yes. Thank you.
    At that time, in 1996, Italy was the only member state of 
the European Union, together with Greece, without a specific 
data protection law. But you know what technologies say--using 
appropriate technologies, late comers can make a leap frog. 
Something like that happened in Italy. Using the European law, 
and transposing immediately for all the member states the 
directive into its legal system, Italy jumped at the top of the 
European data protection.
    The implementation of the law has not been easy, but the 
societal effects are astonishing. Our Commission has been 
dealing during the past 4 years with nearly 100,000 offers 
submitted by phone, fax, e-mail, writing, and as formal 
requests to the Commission acting in alternative to the 
judiciary.
    Statistically, the main people's concern regards health 
insurance, telecommunications, direct marketing, labor 
relationship, police data, banks. People can act directly 
toward the data controller. For instance, 4 million customers 
asked banks not to send them commercial advertising. The 
implementation of the law raised more resistances in the public 
administration than in the private sector that has not at all 
suffered the dramatic consequences foreseen by some interested 
circle.
    So the high level of data protection legally in the UE 
indicates an amassing paradox. Privacy was invented in the U.S. 
and has long been considered to be typical of the American 
society. Europe now is the region of the world where maybe 
personal data is most protected--are most protected. This does 
not mean, however, that--in my opinion, that European-U.S. 
systems are mutually opposed.
    It is an instance of misrepresentation to simplify the 
picture by making Europe the domain of law and the U.S. the 
domain of self-regulation. Indeed, it is exactly the framework 
provided by European directives and national laws which is 
making it possible to develop self-regulatory codes and 
contract models on a larger scale.
    And at the same time, we recognize that many highly 
sensitive issues are being dealt with in the U.S. by means of 
legislative tools. We have been impressed, for instance, by the 
Executive Order to prohibit the use of genetic data for Federal 
employees. We must take this perspective seriously. We cannot 
accept a full-speed world in the data protection field, more 
and more one of the most important and critical matters in the 
globalized world.
    Many devices can be used--national legislation, regional 
rules like in European Union, international guidelines, model 
contracts, and, finally, international conventions. We must 
provide a common framework.
    In my double capacity, I would like to work in this area. 
For making possible more fruitful cooperation, the working 
group is now planning a visit in the U.S. mid-June.
    Coming back to the directive, it has been implemented in 
eleven out of the 15 EU member states. Of course, the European 
Commission has started an infringement procedure against the 
four member states that have not yet notified the implementing 
measures--France, Germany, Ireland, and Luxembourg.
    However, if we consider both the core principles and the 
creation of supervisory authorities, I would say that almost 
all member states are now in line with the fundamentals of the 
directive.
    Germany and France are, for different reasons, in a similar 
paradox. They are late in passing the implementing measures. 
However, their data protection legislation is sound and well 
established. According to some observers, this paradox shows 
that adapting old laws may prove harder than passing a brand-
new law.
    The Netherlands seem to have experienced one of the most 
interesting parliamentary debates. This was prompted by an 
amendment aimed at excluding the private sector from the 
jurisdiction of the Data Protection Authority. The business 
community argued that they would feel more comfortable with the 
powers of self-disciplinary bodies, but the amendment was 
rejected because the Dutch government found that it may have 
been incompatible with the directive.
    So all member states share now the same values and are 
legally bound by the same core principles, directly connected 
with a strong commitment to make effective fundamental human 
rights in this very sensitive area.
    It means that also commercial and economic interests must 
be evaluated in this broader context. At the same time, the 
directive was aware of the problem of transferring that outside 
the European Union. The well-known Articles 25 and 26 reflects 
these concerns through a reference to an adequate level of data 
protection. Until now only Canada, Switzerland, and Hungary 
have met the adequacy test in the judgment of Article 29 
working party.
    At the same time, Articles 25 and 26 have made possible 
and--made possible to buildup a completely new system based for 
the U.S. on the safe harbor entered in force on October 25 last 
year--a special opportunity given to the U.S. company. But we 
have also the new adequacy system, including the standard 
contractual clauses, and the draft by the Commission services, 
and that I received the positive opinion of the Article 29 
working group.
    In my opinion, such clauses are crucial in ensuring 
transborder data flow because----
    Mr. Stearns. Professor, if you don't mind, we just have----
    Mr. Rodota. I will stop. I am ending.
    Mr. Stearns. Sure.
    Mr. Rodota. Just 1 minute. Are crucial because many 
companies make business on a global scale and because data 
flows from the European Union are not linked to the U.S. Both 
systems will be experimented with. It will be especially 
interesting to evaluate the enforcement system.
    It does not work, however, that here are interesting 
developments in the attitude of the business community. More 
and more privacy protection is considered a value to be offered 
with goods and services. Opt-in and not opt-out has been 
indicated as the best approach by prominent European companies 
during their hearing before the European Parliament last 
January.
    So we are living in a transitional period and indeed need 
cooperation as wide as possible. Thank you for giving me this 
opportunity. May I conclude with my very best wishes for your 
future discussions which are crucial for the democratic values 
that we share.
    Thank you very much.
    [The prepared statement of Stefano Rodota follows:]

  PREPARED STATEMENT OF STEFANO RODOTA, CHAIRMAN, EU DATA PROTECTION 
                             WORKING PARTY

    Mr Chairman, Honourable Members, Thank you for inviting me to 
testify today at this important hearing. My name is Stefano Rodota, and 
I am the Chairman of the Data Protection Working Party that was 
established by the EU Directive on the protection of physical persons 
with regard to the processing of personal data. This Directive was 
passed by the European Parliament and the Council in 1995, that is 
after 5 years of fierce discussions on the proposal presented by the 
European Commission in 1990: passing legislation on such a complex 
issue is not easy--neither in the EU nor in the US, you will say . . .
    Since the creation of a Data Protection Commission in Italy (1997) 
I also wear the hat of Privacy Commissioner, and in this capacity I 
would like to share with you a couple of ideas on the concrete 
implementation of the Directive in my country. Before doing that, may I 
say something about the European approach to privacy and data 
protection, that may explain some of the difficulties that we have 
experienced in bridging the gap with the approach of the US Government.
    When compared to other pieces of European legislation, the 
Directive presents a prominent feature: it aims at protecting 
``fundamental rights and freedoms'', although this objective is twinned 
with the free movement of information and services. This approach has 
been recently stressed by a major development: in the Charter of 
Fundamental Rights of the European Union, that was signed in December 
2000 by the European Parliament, the Council and the Commission, two 
specific provisions are devoted to privacy and data protection. Let me 
quote them.
            Article 7, Respect for private and family life.
    Everyone has the right to respect for his or her private and family 
life, home and communications.
                Article 8, Protection of Personal Data.
    1. Everyone has the right to the protection of personal data 
concerning him or her.
    2. Such data must be processed fairly for specified purposes and on 
the basis of the consent of the person concerned or some other 
legitimate basis laid down by law. Everyone has the right of access to 
data which has been collected concerning him or her, and the right to 
have it rectified.
    3. Compliance with these rules shall be the subject to control of 
an independent authority.
    These independent authorities, as you know, meet together in the 
Data Protection Working Party, which is also called ``Article 29'' 
Group, although its powers are to be found in Article 30 of the 
Directive. The Working Party, that I'm honoured to chair since last 
year, has an advisory status and acts independently. Since its 
creation, it has adopted a number of Recommendations and Opinions, some 
of which were devoted to the different versions which led to the final 
shape of the ``Safe Harbor''. All these documents are available to the 
public at the following web page: http://www.europa.eu.int/comm/
internal__market/en/media/dataprot/wpdocs/
The Italian experience.
    In Italy, the Directive was implemented by the Data Protection Act 
(1996). This Act is being complemented by secondary legislation and--
may I stress this aspect--by a number of Codes of conduct, which 
represent an important factor of flexibility. All the relevant 
documents are available at: http://www.garanteprivacy.it
    Judging from my personal experience on the ground, I can testify 
that the provisions by which the Directive was implemented in Italy are 
being invoked on such a wide range of issues that were probably hard to 
imagine when the law was passed--there are over 2,000 claims pending 
before the Garante, covering almost all business areas and 
administration branches--but no company has gone out of business--nor 
has it suffered the dramatic consequences that were anticipated by some 
interested circles. In Capitol Hill, you are in a good position to know 
that lobbying groups sometimes tend to exaggerate the cost of new 
legislation. In earlier times, the same happened during the 
Parliamentary discussions on child labour legislation, but nobody today 
would argue that such legislation was not appropriate.
    When the Directive was passed (1995) in Italy there was no 
legislation in this area, and the issue was virtually confined to the 
academic and literary circles. In less than 4 years, the word 
``Privacy'' has entered into the daily vocabulary of the average 
Italian (without any Italian translation: the media and the man in the 
street just say ``Privacy'', and they seem to know what they mean). 
Sometimes I'm myself puzzled about that.
    The widespread use of the word ``Privacy'', in Italy and in other 
non-English speaking countries, indicates an amazing paradox. Privacy 
was ``invented'' in the US, and has long been considered to be typical 
of American society. Still, Europe is nowadays the region of the world 
where personal data is most protected--so much so that the Charter of 
Fundamental Rights of the European Union has recently included data 
protection among fundamental human rights (see Article 8, quoted 
above).
    This does not mean, however, that the European and the US systems 
are mutually opposed or absolutely irreconcilable. For instance, it is 
an instance of misrepresentation to simplify the picture by making 
Europe the domain of law and the US the domain of self-regulation. 
Indeed, it is exactly the legislative framework provided by EU 
directives and national laws which is making it possible to develop 
self-regulatory codes and contractual models on a large scale. At the 
same time, many highly sensitive issues and topics are being dealt with 
in the USA by means of legislative tools, as shown by the many laws 
passed in the US at the State level and by the Executive Order issued 
by Clinton on 8 February 2000 to prohibit the use of genetic data for 
federal employees.
The implementation of the Directive in other EU countries
    The Directive has been implemented in 11 out of the 15 EU Member 
States. The deadline for implementation was October 1998 and of course, 
as in many other policy areas, the European Commission has started an 
infringement procedure against the four Member States that have not yet 
notified the implementing measures (France, Germany, Ireland and 
Luxembourg). It is the Commission's duty, and I strongly hope that this 
will help in completing the implementing process. However, if we 
consider both the ``core principles'' of data protection and the 
creation of Supervisory Authorities, I would say that almost all Member 
States are now in line with the ``fundamentals'' of the Directive 
(please, don't ask me to name the one or two countries that may still 
make an exception).
    Germany and France are, for different reasons, in a similar 
paradox: they are late in passing the implementing measures; however, 
their data protection legislation is sound and belongs to the best 
established in Europe (the two were the main source of inspiration of 
the European Directive). According to some observers, this paradox 
shows that ``adapting'' old laws may prove harder than passing a brand 
new law, but the case of Germany is certainly made more complex by the 
Federal structure of the State, that implies several levels of 
discussion.
    The Netherlands seem to have experienced one of the most 
interesting parliamentary debates. As far as I understand, this was 
prompted by a major initiative aimed at excluding the private sector 
from the ``jurisdiction'' of the Data Protection Authority: roughly 
speaking, the business community argued that they would feel more 
comfortable with the powers of self-disciplinary bodies, and they found 
sympathetic ears in the Dutch Parliament; an amendment to this purpose 
was tabled, but the Dutch Government found that it may have been 
incompatible with the Directive, and the idea was finally rejected.
The provisions of the Directive with regard to transborder data flows
    A prominent feature of the EU approach, if compared to the US 
privacy debate, is that the Directive provides with a single framework 
which applies irrespective of the business sector concerned, and 
regardless of the nature of the data controller (public or private 
body), although some broad exceptions are allowed.
    In the recent past, some observers have argued that, since the 
Directive had been drafted at the time of mainframe computers, its 
provisions would be outdated in the Internet era. The experience gained 
in the meantime points to the opposite conclusion: all the core 
principles established by the directive, such as the right of access, 
rectification, deletion and the right to damages are drafted in a way 
that copes with technology developments, and they work properly 
irrespective of the technology used to process personal data.
    Incidentally, a similar debate took place with regard to the OECD 
Privacy Guidelines, that are based on the same core principles. At the 
end, as you know, the applicability of the OECD Guidelines to 
electronic commerce was reaffirmed by the Ministerial Conference held 
in Ottawa in 1998, although the Guidelines are much ``older'' than the 
Directive (OECD Guidelines: 1980, EU Directive: 1995!).
    Of course, the Internet revolution carries its lot of new 
challenges, but these normally concern the issues of applicable law and 
jurisdiction, rather than the content of the substantive rules, and 
this is the same kind of problems that does arise in many other areas 
of Law.
    To be concrete, may I give you one example: which law applies to 
the online collection of personal data from individuals of country 
``A'' by a company established in country ``B'' using a server located 
in country ``C''?
    When the countries concerned are within the European Union, the 
answer is simple: the law of Member State ``B'', that is the country in 
which the company is established. In my opinion, this solution is well 
balanced:

 on the one hand, it allows data controllers to comply with one 
        single set of rules (instead of 15 or more), and this is very 
        business-friendly;
 on the other hand, it protects citizens from the possible 
        circumvention of their rights: using a server located in a 
        third country would be an easy route to circumvention, but what 
        matters for the Directive is the country in which the economic 
        activity of the controller is located.
    This approach makes sense, as all Member States share the same 
values and are legally bound by the same ``core'' principles, enshrined 
in the Directive. Of course, the above applies only insofar as the data 
controller is established in a EU Member State: where this is not the 
case, the issue is far more complex. If the data controller is 
established in a country with ``no rules'' on data protection, the same 
approach would result in the absolute lack of guarantees for the data 
subject, whose personal data could be processed without any 
restriction.
    In my opinion, there is therefore a case for an International 
instrument on data protection, as recently stressed in the ``Venice 
declaration'' by all the colleagues convened at the 22nd International 
Conference on Privacy and Data Protection.
    However, in the absence of an international instrument, the 
Directive has established two very important safeguards:

1. By requiring that Member States apply the Directive where the data 
        controller is established in a third country but processes 
        personal data using equipment located in the EU territory 
        (Article 4c);
2. By the well known ``Article 25'', that prompted a number of alarming 
        articles in the US press, warning against what was called ``the 
        Great Wall of Europe'': according to this provision, personal 
        data can be transferred from the EU to third countries only if 
        the receiving country ensures an ``adequate'' level of data 
        protection. Until now, only Canada, Switzerland and Hungary 
        have met the ``adequacy test'' in the judgement of the Article 
        29 Working Party.
    I agree that Article 25 sounds like a bold provision. However, to 
be understood, this general rule must be read together with the many 
exceptions established by Article 26, which allow a significant degree 
of flexibility (examples: the data transfer is allowed if the 
individual has given his unambiguous consent, or where necessary for 
the performance of a contract with the data subject, or to protect his 
vital interests, and so on). In addition, data transfers can also take 
place where the controller adduces appropriate safeguards, that can be 
offered by way of contractual provisions.
    As you probably know, standard contractual clauses have been 
drafted by the Commission Services and have received the positive 
Opinion of the Data Protection (``Article 29'') Working Party. In my 
opinion, such clauses are crucial in ensuring transborder data flows, 
because many companies make business on a global scale and because data 
flows from the EU are not limited to the US. These clauses, when 
adopted, will not be mandatory but if companies choose to use them, 
they will be able to cut out most of the administrative loops which the 
contractual route otherwise requires.
The Safe Harbor
    The Safe Harbor is living proof that the Directive allows 
significant flexibility. In finding that the SH offers adequate 
protection, the European Commission may have gone beyond the letter of 
Article 25, which refers to ``domestic law'' or international 
commitments, and has accepted a set of rules that are proposed to US 
companies on a voluntary basis, but I will not re-open that debate: all 
that I want to stress, is that on the European side there has been a 
lot of good will.
    I understand that, until now, only twenty five US organisations 
have adhered to the Safe Harbor, and it is to be hoped that their 
number will increase, after all the commendable efforts that were 
deployed on both sides to secure the deal.
    Mr Chairman, Honourable Members, thank you for giving me the 
opportunity to testify. May I conclude with my very best wishes for 
your future discussions, which are crucial for the democratic values 
that we share.

    Mr. Stearns. Thank you, Professor Rodota.
    We are going to recess now. We have possibly two votes on 
the House floor.
    So, Mr. Smith, we will reconvene after we come back, and we 
ask for your patience.
    And I think with the two votes it will be difficult to set 
a time, because I think one of them is an adjournment vote. So 
we will reconvene probably perhaps in about 20 minutes, 25 
minutes.
    [Brief recess.]
    Mr. Stearns. The Subcommittee on Commerce, Trade, and 
Consumer Protection will reconvene.
    And, Mr. Smith, thank you for your patience, and we look 
forward to your opening statement.
    I say to my colleagues, we are giving each of these 
gentlemen 10 minutes, instead of the customary 5 minutes, 
because of the distance they have traveled and also as a 
courtesy so that we can really have an impact from all of their 
feelings on this issue.
    So, Mr. Smith, you have the floor for an opening statement.

                    STATEMENT OF DAVID SMITH

    Mr. Smith. Thank you very much, Chairman, and thank you for 
allowing me some extra time.
    I am David Smith, Assistant Information Commissioner from 
the United Kingdom. I work for Elizabeth Franz, the UK's 
Information Commissioner, recently renamed Information 
Commissioner to reflect duties she has under the UK's new 
Freedom of Information Act. She was formerly Data Protection 
Commissioner. She continues as the UK's independent supervisory 
authority, and it is in that role that I am here and I will 
talk.
    So I can't act as a representative either of the European 
Commission or even of the UK government. I am a representative 
of the UK's independent supervisory authority.
    I won't go through my testimony in great detail. I am happy 
to answer questions in relation to it. I will just highlight 
one or two points.
    It starts with the origins of data protection law, 
particularly in the UK. And as Professor Rodota said, we do see 
data protection law as an aspect of human rights, individuals' 
rights to have some knowledge of the information that is kept 
and used about them, a right to some control over who has 
access to that information, and how they use it, and some 
safeguards and rules that we know businesses that keep that 
information will abide by.
    That is exemplified in Europe in the Council of Europe 
Convention on Data Protection, which is at the root of all 
European data protection law, including the UK's law. But it 
bears some similarities to the OECD privacy guidelines with 
which you may be familiar.
    But when data protection started, certainly in the UK, it 
was not only about human rights that was behind government 
thinking. It was also about building people's trust in 
business, going back some time in the use of computers at that 
time, but say, ``Here is the law to protect you. You can trust 
businesses that computerize information.'' And that does have 
some relevance in the world of e-commerce that we are now in.
    The EU Data Protection Directive is designed to harmonize 
European laws and to remove barriers to the flow of information 
within Europe. It essentially takes the Council of Europe 
Convention further, makes it a mandatory requirement, and 
modifies it in relation to EU member states.
    In addition to the general Data Protection Directive to 
which the attention is focused on, there is a Data Protection 
Directive specifically focusing on the telecommunications 
section, which adds to the general directive. And there is even 
some suggestion now, although nothing firmly proposed, that 
there will be one relating to the employment sector.
    The UK Act implements the European directive. The Act sets 
out the scope of the law. It applies not only to automated 
computerized records. It also applies to structured manual 
records. It works on the basis of criteria for processing.
    In order to keep--use information about individuals, a 
business has to meet certain criteria, which in general are not 
especially difficult to meet but are more onerous where the 
information falls into the category of sensitive data, into 
particular categories there.
    The law gives individuals rights such as the right of 
access to their information and the right to compensation if 
the information is misused. And it sets out standards that data 
controllers, businesses, must follow called the Data Protection 
Principles, which cover the requirement to fairly process 
information to keep the information secure, and so forth.
    One of those principles relates to international transfers, 
and the testimony I have provided talks about the meaning of 
adequacy in terms of only transferring data to countries 
outside Europe that provide adequate protection.
    What is actually meant by ``adequacy''? It doesn't 
necessarily require data protection law. It does depend on the 
nature of the data that are transferred, codes of practice, 
enforceable codes, and the like, that exist in the country 
involved. The testimony refers to community findings. Professor 
Rodota referred to particular countries where there has been a 
finding of adequacy, and the safe harbor arrangements fall into 
that category.
    As UK Information Commissioner, we are obliged under a 
community finding to accept the safe harbor arrangements as 
providing adequacy to companies that have signed up to it. 
There are exceptions to the requirement for adequacy where 
individuals have given their consent to the transfer of the 
data where the data are necessary for legal proceedings and in 
a number of other areas.
    And I also talk in the testimony about the role of standard 
contracts and the work that is going on to develop those 
contracts to govern the transfer. So a variety of arrangements 
under which adequacy requirements can be satisfied.
    In terms of enforcement, the UK law does not contain much 
in the way of criminal offenses and criminal penalties for 
breach. The one we place most emphasis on is that of obtaining 
information by deception. Essentially, people like private 
investigators who will contact a bank, an insurance company, a 
doctor, and pretend to be someone with authority to acquire 
information, and so, therefore, do so by deception. And we do 
prosecute those, and we regard that as a particularly important 
aspect of our law.
    But generally, we enforce the law through enforcement 
notices which set out requirements that businesses have to 
undertake to comply with the law to delete data to change their 
practices, or whatever. And a failure to comply with the notice 
is then a criminal matter for which we can prosecute. And 
individuals, under the law, have their own right to take action 
through the courts to enforce their rights.
    As Information Commissioner, we see our role, and, indeed, 
the law sets out our role, as not being solely or even 
necessarily primarily about enforcement. We are very keen to 
develop awareness amongst citizens and amongst businesses of 
how the law operates and their rights and responsibilities 
under it.
    We promote good practice which goes wider than simply 
complying with the law, and it covers conduct which is 
consistent with those requirements. And as Professor Rodota 
said, we also put emphasis on the development of codes of 
practice, codes that develop how the law applies in the area of 
particular industry, particular activities, fields such as the 
use of data in employment.
    We deal with requests for assessment from individuals, 
individuals who ask us to assess whether the law has been 
complied with, and we make those assessments. But we have a 
wider strategy, and I will just, in conclusion, spend a moment 
or two on developing our strategy. Because, as I said, we are 
keen to work on the basis of education and encouragement, both 
of individuals and of businesses.
    We take a very strong view that data protection and privacy 
requirements should be built in at the early stage of thinking, 
whether that is the development of new business processes, new 
IT systems, or the development of public policy.
    They should start with data protection in mind, and one 
example of work we are doing in that area is the development of 
guidelines for those involved in the development of IT systems 
on how to incorporate privacy-friendly features into those 
systems, part of our work of encouragement and producing 
guidance.
    We also encourage self-regulation, not necessarily instead 
of statutory regulation but together with it. We see self-
regulation, provided this is effective and gives effective 
remedies to individuals, and there are arrangements to check 
that businesses comply, audit arrangements, and the like, as 
being the best way of providing remedies for individuals and 
enforcing data protection day to day.
    And we are supporting and actively working with the 
development of alternative dispute resolutions as a better 
method than individuals either taking their cases through the 
court or our office necessarily seeking to resolve them for 
them.
    We also promote good business practice. We are encouraged 
by some developments, particularly in the e-commerce field, 
where businesses are increasingly positioning themselves for 
privacy, not necessarily because they see that as a way of 
meeting regulatory requirements, but because it is what they 
see as necessary to attract and retain customers, permission 
marketing, giving the customer choice, and the like.
    And we encourage that, because the more that data 
protection flows out of good businesses practice than is seen 
as a simple additional regulatory burden, the more satisfactory 
and the more effective it will be.
    And, last, we do seek to influence law makers as well in 
the UK and elsewhere to develop better protection for the 
privacy rights of individuals, but to do so without imposing 
disproportionate burdens on businesses.
    So I hope, Chairman, that is an introduction to our work 
and has been useful to you. Thank you for giving me the time. I 
am happy to answer any questions or provide further information 
if that would be helpful.
    [The prepared statement of David Smith follows:]

 PREPARED STATEMENT OF DAVID SMITH, ASSISTANT COMMISSIONER, OFFICE OF 
              THE UNITED KINGDOM INFORMATION COMMISSIONER

                                SUMMARY

    This testimony is intended to be informative. It is submitted on 
behalf of the UK Information Commissioner who is the independent 
supervisory authority appointed under the Data Protection Act 1998. The 
views expressed are those of the Commissioner and do not necessarily 
represent the position of either the European Commission or the UK 
Government.
    The testimony covers:

 The Origins of Data Protection in Europe; The 1981 Council of 
        Europe Convention, the objectives of Data Protection law and 
        the thinking behind the UK's Data Protection Act 1984.
 The EU Data Protection Directives: The reasons for the general 
        Directive, the timescale for its implementation and the related 
        Telecommunications Data Protection Directive.
 The UK Data Protection Act 1998: The scope and application of 
        the law, criteria for processing, sensitive data rules, other 
        general provisions, individual rights and the standards to be 
        followed by data controllers (the Data Protection Principles)
 Transfers of Personal Data to Third Countries: What is meant 
        by an ``adequate level of protection'', Community findings and 
        exceptions to the requirement for adequacy including the role 
        of standard contracts.
 Enforcement: Criminal offences under the Data Protection Act, 
        obtaining personal information by deception, enforcement of the 
        Principles, information notices and the rights of individuals 
        to take proceedings through the courts.
 The Information Commissioner: The Commissioner's functions 
        under the Data Protection Act, the role and development of 
        codes of practice, her duty to make assessments as to whether 
        it is likely or unlikely that the Act's requirements have been 
        met, her strategy in promoting compliance with the Act and more 
        widely promoting respect for privacy and personal information 
        both nationally and internationally, some activities she is 
        involved in and some comments she has made in relation to 
        possible revision of the legal framework.

                       ORIGINS OF DATA PROTECTION

    European Data Protection law has its roots in thinking in the 1970s 
which led to the 1980 OECD Privacy Guidelines 1 and to the 
1981 Council of Europe Data Protection Convention (Convention 108) 
2. It is Convention 108 that formed the basis for the UK and 
many other European Data Protection laws prior to the Directive and 
which is now reflected in the provisions of the Directive itself.
---------------------------------------------------------------------------
    \1\ Organisation for Economic Co-operation and Development, 
Guidelines Governing the Protection of Privacy and Transsborder Flows 
of Personal Data, Paris 1980.
    \2\ Council of Europe Convention for the Protection of Individuals 
with regard to Automatic Processing of Personal Data, European Treaty 
Series 108, Strasbourg 1981.
---------------------------------------------------------------------------
    Article 1 of Convention 108 sets out the objective.
        ``The purpose of this convention is to secure . . . for every 
        individual . . . respect for his rights and fundamental 
        freedoms, and in particular his right to privacy, with regard 
        to automatic processing of personal data relating to him''.
    At its simplest, Data Protection law delivers this objective 
through three strands:

knowledge: The right of the individual to be informed what personal 
        information is kept, by whom and how it is used and the right 
        of access to the information.
control: some control by the individual over what information is kept 
        and how it is used.
safeguards: safeguards to ensure appropriate confidentiality, 
        availability, integrity and security of personal information.
    The human rights approach to Data Protection is clear. It is 
founded in the right to respect for one's private life. However this 
was not the only thinking behind either Convention 108 and the UK's 
Data Protection Act 1984 or the OECD Privacy Guidelines. There were two 
other strands, both of which are particularly relevant in the context 
of the development of electronic commerce and global markets. First 
there was the fear of technology, whether real or imagined. Evidence 
suggested that individuals were reluctant to trust their information to 
computers and there was anxiety that this lack of trust would stifle 
the development of technology in business. Legal protection was seen as 
a way of reassuring individuals.
    Second was the question of transborder data flows. Fears that the 
lack of an international instrument would lead to restrictions on 
transfer by those countries with domestic law were an important factor. 
In the UK, the Government's reasons for promoting Data Protection 
legislation were given by the then Home Secretary in the House of 
Commons on 30th January 1984.
        ``first . . . reassure people that . . . there are special 
        safeguards for individual privacy . . .
        secondly . . . membership of the European Data Protection club 
        . . . a very important commercial interest . . . British firms 
        not placed at a disadvantage . . .''
    Although Data Protection law can be seen as a means to facilitate 
international trade rather than as a trade barrier it has never sought 
to achieve this by allowing an unrestricted flow of personal data from 
those countries that adopt protective measures to those that do not. 
The UK's Data Protection Act 1984 included provision for transfer 
prohibition notices. Although used rarely this enabled the then Data 
Protection Registrar to stop the transfer of personal data to a country 
that was not bound by Convention 108, if the transfer was likely to 
lead to a contravention of the Act.

                   THE EU DATA PROTECTION DIRECTIVES

    Not all member states of the European Union chose to be party to 
Convention 108. Those that did used the freedom it allowed to adopt 
domestic laws that varied significantly. As part of the development of 
an internal market within the European Union and to facilitate what was 
seen as a necessary and substantial increase in cross-border flows of 
personal data, the EU General Data Protection Directive 3 
was adopted on 24 October 1995. Member states have no choice but to 
implement it in their domestic law. There is still scope for variation 
in its interpretation and application but this is much less that is the 
case with Convention 108.
---------------------------------------------------------------------------
    \3\ Directive 95/46/EC of the European Parliament and of the 
Council of 24th October 1995 on the protection of individuals with 
regard to the processing of personal data and on the free movement of 
such data, Official Journal of the European Communities L 281, Vol. 38, 
23rd November 1995, ISSN 0378-6978.
---------------------------------------------------------------------------
    The EU Directive takes familiar themes forward. It clearly states 
as its two objects:

 ``. . . member states shall protect the fundamental rights and 
        freedoms of natural persons, and in particular their right to 
        privacy with respect to the processing of personal data''
 ``. . . member states shall neither restrict nor prohibit the 
        free flow of personal data between member states . . .''
    The Directive took several years to agree. It is necessarily a 
compromise between the cultures, existing laws and aspirations of 
different member states. To comply with the Directive, member states 
should have had domestic law in place within three years of its 
adoption ie, by 24th October 1998. The UK law came into force on 1st 
March 2000. The Directive allows a transitional period for ``processing 
already under way'' at 24th October 1998. For most processing this 
transitional period will run out on 24th October 2001.
    In addition to the general Directive referred to above there is a 
related Directive addressing Data Protection in the Telecommunications 
Sector 4 The intention of this directive is to particularise 
and complement the provisions of the general Directive as they apply in 
the this sector.
---------------------------------------------------------------------------
    \4\ Directive 97/66/EC of the European Parliament and of the 
Council of 15th December 1997. Concerning the Processing of personal 
data and the protection of privacy in the telecommunications sector.
---------------------------------------------------------------------------

                    THE UK DATA PROTECTION ACT 1998

    The general Data Protection Directive is given effect in the UK by 
the Data Protection Act 1998. There are separate provisions 
implementing the Telecommunications Directive.
General Provisions
    Scope: The Act applies to the processing of personal data. 
``Personal data'' is information that relates to a living, identifiable 
individual. It includes information held not only in automated systems 
but also in structured manual records referred to in UK law as a 
``relevant filing system''. ``Processing'' is defined widely and 
includes any operations performed on personal data from collection 
through to deletion.
    Application: The Act regulates the activities of data controllers. 
That is persons who determine the purposes for which and manner in 
which personal data are processed. It applies to data controllers who 
are:

 established in the UK provided the data are processed in the 
        context of the UK establishment even if the processing actually 
        takes place elsewhere.
 not established on the territory of the UK or another member 
        state but make use of equipment in the UK for processing.
    Criteria for Processing: Before personal data can be processed, one 
of the following criteria must be satisfied:

 the data subject has consented;
 the processing is necessary for performance of a contract 
        involving the data subject or for pre-contractual steps;
 the processing is necessary for compliance with a legal 
        obligations;
 the processing is necessary to protect the vital interests of 
        the data subjects;
 the processing is necessarily carried out in the public 
        interest;
 the processing is necessary for legitimate interests pursued 
        by the controller except where these are overridden by the need 
        to protect the rights and freedoms of the data subject.
    The Information Commissioner takes the view that regardless of 
whether any of the other criteria are also satisfied, legitimate 
business activities should generally be able to rely on the last of the 
above.
    Sensitive Data: Where sensitive data are processed, one of an 
additional list of criteria must also be satisfied. Sensitive data are 
defined as those that consist of information as to racial or ethnic 
origin, political opinions, religious or philosophical beliefs, trade 
union membership, health, sex life and criminal offences. The list of 
criteria for processing sensitive data is restrictive. In very many 
cases the data subjects' explicit consent is required before such data 
are processed.
    Notification: Data controllers are required to notify the 
supervisory authority of their processing operations for inclusion in a 
public register. Some exemptions exist. There is a fee for notification 
of 35 (approximately $50) per year. This indirectly funds 
the Information Commissioner's office.
    Supervisory Authority: The Information Commissioner is the 
independent public supervisory authority with appropriate powers of 
investigation and intervention to monitor compliance with the law and 
hear claims lodged by individuals.
    International Co-operation: Arrangements for co-operation between 
supervisory authorities in member states and the EU Commission are 
established. These include a working party of representatives of 
supervisory authorities (Article 29 Working Party).
Individual Rights
    Access: Individuals have a right to know whether or not a data 
controller is processing data about them, a right of access to such 
data and a right to any available information as to their source. There 
are some limited exemptions from this right. A fee of up to 
10 (approximately $15) can be charged and there are up to 
40 days to respond. There is also a right to knowledge of the logic of 
any automated decision taking that the individual is subject to.
    Correction/Deletion: There is a right to rectification, erasure or 
blocking of data which are incomplete or inaccurate.
    Prevent Processing: Individuals have a right to object to the 
processing of personal data about them:

 where the processing causes substantial damage or substantial 
        distress to an individual and that damage or distress in 
        unwarranted or;
 where the processing is for direct marketing.
    This right is further developed in the regulations implementing the 
Telecommunications DP Directive. Data subjects have a right to opt out 
of the receipt of unsolicited marketing calls through the telephone 
preference service and must not be sent marketing faxes without their 
consent
    Automated Decisions: There is a right not to be subject to 
decisions that are taken solely by automated means and have a 
significant effect on the individual, for example in connection with 
assessing creditworthiness. A decision can be taken in the course of 
entering a contract provided there are safeguards such as a right of 
appeal.
    Request Assessment: The supervisory authority is required to hear 
claims lodged by any person concerning the processing of their personal 
data.
    Compensation: Any person who suffers damage and associated distress 
as a result of a breach of the Act is entitled to compensation from the 
data controller. Claims must be pursued through the courts.
Data Protection Principles
    These set out standards to be followed by data controllers in their 
processing of personal data.
    Fair and Lawful Processing: As well as meeting the criteria for 
processing referred to above data controllers must process personal 
data in a way that is fair to individuals and does not lead to breaches 
of the law. In particular, to make processing fair, individuals should 
be made aware who is holding their data, the purposes of the processing 
and any other information necessary to make the processing fair such as 
the recipients or categories of recipients of the data. This obligation 
applies even where the data have not been obtained directly from the 
data subject, for example where they have been obtained from a credit 
bureau, unless providing the information would involve disproportionate 
effort.
    Limitation of Purpose: Personal data must be collected for specific 
and lawful purposes and not processed in a way that is incompatible 
with those purposes.
    Data Quality: Personal data must be:

 adequate, relevant and not excessive for the purpose for which 
        they are collected;
 accurate and, where necessary, kept up to date;
 kept no longer than necessary.
    Security: Data controllers must have appropriate technical and 
organisational measures in place to protect personal data. Where a data 
controller uses a processor to process data on its behalf there must be 
a contract in place tying the processor to only using the data in 
accordance with the controller's instructions and placing security 
obligations on the processor.
    International Transfers: Transfers of personal data to countries 
outside the European Economic Area, so called ``third countries'', are 
only allowed if the country provides an adequate level of protection 
for the data. There are some exemptions that allow transfers to take 
place in circumstances where adequacy is not achieved.

             TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES

Adequacy
    Whether a country provides an adequate level of protection for 
personal data does not depend solely on whether the country has a Data 
Protection law. The Act makes it clear that other factors must be taken 
into account including the nature of the data, purposes and duration of 
processing, the legal framework, codes of conduct or other enforceable 
rules and security measures. It is perfectly possible for example that 
a country might be considered adequate for the transfer of names and 
addresses on a mailing list but not for the transfer of medical 
records. The existence and effectiveness of any system of self-
regulation is an important factor in assessing adequacy.
    The Act gives effect to ``Community findings''. These are decisions 
of the European Commission that the level of protection in a third 
country is or is not adequate. There have been Community findings in 
relation to Switzerland and Hungary as well as the US safe habor 
arrangements. Several other countries are under consideration.
Exceptions
    In limited circumstances transfers of personal data to third 
countries can take place even though adequacy has not been established. 
These are where:

 the data subject has consented to the transfer;
 the transfer is necessary for performance of a contract 
        involving the data subject or in the interests of the data 
        subject or for pre-contractual steps;
 the transfer is necessary for the reasons of substantial 
        public interest;
 the transfer is necessary for legal proceedings, obtaining 
        legal advice or otherwise for the establishment, exercise or 
        defence of legal rights;
 the transfer is necessary to protect the vital interests of 
        the data subject;
 the transfer is part of the information in a public register.
    In addition transfers can be made on the basis of a contract 
between a UK data exporter and a data importer in a third country which 
is of a type approved by the Commissioner. The Commissioner also has 
the power to authorise particular transfers on the grounds that they 
are made in such a manner as to ensure adequacy. The Commissioner has 
not yet given approval to any standard contract terms. She is awaiting 
the outcome of work the European Commission is undertaken to develop 
such terms which will then be subject to a Community finding.

                              ENFORCEMENT

    In the UK, breaches of the Data Protection Act 1998 are mostly not 
criminal offences. The criminal offences are largely confined to 
failure to notify the Commissioner of processing operations requiring 
notification and knowingly or recklessly, without the consent of the 
data controller, disclosing or obtaining personal data. Within this the 
Commissioner places particular importance on using her powers to 
prosecute those who seek to obtain personal information, to which they 
are entitled, by deception.
    Where there is a breach of one of the principles, the Commissioner 
can issue an enforcement notice requiring the data controller to take 
action to bring about compliance, for example, to delete data. Failure 
to comply with a notice is then a criminal offence. There is no power 
to ``punish'' a data controller for a breach of principles.
    The Commissioner also has a power to issue an information notice 
requiring a data controller to provide her with information needed to 
determine whether there has been a breach of the Act. There is a right 
of appeal to an independent tribunal against enforcement or information 
notices. Where she has reasonable grounds for suspecting a breach of 
the Act she can apply to a court for a search warrant in order to 
obtain evidence.
    In addition individuals can take their own cases to court. They can 
ask the court to:

 order a data controller to uphold their right of access, right 
        to prevent processing and rights in relation to automated 
        decisions;
 order a data controller to rectify, block, erase or destroy 
        inaccurate data.

                      THE INFORMATION COMMISSIONER

    The former Data Protection Commissioner has recently been renamed 
``Information Commissioner''. This reflects additional responsibilities 
for oversight of the UK's new Freedom of Information Act. This 
testimony only addresses her responsibilities under the Data Protection 
Act 1998. She operates through an office with around 115 staff and a 
budget of 4.5 million ($7 million).

Duties
    In addition to enforcement and maintenance of the public register 
of notifications the Commissioners functions under the Act include:

 promotion of good practice which is such practice in the 
        processing of personal data as appears to the Commissioner to 
        be desirable having regard to the interests of data subjects 
        and others and includes (but is not limited to) compliance with 
        the requirements of the Act;
 dissemination of information and the provision of advice to 
        individuals and data controllers about the operation of the 
        Act, good practice etc;
 assessing, with the consent of the data controller, any 
        processing of personal data for the following of good practice 
        (an audit function).
 presentation of an annual report and, when she sees fit, other 
        reports to Parliament;
 provision of assistance to individuals taking action through 
        the courts in relation to the processing of personal data for 
        journalism or for artistic or literary purposes;
 preparation and dissemination of codes of practice;
 determination of requests for assessment.

Codes of Practice
    The Commissioner is required, after consultation, to prepare and 
disseminate codes of practice for guidance as to good practice either 
where she is directed by the Government to do so or where she considers 
it appropriate. Such codes explain the Commissioner's view of how 
compliance with the requirements of the Act should be achieved in 
practice in a particular field of business or activity. She can also 
encourage trade associations to prepare codes.
    A code of practice has been issued on the use of closed circuit 
television in public places. Consultation has recently been completed 
on the draft of a code on the use of personal data in employer/employee 
relationships. The Commissioner places considerable emphasis on the 
development of codes of practice under the Act. She believes they have 
an important role in translating the necessarily general requirements 
of the Act itself into meaningful standards that can be readily applied 
in the context that they address.

Requests for Assessment
    A request may be made to the Commissioner by a person directly 
affected for an assessment as to whether it is likely or unlikely that 
any processing has been carried out in accordance with the Act. Subject 
to some limitations the Commissioner is required to make an assessment 
and inform the person of the result. This replaces her duty under the 
Act's predecessor to consider complaints. In some cases requests for 
assessment may lead to enforcement action.
    Around 5,000 cases are handled each year. Roughly half of these 
require some form of investigation. The others are dealt with by the 
provision of information or advice. Around 65% of cases reveal a breach 
of the Act. The two largest categories of cases in 1999/2000 were 
consumer credit (including credit reporting)--31% and direct 
marketing--18%.

Strategy
    The Commissioner sees her role as wider than simply undertaking the 
specific functions given to her in the Act. Her mission statement 
commits her to promoting respect for the private lives of individuals 
and in particular for the privacy of their information by:

 implementing the Data Protection Act 1998 and;
 influencing national and international thinking on privacy and 
        personal information.
    She is concerned to ensure that data protection and privacy issues 
are identified and addressed at the inception of new laws, processes 
and systems. It is central to this that;

 those who handle information both in the public sector and in 
        the private sector are aware of their obligations and act 
        accordingly;
 data protection emerges as a feature of good business practice 
        and is seen as a necessity for recruiting and retaining 
        customers rather than as a regulatory burden;
 policy makers, particularly at governmental level give 
        appropriate weight to individuals' privacy rights in the 
        development of new legislation, international instruments, 
        public policy and the delivery of services.
    In addition the Commissioner seeks to develop a climate in which 
individuals are aware of their rights in relation to their information 
and feel confident that these rights are respected and can be 
exercised.
    Some specific activities that the Commissioner is or has recently 
been involved in include:

 implementation of a national advertising campaign related to 
        individuals' rights;
 development of education packs for use in schools;
 supporting the development of data protection qualifications 
        and the incorporation of data protection material in other 
        relevant syllabuses;
 preparation of guidance and materials to assist data 
        controllers with compliance eg a data protection audit manual;
 encouraging the work of national and international standards 
        bodies on data protection;
 development of design notes for systems developers to ensure 
        that privacy protection is incorporated in standard design 
        methodologies;
 promotion of a debate on current data protection and privacy 
        issues through conferences/seminars;
 encouraging effective self regulatory initiatives that can 
        operate within the legislative framework particularly in 
        connection with e-commerce;
 supporting the development and use of alternative dispute 
        resolution procedures for handling data protection complaints.
    Recently the Commissioner has been invited to contribute to the UK 
Government's appraisal of the UK's new data protection regime. This has 
been conducted partly with an eye to the review of the EU Directive due 
by 24th October 2001. Many of the points raised in her submission are 
matters of detail but she draws attention to some areas where, in her 
view, the law imposes burdens on data controllers that are out of 
proportion to the benefit, if any, that they bring to individuals. 
These include:

 the application of the law to situations where a data 
        controller is not established in the UK but nevertheless uses 
        equipment in the UK for processing;
 the concept of special or sensitive categories of data rather 
        a recognition that it is the circumstances in which personal 
        data are processed that make them sensitive;
 the provisions on automated decisions;
 the extent of the notification obligation on data controllers;
 the emphasis placed in the provisions governing transfers to 
        third countries on centralised decision making rather than 
        leaving decisions and arrangements on adequacy to data 
        controllers, in the first instance.
    In addition the Commissioner has commented on some areas in which 
she considers the law could better protect individuals. These include:

 the lack of a right to compensation for distress caused by a 
        breach of the Act when there is no associated damage;
 the restriction on her right to assess a data controller's 
        processing of personal data for the following of good practice 
        which means that she can only do so with their consent;
 the lack of a power to impose a penalty rather than merely 
        ensure compliance where a data controller knowingly or 
        recklessly breaches the Data Protection Principles.

                          FURTHER INFORMATION

    The Commissioner would be pleased to supply further relevant 
information that the Sub-Committee might require.

    Mr. Stearns. Well, I thank you, Mr. Smith.
    I will start with the questions here. Let me say to my 
colleagues, if you have a business in Europe, and you want to 
use the internet to send out information back to the home 
company in the United States, you have an option of complying 
with the European Union's privacy provisions, or you have an 
option of the safe harbor agreement that was worked out between 
the administration and the European Union.
    Only 20 corporations, less than 20 corporations, have 
signed up for the safe harbor agreement, because it doesn't 
appear, at least from an American standpoint, to be practical. 
So a third alternative for you, if you are in Europe and you 
are doing business, and you want to send back information and 
do everything, is what is called a model contract.
    And so the gentleman we have here, my colleagues, is head 
of what is called the Article 29 Working Party, which is all of 
the European Union representatives come together and talk about 
how they are going to develop these model contracts.
    So the first question I would like to have for Professor 
Rodota is, what are the key terms spelled out in these model 
contracts? Do U.S. companies have any room to negotiate the 
provisions? If so, with whom do they negotiate? The company 
wishing to transfer data or a privacy commissioner? Do you 
understand that, or is the question clear?
    I think we need to know for American corporations, what are 
the key terms of the model contracts? Who do they negotiate, 
the company, or do they have to come to you as part of the 
privacy commissioner?
    Mr. Rodota. No. No. The companies does not have to come to 
the Data Protection Authority. Now the standard contractual 
clauses have been approved by our group, and now they are on 
the way to be approved by the Commission.
    So when this kind of model contracts will be approved, both 
parties--the exporter and the importer, the European part and 
the U.S. or the third country part, can pass a contract without 
an intervention of the Data Protection Authority at the 
European level, because it means that they are using a contract 
sealed by the European Commission.
    So if they respect the terms of the contract, they have a 
mechanism, an instrument, giving them the opportunity to comply 
with the adequacy test. This is a traditional contract. Yes, I 
don't know if my answer----
    Mr. Stearns. Can they negotiate terms?
    Mr. Rodota. Partly. Partly.
    Mr. Stearns. Partly.
    Mr. Rodota. You have the model contract, a model contract, 
the possibility to choose some options, yes, especially on the 
side of the enforcement, because you can have the possibility 
of--I have here the text of the--yes, the model contract.
    You have the possibility to, for instance, in the part of 
the obligation, to choose the legislation of reference, the 
different--the mediation and jurisdiction for possibility for 
solving the conflicts. So they are part--they cannot make us 
see it--the part referring to basic principles of the 
directive. And other parts parties can have the possibility to 
choose.
    Mr. Stearns. Mr. Smith, your testimony states that the 
Office of Information Commissioner has ``appropriate powers of 
investigation and intervention to monitor compliance with the 
law.'' Could you explain the limits of those powers? Could you 
please provide us with any examples of the application of said 
powers the Information Commissioner has taken to date for 
possible violation of the law?
    Mr. Smith. Yes, Chairman. There are certain criminal 
offenses, as I mentioned, under the Act--obtaining information 
by deception. We have prosecuted a number of organizations and 
individuals for that. We also prosecute for failing to be 
registered or notified with our authority.
    Where there are more matters that require investigation, 
whether they are criminal matters or breaches of the Data 
Protection Principles, we have powers to obtain search 
warrants, and we go before the court and obtain a search 
warrant to obtain evidence, and we have done that on several 
occasions.
    We also, under the new law, have a power to issue 
information notices which require businesses to answer 
questions which are necessary for our investigation. We have 
yet to use that, because this has only just come into being. 
And our powers then are--for general breaches of the Act are to 
issue enforcement notices, which require a business to change 
its practice to delete data, to provide notice and choice, or 
whatever.
    We have used that on probably about a dozen occasions up to 
now and--those cases, and some of them have gone to an appeal 
tribunal, which has generally found in our favor.
    Mr. Stearns. Thank you. My time has expired.
    Mr. Towns, ranking member?
    Mr. Towns. Thank you very much, Mr. Chairman.
    Mr. Smith, has the EU or any member country taken action 
against a firm for its failure to comply with the requirements 
of the privacy directive? And, if so, has any EU firm been 
forced to seize data operations as a result of the non-
compliance?
    Mr. Smith. I can only answer in relation to the United 
Kingdom. We have taken action--because of the privacy 
directive, the law implementing that has only very recently 
come into force. The action we have taken under that, although 
there have been--we have commenced proceedings, in a number of 
cases is limited, but our old law was very similar and there 
were cases under the old law.
    We have required businesses to stop using information in 
the way that they were using it previously, and in some cases 
they have had to change their practices significantly. One 
recently has been in relation to utility companies, which were 
privatized, and the use of information for marketing purposes 
fall in privatization. And they have had to revise 
significantly their practices as a result of our action.
    There are others I could give, but we have required 
changes, certainly.
    Mr. Towns. Thank you. On that note, well, are the privacy 
contracts that are negotiated with foreign firms reviewed by EU 
officials, or is each country's privacy director responsible 
for determining that the contracts are consistent with the 
privacy directive? I mean, who makes that decision?
    Mr. Smith. Under the UK law, which is not necessarily 
identical to the laws of every member state, there are two 
ways. One is the way Professor Rodota has described, which is 
that there are model contract clauses approved by the 
Commission, and when those are approved UK businesses are 
perfectly entitled, and we would encourage them to use those 
and rely on those.
    There are also arrangements under the law where we, as 
Commissioner, can approve model contracts or individual 
arrangements between one company and another. And at the end of 
the day, the UK law requires adequacy, and it talks about 
adequacy being assessed on the basis of arrangements that apply 
in a particular case, whether--including terms such as codes 
which apply in general or in a particular case.
    And a contract is an enforceable arrangement that applies 
in a particular case. So it is possible for a UK business to 
develop a contract with a U.S. business, which does not 
necessarily follow precisely the model, if it is eventually 
approved by the community, and still ensure adequacy.
    So it is possible for contracts to be developed and to meet 
the requirements of the law.
    Mr. Towns. All right. Go ahead, Professor. Yes?
    Mr. Rodota. Yes. Let me describe very precisely a situation 
that can occur in all member states of the European Union. 
Because until now there are many cases in which the data 
protection authorities were asked by European and U.S. 
companies to agree with their contract.
    They control if they submit to the adequacy test, the 
contract submitted by both parties, and they are mostly in 
Germany. A very important contract passed by U.S. Citibank and 
Deutch--and the Deutch Railway. And in other countries like 
France, Spain, Italy, there are many cases in which until now 
not having some general rules like safe harbor, and not model 
contract approved at the European level, they used the 
possibility to ask in specific cases the data protection 
authorities.
    This is a very well-established procedure. Not easy. Not 
easy.
    Mr. Towns. Right.
    Mr. Rodota. Very, very bad for the data protection 
authorities.
    Mr. Towns. Are these private contracts disclosed publicly?
    Mr. Rodota. Yes. They are always brought to the Data 
Protection Authority.
    Mr. Towns. Well, how could I get one? How do you get a copy 
of them? How do people get copies of them?
    Mr. Stearns. He would like to get a copy himself.
    Mr. Smith. Certainly. The individual contracts would not be 
made publicly available. The only contracts which may be 
publicly available are the model which has been referred to.
    Mr. Towns. So, I mean, that is secret. Okay. Well, anyway, 
let me move on. You have been traveling a great distance.
    Let me just ask one other question, Mr. Chairman.
    There was a survey conducted by the Kearny Management Group 
which was reported in November of last year in the publication 
``Biz Report''--confirms this point. Let me quote, ``E 
retailers worldwide lose $6.1 billion''--that is B as in boy--
``in sales due to an 80 percent failure rate among online 
purchase attempts, and that invasive information requests are 
blamed for 52 percent of sales that fall apart, followed by 
reluctance to enter credit cards, 46 percent.'' Do you agree 
that business is paying a big price for the confidence consumer 
lacks in the privacy security of their online transactions?
    Mr. Smith. Yes, we would agree that there is a real problem 
there and that those businesses that recognize the true 
situation actually build privacy into their practices as a way 
of attracting and recruiting, keeping customers, rather than 
simply as a regulatory requirement.
    Your figures are supported by a whole range of studies, and 
our perception in the UK is the same as yours. Businesses 
increasingly will--not increasingly, but we do find businesses 
that adopt practices online which, in our view, are not 
acceptable and do not necessarily comply with the law, 
particularly excessive information gathering, requiring 
information as a condition of doing business where that is not 
necessary for the transaction, and failing to provide the 
choice that is allowed, and operating in an underhand way, not 
giving notice of information collection practices which are 
taking place through the use of cookies and mechanisms such as 
that.
    Mr. Towns. Thank you, Mr. Smith.
    Thank you, Mr. Chairman, for your generosity.
    Mr. Stearns. The gentleman's time has expired.
    Mr. Shimkus is recognized for 5 minutes.
    Mr. Shimkus. Thank you, Mr. Chairman. Mr. Chairman, I would 
recommend that also the OECD was mentioned in some of the 
opening statements. I had a chance to visit the OECD on the 
NATO trip. A lot of people--we don't--a lot of us don't know 
what that is, but we are a member. And we have an ambassador 
and a staff, and if they are doing issues on privacy we should 
probably call them to see what our response is in that 
organization, and I would be willing to help facilitate that.
    Mr. Stearns. It is a good idea to coordinate with them, 
too. Yes.
    Mr. Shimkus. Because they are working in conjunction with 
our European allies, not just--Mexico is a member, Korea is a 
member. It is a pretty big international grouping of nation 
states.
    Mr. Smith, I would like to--you also mentioned effective 
remedies for individuals, dispute resolution, which implies 
that there will be some information that will be improperly 
used, and that individuals will try to address redress, or get 
redress, which brings up the issue that I would like to ask on 
is the Investigative Powers Act or the RIP Act, which, again, 
based upon my opening statement, privacy is the utmost issue we 
had to debate here in our country on the CARNIVORE issue.
    The fact of being able to gather all of the communications, 
hold them in a bank of information for 7 years, and require 
people who are doing business to do so, I think is really a 
threat on privacy issues for our companies and individuals.
    And I would like to follow up with a question to both of 
you is, Professor Rodota, how does the EU Data Privacy 
Directive affect the RIP Act or similar laws that may pass in 
other EU countries? And how would the EU directive protect non-
EU members from the UK government storing personal information 
about them?
    Mr. Smith. Perhaps if I start, and then Professor Rodota 
can take up the general European situation.
    Mr. Shimkus. Great.
    Mr. Smith. The RIP Act, the Regulation of Investigatory 
Powers Act, doesn't actually include any measures that require 
or necessarily permit businesses to store data solely for--or 
telecommunications providers solely to store data----
    Mr. Shimkus. No. But the government stores it.
    Mr. Smith. Well, no, not under the Regulation of 
Investigatory Powers Act. The Regulation of Investigatory 
Powers Act only gives powers of interception, and we, as 
Commissioner, expressed views which weren't necessarily taken 
into account in the final version.
    You are quite right that there are proposals or suggestions 
to retain data for investigatory purposes. They are not 
actually part of the RIP Act, and they haven't yet been brought 
in. The suggestion of 7 years is merely in a leaked report from 
the National Criminal Intelligence Service and is by no means 
government policy.
    Government policy, as far as we know at the moment, is not 
to legislate in this area and to wait until international 
instruments address the matter and essentially set the 
standard.
    So I think there may be some misunderstanding. There is no 
requirement at the present time to keep traffic data for 
investigatory purposes for 7 years. We would be very much 
against that. If there is to be a period of retention at all, 
it should be very much shorter than that. And as I say, it is a 
matter being addressed by international instruments, which is 
what Professor Rodota----
    Mr. Shimkus. But if I may, before we go to the EU aspect, 
but is there--okay. If it is not a collection, is there a 
review of all data coming in, electronic, internet, or cell, or 
land line review, under the RIP Act?
    Mr. Smith. No, there isn't. I mean, there are arrangements 
whereby interception can take place. Essentially, there are 
provisions. They have to be authorized by--in some cases by the 
Home Secretary, in other cases by a senior police officer or 
equivalent.
    And one of our concerns when the bill was going through 
Parliament was the level of that authorization. We asked for it 
to be higher than it is. But there is an arrangement whereby 
interception does have to be authorized on a case-by-case 
basis.
    Mr. Shimkus. We had this debate on the encryption debate 
and law enforcement. It got very contentious here.
    And I will finish up with, if I may, Mr. Chairman, allowing 
the Professor to finish, and that will end my time.
    Mr. Rodota. I would like only to say that this problem is 
now under discussion in Europe, because the way in which 
traffic data can be collected is under discussion in the 
framework of the Council of Europe Directive on Conventions on 
cyber crime. And also, the U.S. are part in the negotiations.
    Generally speaking, the attitude is different in different 
countries. But the work--the Article 29 Working Party passed 
the resolution last year, very clear on this point, saying, 
first of all, that no interception can be made without an 
authorization by jurisdictions. And no collection, massive kind 
of data collection.
    This is the problem--two very important principles in the 
directive are: first of all, the principle of finality; and, 
second, the principle of proportionality. We were, and we are, 
strongly against any kind of massive collection, without the 
specific and indicated aim. We are asking also for a very short 
period in the duration for this kind of collection of data. 
They are moving in different directions.
    For instance, the Belgium Parliament has passed, for 
security reasons, for the first time, a law saying that data 
can be stored for 1 year, and that they are going beyond the 
indication Article 29, saying they were much more in favor of 
shortest time of conservation.
    Mr. Stearns. The gentleman's time has expired.
    Mr. Gordon, the gentleman from Tennessee, is recognized for 
5 minutes.
    Mr. Gordon. Mr. Shaw, if I could follow up on some comments 
you made earlier. You were talking about how individuals in the 
United Kingdom had the right to go to court, if necessary, to 
protect their rights if--as individuals. Do you have what we 
would call class action lawsuits here? Do they go as an 
individual, or can they bring in large groups of individuals 
that they feel are in that same situation?
    Mr. Smith. No, the UK law, as it stands at the moment, only 
allows individuals to bring cases. And I think it is fair to 
point out that actually the individual's rights are fairly 
limited, and that it only enables them in terms of getting 
redress, to get compensation for damage, which in UK legal 
terms involves some sort of financially quantifiable loss. And 
most of the data protection breaches result in distress to 
individuals, but not necessarily a financially quantifiable 
loss.
    So I think we have been asked, as Commissioner, to express 
our views on the law, and it is one area we feel the law could 
be improved in providing redress for individuals.
    Mr. Gordon. So if you are a U.S. company thinking about 
doing business in Great Britain, I guess my thoughts would be, 
certainly, if I was looking at Europe at large, that although 
United Kingdom has not opted into the Euro, it would--you know, 
certainly, the EU is trying to bring down barriers among their 
own countries and trying to become more productive in terms of 
their commerce there.
    But this is--I guess in Tennessee we would call it a little 
loosey-goosey. I mean, you know, if I am a company, and I am 
trying to do business in Italy and maybe in France, and a 
couple of other countries, under a safe harbor I would be 
somewhat concerned that maybe one country would say okay, 
another country maybe not. You know, it makes you concerned 
there.
    So if you are deemed not properly within the safe harbor, 
what are the penalties? What risk does an American company, Mr. 
Shaw, risk?
    Mr. Smith. If a company is not part of the safe harbor and 
transfers----
    Mr. Gordon. Or tries to be, but deemed not so.
    Mr. Smith. Yes.
    Mr. Gordon. In one--say, potentially, two countries say 
yes, but another country says no.
    Mr. Smith. Yes. I mean, that is not how the safe harbor 
works. It is up to the U.S.--I believe it is through the 
Federal Trade Commission--to take people onto the safe harbor 
list. And if they are taken onto the list, then we and all of 
the other EU member states have to recognize them as providing 
adequate protection. We have no choice in that, and this is a 
common standard.
    The area where penalties would come in is if a U.S. 
business is not in a safe harbor, has made no arrangements for 
adequacy, has no contract or other arrangements, and is 
transferring data in breach of the law. And then our power 
would essentially be to provide them with an order to stop them 
transferring that data. And if they failed to comply with that 
order, then they could be prosecuted for a criminal offense.
    Mr. Gordon. Okay. So if the FTC says that they are in 
compliance with safe harbor, but, again, a country in Europe 
disagrees with that, then does the FTC's position trump it?
    Mr. Rodota. I would like to--also to go back to the first--
the first question you raised. In Italy, we have no class 
actions, but there is the possibility, if the people make this 
kind of decision, to be assisted or to be substituted by a 
tribunal or organization.
    In the situation of a weakness or the part asking for the 
respect of the law, the individual can give the possibility to 
a group to act in--on behalf on its own interest. This is very 
interesting machinery.
    Second, the problem if this--there is the possibility that 
the same request made by a U.S. company in France or in Italy 
have different answers. It is possible that they can escape 
this risk using one or two means. There you have safe harbor or 
standard contractual clauses.
    Third, if there are the possibility--if some data are 
transferred without entering the safe harbor, without having--
using model contract, without previous authorization of the 
national Data Protection Authority, they are in infringement of 
law, surely, for the national authority.
    What happens if there is a discrepancy between what the FTC 
decides and the attitude of the national Data Protection 
Authority? That is a problem. That is a problem because we are 
waiting for the way in which the Federal Trade Commission 
will----
    Mr. Gordon. Excuse me. We have a limited amount of time. 
So, again, so you are saying, then, that there can be a 
situation where the FTC could grant safe harbor, but an 
individual European country could say, ``We don't agree with 
that.'' Is that----
    Mr. Rodota. They don't agree with the safe harbor----
    Mr. Gordon. All right. So, then----
    Mr. Rodota. [continuing] with the FTC decision.
    Mr. Gordon. All right. That is not consistent, then, with 
what Mr. Shaw said, is it? And I am trying to figure out--Mr. 
Shaw, is that----
    Mr. Stearns. Mr. Smith, you mean.
    Mr. Gordon. Mr. Smith. I am sorry. Excuse me. Is that--that 
sounds to be inconsistent there with your statement. Is that 
true or not? I am just trying to--I am not trying to get a 
fight here. I am just trying to find out what is going on, and 
then trying to see what level of risk our countries are taking, 
or our companies are taking.
    Mr. Smith. My understanding is that if a business is on the 
safe harbor list, we, as a supervisory authority in the UK, 
cannot act to stop transfer to that business, unless there is 
some breach of UK law taking place in the UK prior to transfer, 
which, you know, would be the same as if the transfer was to a 
company in France or even to another company in the UK.
    The only area where I believe we could take action is if 
the company has failed to comply, demonstrably failed to comply 
with the safe harbor arrangements, and then the--and no action 
has been taken. But, essentially, if they are on the safe 
harbor list, then they are approved in that sense.
    Mr. Stearns. The gentleman's time has----
    Mr. Gordon. Yes. But you are still the final arbitrator of 
that.
    Mr. Stearns. The gentleman's time has expired.
    Let me just, have you folks finished your answers? Yes.
    The gentleman from New Hampshire, Mr. Bass, is recognized. 
He is not here.
    Then, Mr. Doyle is recognized.
    Mr. Doyle. Thank you, Mr. Chairman.
    You were asked earlier, I believe, by Mr. Towns about the 
privacy contracts and whether they were disclosed publicly, and 
I believe your answer was that they weren't, that they were 
private, is that correct?
    Mr. Smith. Yes.
    Mr. Doyle. So when a company negotiates a private contract 
with the privacy director, that is only known--the details of 
that are known between the company and the privacy director. 
Yet when companies go the safe harbor route, the details of 
that agreement are posted on the internet and are publicly 
disclosed for all to see.
    Do you think maybe that explains why so few companies go 
the safe harbor route? Wouldn't it be smarter for them to make 
their arrangements with the privacy director in private without 
disclosure? How does one police--you know, if the contracts are 
private, you know, how does one know what agreements are being 
made in private between the companies and the privacy director, 
as opposed to companies that go the safe harbor route and 
disclose everything?
    Mr. Rodota. That is a matter of the politics of each 
company. But generally speaking, I think that entering safe 
harbor means the company can transfer data by European partners 
without any specific and case-by-case procedure. Otherwise, in 
any case and for every counterpart you have in Europe you must 
engage a specific procedure before the national Data Protection 
Authority.
    I think that the economy of means may be balanced by the 
limited publicity of----
    Mr. Doyle. So if you are dealing in multiple countries, you 
would have to get a separate contract in each one of these 
countries. And that hassle, or, you know, whatever that would 
entail is outweighed by the disclosure.
    Mr. Smith, do you agree with that?
    Mr. Smith. Yes.
    Mr. Doyle. Let me ask you another question. Do you think 
the European Union privacy directive, do you think it was a 
reactive initiative and measure? That is, that European 
industries weren't practicing self-regulation and the 
government needed to step in and put an extra level of 
protection, or do you simply see it as something that 
complemented what industry in Europe was doing?
    Mr. Smith. Yes. I think the thinking behind the directive 
was from a slightly different perspective. It was essentially 
seen as the development of the single market within Europe. And 
in order to remove the possibility of, say, the UK businesses 
not being allowed to transfer data to France, for example, on 
the basis that there was inadequate protection, the directive 
would bring all countries up to a roughly similar level. So 
there is no basis for restricting the flow of data.
    I think that was the thinking behind it. I mean, in most 
countries, but not all, there was data protection law 
beforehand. There was in the UK. And I think the roots of that 
were primarily in the human rights argument that there needed 
to be a level of protection. We had signed up, as the UK, to 
the Council of Europe Convention and should have had a law, 
then, to implement that.
    But also, as I mentioned earlier, there was a strong lobby 
in the UK from the business community, from the Confederation 
of British Industry, to have data protection law in the UK, 
firstly, to give some reassurance to consumers that they could 
trust companies which computerize their data--was basically the 
position at that time. But also, to bring the UK at that time 
into the European data protection, if you like, club, to enable 
it to participate in the flow of data.
    So I don't think there was a great deal of look at, if you 
like, whether self-regulation was effective or not in terms of 
developing the law. But what we are seeking to do now is very 
much encourage self-regulation and self-regulation to resolve, 
if you like, day-to-day consumers' problems and individuals' 
problems but with a backstop of the law. So if that fails, then 
the law is there to provide the final area.
    Mr. Doyle. Just one last question. To the four countries, 
Professor, that you said were in non-compliance with the 
directive--Germany, France, Ireland, and Luxembourg--are the 
data firms in these countries being forced to enter into 
privacy contracts to continue transfers with other EU members?
    Mr. Rodota. The fact that they have not implemented the 
directive does not mean that they have no data protection. They 
have data protection. France and Germany have very well-
established, since 1978, data protection laws. They have Data 
Protection Authority very, very prominent in France and in 
Germany. In Germany, they have also the Federal level. It means 
that they have data protection authorities in every land. So I 
think that that is not a problem.
    I would add a word on the problem of industry, self-
regulation, and the framework of directive. I think that we are 
now assisting to a very interesting development inside Europe, 
because the codes of conducts are not at all considered as an 
expression of a specific sector. You know that there is an 
article in the directive, the Article 27, implementing the 
codes of conduct.
    This means that the interested sector can submit a draft to 
the workgroup--Article 29 working group--asking for a seal, in 
brackets, for a seal. And it means that this kind of codes of 
conduct comply with the general principles of directive. 
Expression of a representative sector of the industry are 
agreed, and they have not only a moral suasion, much moral 
suasion, but they can better be implemented also at the code 
level. It is very important.
    And, in Italy, we are now developing this experience of 
codes of conduct with different sectors. Media, it is working 
very well; the sector of research, historical statistics; the 
sector of private investigation; banking and insurance now we 
are underway.
    It is very important, because we have a general set of 
legal established principles and a tool, the codes of conduct, 
for making these principles flexible. This is very important. 
But it means that you have at the national level, or the 
European level, one single body giving this kind of seal.
    And if I can express an opinion, it would be very important 
for all of the world if also United States will have an agency, 
a privacy agency, giving this opportunity to the citizens and 
also to the business community.
    Mr. Doyle. Thank you.
    Mr. Stearns. The gentleman's time has expired.
    Mr. Buyer is recognized for 5 minutes.
    Mr. Buyer. I want to thank you, Mr. Chairman, and I want to 
thank the witnesses for coming. I want to make a few comments, 
and then I want to solicit your response to my comments and my 
question.
    I have been upon the European continent. Not only as a 
private citizen, but I have worn the uniform, and as a Member 
of Congress. One thing I enjoy are these discussions, because 
it always reinforces what I believe was good judgment of my 
ancestors to leave the continent.
    Okay? I find myself troubled at the moment. I am troubled 
because, as I watch the European Union sort of try to come 
together, which in world history is amazing. Because you mocked 
us at the creation of our country, as we were called the Grand 
American Experiment. Perhaps we can now look back across the 
ocean and sort of mock you back and say, ``Well, let us see if 
it can succeed.''
    And then, I find myself here in Congress, and say, ``Well, 
I do agree in a quest for economic harmony?'' That is what we 
are trying to do as each of us, as sovereign nations, seek to 
protect our own identity, and how we choose to recognize rights 
and govern. Okay?
    You, meaning the European Union, and those member 
countries, have chosen to give up something for some social 
compact. Am I now here in this country supposed to accept that 
your model should be the standard for the world? I am bothered 
and troubled at the moment.
    I find myself a few years ago having to vote on some 
measures here in Congress that were negotiated with countries 
around the world, or whether we should create the World Trade 
Organization and The General Agreement on Tariffs and Trades. 
It was very difficult to get Europe to agree on certain things. 
So in the end, in order to get signatures, we created carveouts 
and exceptions.
    Now I find myself troubled and ask, are these carveouts and 
exceptions being exploited? We recognize that nations want to 
protect, certain things, whether it is cultural or other types 
of things. Like, are we are not going to let those genetically 
engineered organisms come in upon our continent? My gosh, let 
us just prevent all that U.S. agriculture from coming in. So 
they exploit an exception.
    So I am curious as I sit here, because you are the experts 
now. What protections did the EU nations make to ensure that 
the data protection did not generate a violation of the 
commitments that your nations made to the World Trade 
Organization? Do you believe that it did or did not? I am 
interested in the response from both of you.
    Mr. Rodota. I emphasized at the beginning of my statement 
that there is an important evolution in the European Union, 
giving an important protection to personal data because they 
are considered a very important part of fundamental human 
rights. And if we are living in the information society, 
information about individuals becomes more and more important 
for respecting the individual rights.
    There is not an idea to impose a model to the world or to 
defend a cultural identity. Europe accepted the modern idea of 
privacy protection coming from the United States. That was very 
important for us. We recognized a very important improvement in 
the idea of democratic rights, privacy. We accepted this idea. 
And as a very prominent law philosopher, Ronald Dworkin, 
teaching in the U.S. said, we have taken rights seriously.
    So at this very moment, we are not trying to impose our 
model. We are trying to have a dialog on these very important 
issues with all countries, and we respect the idea and the 
model of U.S. Otherwise, the safe harbor could not be possible.
    But at the same time, we have considered privacy problems 
according to the very, very long American tradition. I am a 
professor of law. I know very well the seminal work of Warren 
Brandeis published in the Harvard Law Review in 19--at the end 
of the 19th century, 1890, in the Harvard Law Review.
    And the idea of privacy was not directly connected with 
economic at first. We must have a balance. This is our 
attitude, and I think that we can have a fruitful dialog on 
these points.
    Mr. Smith. I have nothing to add.
    Mr. Stearns. The gentleman's time has expired.
    Ms. DeGette is recognized for 5 minutes.
    Ms. DeGette. Mr. Chairman, thank you very much. And I 
wasn't here at the beginning of the hearing, I was on the 
floor, and so I would like to ask unanimous consent for myself 
and all other members to submit their opening statements for 
the record, Mr. Chairman.
    Mr. Stearns. Unanimous consent so granted.
    Ms. DeGette. Thank you. And I am sure that my colleagues 
thanked both of you for traveling here to testify today, but I 
would like to add my thanks. I know that the European Union has 
tried very hard to craft a policy directive that will protect 
consumers and at the same time encourage commerce.
    And I, for one, think that it is a noble effort, and I am 
sure that most of the members of this subcommittee would share 
my congratulations. As with the United States, it is an 
evolving effort because of the evolving technologies. And I 
would just like to ask you gentlemen a couple of questions in 
that direction.
    First of all, for clarification, Germany, France, Ireland, 
and Luxembourg, it is not that they are in non-compliance, in 
my understanding, it is that they have not yet adopted the EU 
Data Protection Directive. Would that be correct, Professor?
    Mr. Rodota. Yes.
    Ms. DeGette. And I would assume in those situations that 
would be because they feel that they have their own laws which 
will protect privacy. I think you talked in particular about 
France and perhaps Germany.
    Mr. Rodota. No. I think that the reasons why they have not 
yet implemented the directive are political ones----
    Ms. DeGette. I see.
    Mr. Rodota. [continuing] because they changed their 
majority, and the new government in France started again with--
--
    Ms. DeGette. Okay.
    Mr. Rodota. I think that--and Germany is now trying to have 
a more comprehensive----
    Ms. DeGette. I see.
    Mr. Rodota. [continuing] law than the----
    Ms. DeGette. Then the----
    Mr. Rodota. [continuing] same directive.
    Ms. DeGette. Okay.
    Mr. Rodota. I think that at the end of this year they will 
comply with that.
    Ms. DeGette. They will. Now, I am sure both of you 
gentlemen are familiar with a recent study that was done by 
Consumers International. It was quoted extensively in The Wall 
Street Journal. And in the article, Anna Fiedler, who is the 
Director of Consumers International, said that the evidence 
shows there is a real lack of enforcement by the EU privacy 
regulations. So that even though they are on the books, they 
are rendered useless.
    What is your opinion? Let us start with Mr. Smith, and then 
we will go to you, Professor, on that.
    Mr. Smith. Yes. Thank you. We have some--I mean, I have 
some sympathy with the article, although I think it perhaps 
goes a little too far in saying that enforcement is useless. I 
mean, I have described I hope to the committee some of our 
enforcement action and the powers that we have and that we have 
used them.
    But we have never seen formal enforcement as the primary 
mechanism of achieving data protection compliance. It is rather 
through a process of education, development, and encouragement, 
and developing it into good business practice, self-regulatory 
requirements, that compliance is being delivered.
    Now, there is a long way to go, and the survey relates 
particularly to the world of electronic commerce----
    Ms. DeGette. Right.
    Mr. Smith. [continuing] where there are real challenges.
    Ms. DeGette. Thank you.
    Professor?
    Mr. Rodota. Well, I think that--I know the study. I have 
seen the article in The Wall Street Journal. I am convinced 
that it is a misunderstanding. And they--this research gives a 
false impression of the real situation. They say 60 percent, if 
I remember correctly, of the American websites have----
    Ms. DeGette. Privacy.
    Mr. Rodota. [continuing] privacy problem.
    Ms. DeGette. Right.
    Mr. Rodota. And only 32 percent of the European websites 
have a privacy problem. But, in Europe, even if there is no 
policy indicated by the websites, in any case that is the law.
    Ms. DeGette. Well----
    Mr. Rodota. And the citizens have the opportunity to use 
law without any reference to the politics indicated by the 
websites.
    Ms. DeGette. Yes. But, Professor, what the study said was 
that more than 69 percent of European websites collect 
information by users, but only 32 percent point them to the 
privacy policy. What they pointed out is there is a lack of 
consumer confidence.
    Mr. Rodota. No. But----
    Ms. DeGette. That is not correct?
    Mr. Rodota. This is--that is a problem. Frankly speaking, I 
must say that we are discussing the Article 29 group on the 
basis of a proposal of the French Data Protection Authority. 
The French Data Protection Authority make an inquiry in France 
for having the--for checking the kind of politics of privacy 
politics by the different websites.
    And now we are discussing European level, in order to give 
also a European seal to the websites. But in any case, it does 
not mean that consumers in Europe have not enough protection. 
For instance, in Italy, some consumers ask our Data Protection 
Authority against some collectors of data, and we have the 
means to intervene. We intervened. We are the enquirer. And at 
the end, also we apply the sanction, and there is the 
possibility of an intervention of the judiciary.
    And generally speaking, we have at the European level a 
recommendation of the Article 29 group saying that the 
invisible treatment, for instance through cookies, are in 
Europe completely illegal on the basis of the European 
directive.
    Ms. DeGette. Thank you.
    Mr. Stearns. The gentlelady's time has expired.
    Mr. Walden, the gentleman from Oregon, is recognized for 5 
minutes.
    Mr. Walden. Thank you, Mr. Chairman.
    I appreciate your testimony today and your willingness to 
come here and share your views on the privacy directive and 
help us understand it better.
    I am curious, given what you are trying to do to solve the 
problems within the EU countries, so you have a common 
threshold for privacy protection, when we look at those and say 
we have to comply in order to have commerce, in effect, what do 
we do when Canada or Argentina or somebody comes in with a 
different set of directives?
    How is the EU going to relate to that if Canada, for 
example, has a different requirement than what you have 
negotiated with the EU? Is each country going to negotiate, 
then, separately with Canada or the U.S.? How does that work? 
Can either of you speculate on that?
    Mr. Smith. Yes. The European directive under UK law 
requires adequacy, not equivalence. It doesn't have to be the 
same as the directive.
    Mr. Walden. All right.
    Mr. Smith. And, indeed, the safe harbor arrangements do 
differ from the directive. The Canadian law which is on the way 
to being approved, but has not yet been approved, is also 
significantly different. I mean, I do take your point that, you 
know, where you go to is sort of, when you do these 
comparisons, around the world. But with that approach to 
adequacy rather than equivalence, it shouldn't be too difficult 
to reach that sort of settlement.
    We would also favor--I mean, it is not for us to put it 
forward. We are only the supervisory authority.
    Mr. Walden. Right.
    Mr. Smith. Increasing development of international 
instruments, and the work which has been referred to as the 
OECD is particularly important in this area. And we would very 
much encourage it. I mean, that clearly would be the ideal, an 
international framework which we could all sign up to, which 
will provide the privacy protection effectively, and what is, 
you know, now a global market, where it is difficult to apply 
some of the nationally based regulatory requirements.
    Mr. Walden. Because it seems to me--see if you agree with 
this--that your privacy directive, first of all, has an 
individual right of action. Somebody can sue, correct? And so 
one of the concerns I have, and I think shared by Mr. Buyer and 
others, is how that affects our sovereignty as a nation.
    Because, in effect, you could export an enforceable legal 
right to the United States that could be litigated here by both 
an American and a non-American in our court system, in effect a 
law we have never voted on, enacted, and yet somebody can be 
sued here. Correct? I mean, that is what I am hearing is a 
possibility. Is that----
    Mr. Smith. I am not sure that I am in a position to answer 
that.
    Mr. Walden. Okay.
    Mr. Smith. I think that is a question which really has to 
be directed to the European Commission rather than to----
    Mr. Walden. I see. But do you see where we are headed here? 
Do you share that concern? What if we have one that could be 
litigated in the European Union without you ever having an 
opportunity to weigh in on it, if we pass a directive?
    Mr. Stearns. Just a point of information. I think the 
gentlemen, if they don't sign the safe harbor, they can't be 
prosecuted in the United States. But if they sign the safe 
harbor, and ultimately the model directive, yes, they can be 
sued.
    Mr. Walden. But the impact, though, Mr. Chairman, is if 
they don't sign or don't agree----
    Mr. Stearns. Right.
    Mr. Walden. [continuing] they have been excluded from 
commerce, so by de facto you either are excluded from trade or 
you agree to absorb somebody else's laws and suffer personal 
right of----
    Mr. Smith. I mean, that is certainly not how we as a 
supervisory authority would view it. I mean, those are----
    Mr. Walden. Okay.
    Mr. Smith. [continuing] wide questions. But the simple 
approach that we would take is that if it is data on a UK 
citizen, that ought to be protected. And if that citizen gives 
the data to a business operating in the UK, that person ought 
to have some privacy protection. And if that company simply 
exports the data, not necessarily to the United States, to 
anywhere in the world----
    Mr. Walden. Sure.
    Mr. Smith. [continuing] which doesn't have protection, that 
citizen is at risk, and increasingly so because of global 
markets and the internet and the way in which information can 
be moved around the world so readily. And it is simply a 
question of providing protection.
    I think that does raise questions of the sort that you have 
raised, but those would not be, certainly from our point of 
view, at the top of the list.
    Mr. Walden. Right.
    Mr. Smith. They are consequences rather than intentions.
    Mr. Walden. I guess the problem--my time has expired, but I 
guess the problem I see is that, you know, okay, so we line up 
with the EU, and then, you know, China comes up with a 
different set, and then this is a pretty sticky wicket we are 
headed into. So I--I am out of time. Thank you.
    Mr. Towns. The gentleman's time has expired.
    The gentleman from Georgia, the ranking member, Mr. Nathan 
Deal? Actually, he is the vice chairman of the subcommittee, 
not ranking member, vice chairman.
    Mr. Deal. Thank you, Mr. Chairman.
    And I would like to also express my appreciation to the 
panel members for coming and appearing here today. And even 
though I share with my colleague, Mr. Buyer, the thankfulness 
that my forefathers decided to come to this country and leave 
the continent, my forefathers from the south also went a little 
further and decided they didn't like the United States either 
and tried to secede from that.
    And I must tell you gentlemen that we appreciate your--both 
your English dialect and your Italian dialect, as you speak the 
English language. I must tell you, I hear with a southern 
accent, and I appreciate your efforts, and I will do the best 
to do my part as well.
    In the discussion we have had, it is obvious that one of 
the concerns that we have as a Congress, and I think as 
individuals, is this issue of sovereignty. How do we deal with 
a directive that has now been adopted by 11, as I understand, 
of the European Union nations? And how do we incorporate that 
into what we do legislatively?
    I think I understand the process that you have set up with 
the safe harbor and the contract approach, but I suppose the 
most important question that I would have at this point is our 
most recent attempts to legislate in the area of privacy 
related to financial institutions, commonly referred to--I 
believe we call it the Gramm-Leach-Bliley legislative 
initiative on financial institutions setting standards for 
privacy.
    And I apologize if you have answered this question before I 
arrived. But it is my understanding that there has been a 
determination by the EU that these do not meet the standards of 
adequacy. Is that correct, or has there been any determination 
in that regard?
    Mr. Smith. I will explain my understanding, and Professor 
Rodota can correct me if I get it wrong. My understanding is 
that there has been no determination. That in the course of the 
safe harbor discussions the question of the Gramm-Leach-Bliley 
legislation was put to one side and said we would look at that 
later, but it has not been returned to.
    I am not familiar with all of the detail of it, so I can't 
give an authoritative answer. But I have been asked about it by 
UK financial institutions, and the view that I have expressed 
there is that it is, if you like, very good as far as it goes. 
It does--or it looks on the face of it as though it would 
provide adequacy in terms of notice and possibly choice, and it 
deals with security aspects.
    But there are other issues that arise out of the European 
directive in the UK law to do with information being accurate, 
up to date, not kept for longer than is necessary, which I am 
not sure--and I only say I am not sure--I am not sure that the 
legislation necessarily addresses.
    And, in fact, in terms of international transfers, the area 
it addresses most comprehensively, the notice and choice, is 
not necessarily a very big issue for--as in Europe, because 
essentially we are talking about data that have been collected 
already in Europe. So the notice and choice provisions are 
already there under European and UK law.
    So those are only views off the top of my head from what I 
have looked at. It is not that there is anything wrong with 
what is there. It is not that it doesn't necessarily go as far 
as it should.
    And I think, you know, concerns have been expressed about 
trying to export European requirements. I mean, the safe harbor 
arrangements are viewed as adequate. They are a U.S. approach. 
They are based on your self-regulatory arrangements. They are 
not the same as the European approach, but they have been 
viewed as adequate.
    And although we are not trying to convince you to our 
approach, it is not our job to do that, it is simply to provide 
some information. Some things it is hard to see in any, if you 
like, data protection or privacy system, how you can get away 
from some of the basics which I would hope we would all agree 
on, that information must be kept secure, people should be 
given notice, they should be given choice.
    We might disagree about quite what that choice is and 
whether it is opt-in or opt-out. but for a very large amount of 
what we talked about, we must surely be agreed on what the 
basic principles are.
    Mr. Deal. Just very quickly before my time expires. In our 
dialogs and as go forward with consideration of privacy 
legislation in this country, we are concerned, as Mr. Walden 
has indicated, with the countervailing part, with the rights. 
We are trying to define rights of privacy, but we recognize 
that with every right there also must be a remedy.
    And our concern with the litigation portion of it is we are 
a more litigious society than perhaps your continent is, and we 
are concerned about that and have to be concerned about it. So 
when we express those opinions, it is because of our own 
history with regard to when we define rights, and we provide 
remedies. Sometimes the remedies define the rights.
    Mr. Smith. Yes, we recognize that.
    Mr. Stearns. I thank my colleague. His time has expired.
    We have finished with the first panel. Professor Rodota, we 
thank you very much for participating, and Mr. Smith. We are 
delighted that the two of you took the time, and we hope you 
will stay around and listen to panel No. 2.
    And with that, we are going to proceed forward here for 
another 15 to 20 minutes, and then we are going to break for 
lunch.
    Yes?
    Mr. Markey. Can I ask one question?
    Mr. Stearns. Oh, absolutely. Okay. Mr. Markey is recognized 
for 5 minutes.
    Mr. Markey. Thank you, Mr. Chairman, very much.
    Professor Rodota, Mr. Smith, I note that under the safe 
harbor the EU has negotiated with the U.S. financial data 
regulated under the Gramm-Leach-Bliley Act does not qualify for 
the safe harbor. I believe this was a wise decision on your 
part, since the privacy provisions of that Act are a pathetic 
joke.
    For example, under the Act, a consumer's consent does not 
have to be obtained in order to transfer data between separate 
affiliates. All of these secrets that you have as they all--as 
they merge--insurance and brokerage and banking, as they all 
merge, you don't have any privacy.
    You can't protect the secrets of your health care, of your 
family, from being transferred, between separate affiliates in 
the holding company or with a non-affiliated third party who 
have entered into a joint marketing agreement with a financial 
institution.
    In addition, consumers have no access and correction 
rights. Since the charter of fundamental rights of the European 
Union specifically calls for consent and access and correction 
rights, will the EU continue to resist including this totally 
inadequate Gramm-Leach-Bliley Act within the safe harbor?
    Mr. Rodota. You know why the financial institutions are not 
qualified. Because if you look at the memorandum related to the 
safe harbor enforcement overview, there is a problem because 
FTC has no jurisdiction for this area. And the U.S. Government 
has notified only two bodies for the enforcement--FTC and 
Department of Commerce.
    So you can see that there is a problem for this kind of----
    Mr. Markey. Is it going to continue to be a problem for 
you?
    Mr. Rodota. No. We may have now the possibility to use 
standard contractual clauses. I think that that--now they have 
this opportunity.
    Mr. Markey. So you have an opportunity to lower the privacy 
standards in Europe?
    Mr. Rodota. Too low now.
    Mr. Markey. No.
    Mr. Rodota. No, no.
    Mr. Markey. You won't lower them.
    Mr. Rodota. No, no, no.
    Mr. Markey. Oh, good. That is what----
    Mr. Rodota. That is myself----
    Mr. Markey. Thank you. I see, yes.
    Mr. Rodota. [continuing] negotiating, but the Ambassador I 
don't know, but I am----
    Mr. Markey. Okay.
    Mr. Rodota. [continuing] on this point.
    Mr. Markey. Now, Professor Rodota or Mr. Smith, are you 
aware that last year the Clinton Administration submitted draft 
legislation which Representatives the LaFalce and Dingell and I 
introduced to close these loopholes in the Gramm-Leach-Bliley 
Act.
    Unfortunately, the Republican majority did not take up our 
bill. We are hopeful that the Bush Administration will take a 
far more favorable view. Has the EU asked the administration 
whether it intends to close the loopholes in the Gramm-Leach-
Bliley Act, which make it inconsistent with the EU privacy 
directive?
    Mr. Smith. I mean, I can't really add to the answer I gave, 
I am sorry. I was asked about this by one of your colleagues 
before you----
    Mr. Markey. You can just answer yes or no then. Have you 
asked them to adopt----
    Mr. Smith. No. As far as I know, and I cannot speak on 
behalf of the European Commission, there has been no request 
and there has been no decision in relation to the Gramm-Leach-
Bliley legislation. It was put to one side during the safe 
harbor arrangements and has not been returned to.
    And the answer I gave before, I suggested some reasons why 
there could be difficulties in considering that legislation 
adequate. And you have--and the question added to that 
explanation.
    Mr. Markey. I just wanted you to know, because my time is 
going to expire, that many people in our country say, ``Oh, we 
are not like the Europeans. They like a lot more privacy than 
we like here in the United States.'' But when they poll in the 
United States, 85 percent of Americans want the same privacy 
that you give to your citizens.
    And I think the reason is is that most of our grandparents 
came from your countries, and you can't wash your family values 
out in a generation in the United States. And so the polling is 
identical, and the only way in which we don't adopt your 
standards is that the Republicans won't allow us to have a 
clean vote on the floor of the House of Representatives.
    Because if we did, everyone would be forced to vote for it, 
because 85 percent of the American people want it. So you 
should just understand that the whole process is aimed toward 
not allowing any votes on the floor of the Congress, because 
there would be an overwhelmingly favorable vote to do exactly 
what you have done because we feel exactly like those from 
Ireland and Germany and France and Italy, etcetera, etcetera, 
feel about the very same health and financial services and 
other information issues.
    But there is a large corporate sector here that for some 
reason or another doesn't want to have a fair vote out on the 
House floor, and that is why they are sitting out there behind 
you.
    Okay. Just so you understand that.
    So keep up the good work. Okay?
    Thank you, Mr. Chairman.
    Mr. Stearns. The gentleman has 2 seconds left.
    We thank the gentleman for arriving in time, and we 
appreciate his questions. We assure him that we are going to 
try to develop a bipartisan bill. With his help, we will be 
able to do that.
    Well, we have just finished, as I said earlier, the first 
panel, and we have a vote in place. And we understand it is 
going to be successive votes between 12 and 1. And so we are 
going to motion to adjourn, and I think until 1. I think that 
is what I hear from the House, that we are going to have 
continuing votes here up until 1. So I appreciate that, to 
panel No. 2, have a nice lunch, and we will see everybody back 
here at 1.
    [Brief recess.]
    Mr. Stearns. The Subcommittee on Commerce, Trade, and 
Consumer Protection will reconvene, and I thank panel two for 
waiting. We had a number of votes, and we are going to continue 
on. We know all of you have planes to catch.
    So, panel two, we have Ambassador David Aaron, former 
Undersecretary of Commerce for International Trade, U.S. 
Department of Commerce; Mr. Jonathan Winer, former Deputy 
Assistant Secretary for International Law Enforcement, U.S. 
State Department; Professor Joel Reidenberg, Professor of Law 
at Fordham University School of Law; Mr. Denis Henry, Vice 
President, Regulatory Law, Bell Canada; and Ms. Barbara Lawler, 
Customer Privacy Manager at Hewlett Packard.
    Thank you very much, sincerely, for waiting for us. We are 
very pleased to have your opening testimony, and we will just 
start maybe just from the left and go to the right here, my 
left.
    So we would start, then, with Ambassador Aaron.

  STATEMENTS OF DAVID L. AARON, SENIOR INTERNATIONAL ADVISOR, 
 DORSEY & WHITNEY LLP; JONATHAN M. WINER, COUNSEL, ALSTON AND 
    BYRD LLP; JOEL R. REIDENBERG, PROFESSOR OF LAW, FORDHAM 
   UNIVERSITY SCHOOL OF LAW; DENIS E. HENRY, VICE PRESIDENT, 
   REGULATORY LAW, BELL CANADA; AND BARBARA LAWLER, CUSTOMER 
                PRIVACY MANAGER, HEWLETT PACKARD

    Mr. Aaron. Thank you very much, Mr. Chairman. Let me thank 
you and the committee for inviting me to testify on the 
European Union's Personal Data Protection Directive and its 
implications for U.S. privacy law.
    It is important to recognize that while we and the 
Europeans share many basic values, the EU directive comes from 
a different legal tradition and historical experience, 
including the police states and the holocaust of the last 
century. The EU directive attempts to set up a comprehensive 
personal data protection regime that tries to anticipate every 
problem and answer every question. It is enforced by a system 
of independent data privacy commissioners in each of the member 
states.
    While its goals may be laudable, there are a number of 
fundamental problems with the European directive. First, it was 
conceived over a dozen years ago when there was no World Wide 
Web and information technology was dominated by mainframe 
computers, not distributed information networks, laptops, and 
digital assistants. As a result, the directive is often rigid 
or silent in dealing with privacy issues growing out of new 
technology and new business models. Many European states have 
had great difficulty translating it into national law.
    Second, one can read the European Personal Data Protection 
Directive from end to end and not find the word ``privacy.'' 
Although the Commission--the statement on human rights talks 
about respecting private and family life, the personal data 
protection is an obligation of the states toward its citizens. 
In America, we believe that privacy is a right that inheres in 
the individual.
    We can trade our privacy--our private information for some 
benefit if we choose. In many instances, the Europeans cannot. 
This can have an important implication when it comes to 
electronic commerce. But the most troubling aspect of the 
directive for the United States is the requirement that 
personal data only be transmitted from Europe to countries that 
have ``adequate'' privacy regimes. In effect, the directive 
would embargo European personal data to any country whose 
privacy policies, including the United States, the EU had not 
approved.
    Imagine, no transatlantic bank connections, no 
transatlantic brokerage, no credit card purchases, airline or 
hotel reservations, no internet or catalog sales, no ability of 
U.S. firms to manage their operations in Europe, and vice 
versa. Fortunately, the European Commission recognized that 
this could hurt Europe as much as it would the United States.
    This was the background for the safe harbor negotiations 
which lasted more than 2 years. Let me briefly describe how the 
safe harbor emerged and what it is and what it is not.
    The first thing we established was that the United States 
was not going to negotiate a treaty or an executive agreement 
that would apply the EU directive in the United States. What we 
were prepared to do was issue guidance to the American business 
community on how to conduct commercial relations with Europe.
    This comes under the existing authority of the Commerce 
Department. In the past, we have provided such guidance to help 
protect U.S. firms doing business in places like the Soviet 
Union, China, and elsewhere.
    The second thing we made clear is that we were not going to 
accept the jurisdiction of European law in the United States. 
Indeed, we agreed that the safe harbor would be silent on the 
issue of jurisdiction. We were prepared to have voluntary self-
regulation within the framework of existing U.S. law. We were 
not going to pass new legislation.
    Third, the Europeans had to recognize that we were trying 
to adapt the directive to the most advanced information economy 
on earth. Accordingly, the actual provisions of the safe harbor 
had to be more flexible and address real-world information 
practices on a reasonable basis. Fortunately, we had the 
precedent of the privacy principles that we and the Europeans 
had agreed upon in the OECD many years ago, and this became a 
touchstone of the discussions.
    The European Commission accepted these points but had a 
bottom line of their own. They insisted on what they considered 
a high level of privacy protections for European personal data 
as provided by their directive. It was their information. They 
had the right to control its dissemination from their point of 
view.
    The result was the safe harbor accord of last year. The 
Commerce Department promulgated a set of privacy principles for 
handling European data in the United States. The EU Commission, 
over the reluctance of many European data protection 
authorities, and the outright opposition of the European 
Parliament, held that the safe harbor principles provided 
adequate privacy protections. Companies that signed up to the 
safe harbor could receive personal data from Europe without 
hindrance.
    I won't take the committee's time to review the safe harbor 
principles, but I would like to comment on what aspects of the 
directive or the safe harbor might be instructive in developing 
U.S. privacy laws. In doing so, I am drawing on my most recent 
experience at Dorsey and Whitney where we provide privacy 
advice to a wide variety of clients as well as my negotiations 
with the European Union.
    First, there is the concept of national privacy standards. 
The EU developed its directive as part of the effort to create 
a single market; that is, in order to avoid the complex and 
burden of having 15 different national privacy laws. I believe 
that we face a similar risk in the United States, only instead 
of 15 national laws we could have 50 State laws.
    But I have one important caveat. Any Federal privacy 
legislation preempting State law would have to provide high 
standards. We need the highest common denominator, not the 
lowest. If the Federal rule is a minimum standard, for example, 
that companies merely must have a privacy policy and tell their 
customers what it is, I think it would be difficult to justify 
preempting the states.
    My second observation draws upon the safe harbor. The 
essence of that deal was that we accepted high standards and 
they accepted self-regulation. Any Federal standard should 
rely, to the extent possible, on self-regulation. That, in my 
experience, is the best way to avoid high standards from 
becoming a straitjacket that could smother the information 
economy.
    Thank you very much, Mr. Chairman.
    [The prepared statement of David L. Aaron follows:]

  PREPARED STATEMENT OF DAVID L. AARON, SENIOR INTERNATIONAL ADVISOR, 
                          DORSEY & WHITNEY LLP

    Mr. Chairman, let me thank you and the Committee for inviting me to 
testify on the European Union Personal Data Protection Directive and 
its implications for US privacy law.
    It is important to recognize that while we and the Europeans share 
many basic values, the EU Directive comes from a different legal 
tradition and historical experience--including the police states and 
holocaust of the last century. The EU Directive attempts to set up a 
comprehensive personal data protection regime that tries to anticipate 
every problem and answer every question. It is enforced by a system of 
independent Data Privacy Commissioners in each of the member states.
    While its goals may be laudable, there are a number of fundamental 
problems with the European Directive. First, it was conceived over a 
dozen years ago when there was no World Wide Web and information 
technology was dominated by mainframe computers not distributed 
information networks, laptops, and digital assistants. As a result, the 
Directive is often rigid or silent in dealing with privacy issues 
growing out of new technology and business models. Many European States 
have had great difficulty translating it into domestic law.
    Second, one can read the European Personal Data Protection 
Directive from end to end and not find the word ``privacy''. Personal 
data protection is an obligation of the State toward its citizens. In 
America we believe that privacy is a right that inheres in the 
individual. We can trade our private information for some benefit. In 
many instances Europeans cannot. This can have important implications 
when it comes to e-commerce.
    But the most troubling aspect of the Directive for the United 
States is the requirement that personal data only be transmitted from 
Europe to countries that have ``adequate's privacy regimes. In effect, 
the Directive would embargo European personal data to any country who's 
privacy policies the EU had not approved.
    Imagine. No transatlantic bank transactions, credit card purchases, 
airline and hotel reservations, no internet or catalogue sales, no 
ability of US firms to manage personnel in their European operations, 
and visa versa. Fortunately, the European Commission recognized that 
this could hurt Europe as much as the United States.
    This was the background for the Safe Harbor negotiations that 
lasted more than two years. Let me briefly describe how the Safe Harbor 
Accord emerged and what it is and is not.
    The first thing we established was that the United States was not 
going to negotiate a Treaty or an Executive Agreement that would apply 
the EU Directive in the U.S. What we were prepared to do was issue 
guidance to the American business community on how to conduct 
commercial relations with other countries. This comes under the 
existing authority of the Department of Commerce. In the past we have 
provided such guidance to help protect US firms doing business in 
places like the Soviet Union, China and elsewhere.
    The second thing we made clear is that we were not going to accept 
the jurisdiction of European law in the United States. Indeed we agreed 
that the Safe Harbor would be silent on jurisdiction. We were prepared 
to have voluntary, self regulation within the framework of existing US 
law. We were not going to pass new legislation.
    Third, the Europeans had to recognize that were trying to adopt the 
Directive to the most advanced information economy on earth. 
Accordingly the actual provisions of the Safe Harbor had to be more 
flexible and address real world information practices on a reasonable 
basis. Fortunately, we had the precedent of privacy principles that we 
and the Europeans had agreed upon in the OECD many years ago. This 
became a touchstone of the discussions.
    The European Commission accepted these points but had a bottom line 
of their own. They insisted on what they considered a high level of 
privacy protections for European personal data as provided by their 
Directive. It was their information; they had the right to control its 
dissemination.The result was the Safe Harbor accord of last year. The 
Commerce Department promulgated a set of privacy principles for 
handling European Data sent to the U.S. The principles cover notice, 
choice, transfers to third parties, access, security, data integrity 
and enforcement. These are accompanied by 15 frequently asked questions 
that spell out some of the points in detail.
    The EU Commission, over the reluctance of many European Data 
Protection Authorities and the opposition of the European Parliament, 
held that the Safe Harbor principles provided ``adequate's privacy 
protections. Companies that signed up to the Safe Harbor could receive 
personal data from Europe without hindrance.
    Alternatively, US companies can negotiate contracts with European 
data suppliers that would follow the Safe Harbor principles but also 
contain other provisions called for by individual Data Protection 
Authorities who have to bless the contracts. One US multinational 
company told me that if they took that route, they would have to 
negotiate over thousands such contracts.
    I won't take the Committee's time to review the Safe Harbor 
principles, but I would like to comment on what aspects of the 
Directive or the Safe Harbor might be instructive in developing US 
privacy laws.
    First, the Directive falls short of US privacy expectations in some 
respects. For example, it provides no special safeguards for protecting 
children on-line as COPPA does. It also does not protect credit 
information the same way. As a result, experts have calculated that 
Europeans pay at least 500 basis point more for consumer credit.
    It also goes much further than many Americans might consider 
reasonable. For example, if a person orders a kosher meal on a flight, 
the airline cannot store this information for future reference unless 
the individual explicitly agrees. Why is this considered sensitive 
information? Because it might reveal the passengers religion or 
ethnicity.
    With these cautionary examples in mind let me suggest how some 
aspects of the Directive and Safe Harbor could prove useful to any 
legislative effort. In doing so, I am also drawing on my most recent 
experience at Dorsey & Whitney where we provide privacy advice to a 
wide variety of clients.
    First there is the concept of national privacy standards. The EU 
developed its Directive as part of the effort to create a single 
market--that is in order to avoid the conflicts and burden of having 15 
different national privacy laws. I believe that we face a similar risk 
in the United States, only instead of 15 national laws we could have 50 
state laws. But I have one important caveat: any Federal privacy 
legislation preempting state law would have to provide high standards. 
We need the highest common denominator not the lowest. If the Federal 
rule is a minimum standard--for example that companies merely must have 
a privacy policy and tell their customer what it is--I think it would 
be difficult to justify preempting the States.
    My second observation draws upon the Safe Harbor. The essence of 
that deal was that we accepted high standards and they accepted self 
regulation. Any Federal standard should rely to the extent possible on 
self-regulation. That, in my experience, is the best way to avoid high 
standards from becoming a straight-jacket that could smother the 
information economy.
    Is Federal privacy legislation timely? In my experience, the answer 
is clearly yes.
    Trust is a continuing issue in e-commerce. Experts estimated last 
year that the lack of consumer trust cost e-businesses $16 billion in 
lost sales. More and more companies are seeing the competitive value of 
providing good privacy practices for their customers. The States are 
already riding off in different directions on privacy. If high 
standards can be adopted at the Federal level this will provide 
American companies with a predictable framework to conduct their 
business. Even more important, it can provide the American people with 
greater confidence that their rights will be protected both on-line and 
off-line to the benefit not only to our economy but to our democracy.
    Thank you Mr. Chairman.

    Mr. Stearns. Mr. Winer?

                 STATEMENT OF JONATHAN M. WINER

    Mr. Winer. Thank you, Mr. Chairman. Thank you for the 
opportunity to testify here today.
    I wish to make 10 points about the EU privacy directive. 
First, it has extraterritorial impact. With the privacy 
directive, the EU is regulating cyber space and much offline 
activity as well. E-commerce is, by its nature, global. Thus, 
national laws regulating it tend also to quickly become global.
    Following the EU's lead, other countries are adopting 
privacy laws, some of which, including Canada's, have 
substantial potential extraterritorial impact. These new laws 
are global but inconsistent. As we are finding out in the 
United States, there are many different ideas about how best to 
regulate privacy. Internationally, we are now facing a maze of 
conflicting provisions----
    Mr. Stearns. Mr. Winer, could you bring the microphone just 
a little closer for yourself?
    Mr. Winer. Yes, sir.
    Mr. Stearns. Okay. Good.
    Mr. Winer. I didn't want to be too loud. Let us try it 
again.
    Internationally, we are now facing a maze of conflicting 
provisions that create a complex, perilous, and potentially 
non-navigable environment for the many firms that process 
personal data which crosses borders. Many of the new foreign 
privacy laws differ from existing U.S. law, yet because of the 
transborder nature of many global information flows these laws 
may, in practice, regulate substantial amounts of data 
processing within the United States.
    If the U.S. is not vigilant, such laws potentially place at 
risk U.S. competitiveness, U.S. trade, and fundamental U.S. 
values, including rights protected under the First Amendment as 
you heard last week.
    Second, the privacy directive terms, to the rest of the 
world, are tantamount to extortion. The EU is requiring that 
all other countries adopt the EU's privacy laws or risk having 
data flows to them cutoff by all of the EU's member states. As 
it has been said, the EU judges which countries in the world 
have adequate privacy laws. The EU says you don't. EU member 
states are required by the privacy directive to shut off data 
flows to that country.
    Transatlantic trade and information includes billions of 
bytes of data each day, and hundreds of billions of dollars in 
commercial activity a year. The sanction of cutting off such 
flows is one that cannot be easily activated without 
threatening fundamental damage to the global economy. The EU 
has stated it won't implement sanctions if it can find any 
other way to enforce the privacy directive.
    The EU has agreed to a stand-still in enforcement against 
U.S. firms through at least July 2001. At some point, however, 
that stand-still will end, and we could have a serious problem.
    Third, the safe harbor, unfortunately, is inadequate. 
Undersecretary of Commerce Aaron negotiated it to secure 
recognition by the EU that the U.S. system for protecting 
privacy was adequate, but he was not able to convince the EU to 
accept that U.S. Federal laws governing privacy in the 
financial services sector are adequate.
    The EU agreed to accept the U.S. system only to the extent 
that the Federal Trade Commission--and, for a small number of 
companies, the Department of Transportation--could sue U.S. 
companies who violate an agreement to live up to principles 
based upon the requirements of the directive.
    This was a very unfortunate outcome. Unlike the EU's lax 
enforcement of its privacy directive, the U.S. systematically 
enforces its privacy laws. The U.S. also has a high level of 
self-regulation. U.S. regulators have issued detailed 
regulations governing privacy in the financial services sector, 
and they examined financial institutions for compliance with 
U.S. privacy laws.
    According to a recent study sponsored by some 200 consumer 
groups, the U.S. system already protects online privacy better 
than the EU system. The EU should deem the whole U.S. system 
adequate and end the threat of cutting off data flows to the 
United States.
    Fourth, the safe harbor is unpopular. The safe harbor has 
attracted very few takers so far. Only 26 companies have 
entered as of this week, one of which is here with us today. 
The tiny number of companies signing up for safe harbor means 
the vast preponderance of all U.S. companies remains subject to 
being treated by the EU as inadequately protecting privacy.
    Fifth, as was said this morning, the privacy directive 
threatens national sovereignty. The EU is insisting that it be 
treated as the de facto global standard for privacy. After July 
1st, or whenever the enforcement stand-still ends, all EU 
member states are supposed to shut down data flows to any 
company located in any jurisdiction deemed to have inadequate 
privacy protection.
    That is true unless the company subjects itself to EU 
jurisdiction, EU rules, EU regulations, EU standards, EU 
courts, and liability to every individual whose information 
passes to the non-EU company from the territory, physical or 
electronic, of the EU.
    In early 1996, following the shoot-down of an unarmed 
civilian planes and the murder of U.S. citizens by Cuban MiGs, 
Congress passed and the President signed the Litertad Act, 
known by the name of its primary sponsors as Helms-Burton. The 
Act sought to protect the property rights of thousands of 
American citizens whose property was confiscated without 
compensation by the Castro regime, by imposing sanctions on 
those who profited off that stolen property.
    After the U.S. enacted Helms-Burton, the EU issued the 
following statement. ``The European Union is opposed to the use 
of extraterritorial legislation, both on legal and policy 
grounds. In the last few years there has been a surge of U.S. 
extraterritorial sanctions legislation. Such laws represent an 
unwarranted interference by the U.S. with the sovereign rights 
of the EU to legislate over its own citizens and companies, and 
are, in the opinion of the EU, contrary to international law.''
    In a wired world, literally millions of communications 
containing personal information go back and forth between the 
U.S. and the EU every day. A standard that insists that these 
and other cross-border information flows adhere to an EU 
privacy regime is in the regime that imposes EU law on the 
entire world.
    And last week I participated in a telephone conversation 
with an EU official who said, specifically, ``Yes. The rules we 
are applying are going to have global application. You bet.''
    The privacy directive may fairly be termed the EU's Helms-
Burton Act. It seeks to protect a class of property rights by 
demanding extraterritorial enforcement of those asserted 
property rights----
    Mr. Stearns. Mr. Winer, we just need you to wrap up.
    Mr. Winer. Yes, sir.
    Mr. Stearns. Under the 5-minute rule.
    Mr. Winer. My company is based all over the world.
    Sixth, the privacy directive is burdensome. My testimony 
goes into that.
    Seventh, it is not a good way of protecting privacy. The 
principles may look good, but in practice many of them are not 
workable.
    Eighth, do as I say not as I do. The EU is not 
systematically enforcing it. There is massive non-compliance in 
the EU.
    Ninth, like the privacy directive, the model contracts 
potentially threaten U.S. competitiveness. They would create 
causes of action for data subjects who would be third-party 
beneficiaries of those contracts.
    And, tenth, we have the power to protect ourselves from 
this foreign threat to U.S interest and U.S. economic security. 
There are a number of options the Congress has in front of it 
that could help protect us, and I urge you to consider them.
    I am happy to respond to any of your questions. Thank you, 
sir.
    [The prepared statement of Jonathan M. Winer follows:]

       PREPARED STATEMENT OF JONATHAN M. WINER, ALSTON & BIRD LLP

    Mr. Chairman and distinguished members of this Committee: My name 
is Jonathan Winer. I am an attorney practicing law with the firm of 
Alston & Bird LLP in Washington, D.C. Previously, I served from 1994 
through 1999 as Deputy Assistant United States Secretary of State for 
International Enforcement matters, where my responsibilities included 
undertaking negotiations and discussions with the European Union, and 
its executive implementing body, the European Commission, on a range of 
Trans-Atlantic matters. Prior to that, I served in the Senate for many 
years as counsel to U.S. Senator John Kerry (D-Mass.), during which 
time I worked on international, banking, and legal matters before the 
Foreign Relations, Banking, Commerce, and Judiciary Committees. 
Currently, I spend much of my time writing, lecturing, and counseling 
U.S. companies about privacy issues, including the EU Privacy Directive 
that is the subject of this hearing.
    Privacy is a fascinating and rapidly growing area of the law, and 
the issue is an exceptionally complex one. I commend this Committee for 
recognizing its importance and for initiating this set of hearings, and 
am grateful for the opportunity to testify before you.

           1. THE EU IS WRITING RULES REGULATING CYBERSPACE.

    If there is anything that is growing at an even more exponential 
rate than e-commerce, it is laws that purport to govern e-commerce, and 
in particular, laws governing privacy. Since e-commerce is by its very 
nature global, national laws regulating it tend also to quickly (and 
sometimes unintentionally) become global, raising from the beginning 
the question of whose law will wind up writing the rules by which e-
commerce and the World Wide Web operate. While some may want cyberspace 
to remain a lawyer-free zone, an ever-thickening web of laws is already 
purporting to determine what activities are permitted, and what 
activities are prohibited on-line. The vast preponderance of these laws 
are arising in the European Union, and the most important of them to 
date is the EU's Directive on Data Protection, known as the ``Privacy 
Directive.'' 1 Significantly, while many of these laws have 
been stimulated by consumer and business issues highlighted by new 
technologies, they would often regulate a far broader swath of 
activity. In the case of the EU privacy directive, the regulated 
``industry'' would extend to everyone who does business by 
communicating information about people. Under the Directive, government 
would regulate and determine what is permitted and what is prohibited 
communications about all personal data, at least in a commercial 
context.
---------------------------------------------------------------------------
    \1\ ``Data Protection Directive, 95/46/EC.'' Other EU laws that 
purport to regulate various aspects of cyberspace and the world-wide 
net include, but are not limited to, the EU Directive on E-Commerce 
(2000), which mandates particular labeling requirements, the Brussels 
Regulation, which governs consumer rights to sue in their own 
jurisdiction regardless of contractual terms to the contrary, laws on 
Access to Justice, Comparative and Misleading Advertising, Consumer 
Credit and Education, Dangerous Imitations, Long Distance Selling, 
Information Society, Package Travel, Product Liability, Product Safety, 
Time Sharing, and Unfair Contract Terms. As a senior European 
Commission official stated to the author recently, ``if it moves, we 
regulate it.''
---------------------------------------------------------------------------
    Since the passage in 1995 of the Privacy Directive, which became 
effective in 1998, there has been an explosion of new national privacy 
laws governing the off-line, as well as the on-line uses of personal 
data. Within the past twelve months alone, we have seen new data 
protection laws emerge in Argentina, Australia, Canada, Chile, and 
Paraguay, following earlier privacy laws in Hong Kong, Hungary, New 
Zealand, and Switzerland, in addition to the 15 member states of the 
European Union. Each of these laws is well-intentioned, and addresses 
what for many is becoming the assertion of a fundamental right--the 
right of private citizens to own their own personal information. Many 
of these laws have extra-territorial impact, and some, such as the 
Privacy Directive, are literally global in their application. Of 
particular interest is Canada's law, which requires all exporters of 
Canadian personal data to insure that U.S. companies importing the data 
agree to apply Canada's laws to the data so long as they retain it, 
thereby exporting Canada's laws to the U.S. in an almost EU-like 
fashion. Canada's privacy law could have a profound impact on North 
American data flows, and on NAFTA, but being only in effect for some 
two months, its impact remains difficult to measure. 2
---------------------------------------------------------------------------
    \2\ Canada's law has only been in effect since January 1, 2001, and 
currently only applies to transborder movements of data that is sold in 
the commercial context, and not mere processing of personal data. The 
latter is to be fully covered under Canadian law by January 1, 2004. 
Interestingly, despite the breadth of Canadian law, the EU has yet to 
find it to be fully ``adequate'' under the EU Data Protection standard. 
To date, only the privacy laws of Hungary and Switzerland, which mirror 
the EU's, and other states in the EU's economic area have been deemed 
adequate by the EU.
---------------------------------------------------------------------------
    Unfortunately, the laws are not just global, but inconsistent. Like 
the state legislatures in the U.S., each nation that has looked at 
privacy has come up with its own constructions for how to protect it. 
Accordingly, national privacy laws differ from one another on matters 
of definition, scope, terminology, and application, creating a maze of 
often conflicting provisions and a potential compliance nightmare for 
not just for e-commerce, but for any company doing business across 
borders with individual consumers.
    For the United States, the new web of privacy requirements creates 
some very serious potential problems for our economy and our legal 
system. Many of the new national privacy laws coming into effect 
outside the U.S. differ from existing U.S. law, and yet will have the 
impact of regulating substantial amounts of data processing within the 
United States. Indeed, in some cases, including the Privacy Directive, 
the results of the foreign laws will in practice be to create new 
enforceable legal rights that can be litigated within U.S. courts by 
Americans and non-Americans alike, regardless of whether Congress, the 
Executive Branch, or the states have decided that this is a good idea.
    The result, for the U.S., is the renewed reminder that foreign 
countries can enact laws with extra-territorial application. If the 
U.S. is not vigilant, such laws potentially place at risk U.S. 
competitiveness, U.S. trade, and fundamental U.S. values, including 
protected rights under the First Amendment. Each of these areas will be 
put at great risk by the Privacy Directive in the months ahead, as the 
EU body responsible for securing its enforcement by the 15 EU Member 
States, the European Commission, works to insure that its provisions 
are adhered to by every nation in the world.

2. UNDER THE PRIVACY DIRECTIVE, THE EU DECIDES WHETHER EACH COUNTRY IN 
      THE WORLD'S PRIVACY LAWS ARE ``ADEQUATE'' OR ``INADEQUATE.''

    Under the Privacy Directive, the EU has decided that privacy is 
such a fundamental human right that it will permit no one to export 
personal data from the EU under circumstances that differ substantially 
from the privacy rules the EU has adopted for itself. Jurisdictions 
deemed by the EU to have ``inadequate'' protection of personal data are 
supposed to be cut off from all the EU's personal data. As Trans-
Atlantic trade in information amounts to billions of bytes of 
information a day, and hundreds of billions of dollars of commercial 
activity a year, the sanction is one that cannot be easily activated 
without threatening fundamental damage to the global economy. The EU 
has recognized this, and has stated that it has no intention of 
shutting down data flows if it can find any other reasonable solution 
that adequately protects personal data. A fair amount of forbearance 
has already been shown by the EU in this regard: although its own 15 
member states have been required to be in compliance with the Directive 
since October, 1998, and several have been taken to court for non-
compliance by the European Commission, no country has actually been 
sanctioned for non-compliance with the Directive to date. Regarding the 
U.S., the European Commission has agreed to an semi-official stand-
still on enforcement against U.S. firms through at least July 1, 2001.

3. THE US-EU PRIVACY SAFE HARBOR: A HOPED-FOR ALTERNATIVE TO A PRIVACY 
                               TRADE WAR.

    Neither the U.S. nor the EU sought a trade war over privacy. During 
the Clinton Administration, the U.S., led by Under Secretary of 
Commerce David Aaron, negotiated in good faith with the EU seeking its 
recognition that the U.S. system for protecting privacy was adequate. 
Ultimately, the EU agreed to accept the U.S. system as adequate to the 
extent that the Federal Trade Commission (``FTC'') could sue U.S. 
companies that agreed live up to a series of principles based upon the 
Privacy Directive's requirements, and then failed to do so. Such 
companies could sign up to the EU's privacy standards, and thereby 
receive a ``Safe Harbor'' from the sanctions imposed by the EU on firms 
based in jurisdictions deemed by the EU to have inadequate protection.
    Notably, however, Ambassador Aaron was not able to convince the EU 
to accept that U.S. federal laws governing financial services, 
including the Fair Credit Reporting Act and the Financial Services 
Modernization Act of 1999 (``Gramm-Leach-Bliley,'' or ``GLB''), 
adequately protect privacy, despite clear evidence that these laws are 
being systematically enforced by U.S. regulators, evidence lacking to 
date in many cases in the enforcement of EU Member States of the 
Privacy Directive. Because the EU hasn't found these laws adequate, 
companies regulated by those laws cannot rely on them for protection 
against sanctions by EU member states, even if they are in complete 
compliance with U.S. federal privacy laws.
    As a result, the Safe Harbor negotiated by Under Secretary Aaron 
wound up excluding some of the most important sectors of the U.S. 
economy, including telecommunications as well as financial services and 
dramatically limiting its immediate utility.

          4. SUPPOSE THEY GAVE A SAFE HARBOR, AND NO ONE CAME?

    Notably, in the more than four months since U.S. companies have 
been able to sign up for Safe Harbor only 26 have chosen to do so as of 
March 5, 2001. A small number of these are major business-to-business 
companies, such as Dun & Bradstreet and Hewlett Packard, who have 
comparatively limited needs for processing personal information by 
comparison to the many companies whose business are centered on 
business-to-consumer transactions. Others are self-regulatory 
organizations such as TRUSTe, the Entertainment Software Rating Board, 
and the UserTrust Network, for which privacy is the line of business, 
rather than a requirement of business. The tiny number of companies 
signing up for the Safe Harbor indicates that the vast preponderance of 
all U.S. companies remain subject to being treated by the EU as having 
inadequate protection of privacy.

            5. THE PRIVACY DIRECTIVE: THE EU'S HELMS-BURTON?

    Under the Privacy Directive, the consequences for having inadequate 
protection of personal data are simple. Once the current standstill on 
international enforcement is over--currently set to expire July 1, 
2001--all EU member states are supposed (eventually) to shut down the 
flows of data to any company located in such a jurisdiction, unless 
that company contractually subjects itself to EU jurisdiction, EU 
rules, EU regulations, EU standards, EU courts, and liability to every 
individual whose information passes to the non-EU company from the 
territory, physical or electronic, of the EU.
    In an era of globalized information, the threat to shut down data 
flows is a remarkable one, but it is the heart of the Privacy 
Directive. The issue is not one of privacy, but of national 
sovereignty: should any nation, or group of nations, at this stage of 
the information economy be threatening to halt data flows to any other 
nation? In the EU, that is in fact the law imposed by the Privacy 
Directive, to those who do not provide what the EU deems to be 
``adequate protection'' to personal data.
    In early 1996, following the shootdown of unarmed civilian planes 
and the murder of U.S. citizens by Cuban MIGs in broad daylight and 
without justification, Congress passed and the President signed the 
Libertad Act, known by the name of its primary sponsors as ``Helms-
Burton.'' The Act sought to promote democracy in Cuba and to protect 
the property rights of thousands of American citizens whose property 
was confiscated without compensation by the Castro regime, by imposing 
sanctions on those who profited off that stolen property.
    After the U.S. enacted the Helms-Burton Act, the European Union 
issued the following statement:
        ``The European Union is opposed to the use of extraterritorial 
        legislation, both on legal and policy grounds. In the last few 
        years, there has been a surge of US extraterritorial sanctions 
        legislation both at federal and sub-federal level . . . Such 
        laws represent an unwarranted interference by the U.S. with the 
        sovereign rights of the EU to legislate over its own citizens 
        and companies, and are, in the opinion of the EU, contrary to 
        international law.''
    The EU complained that it was a violation of international law that 
the Helms-Burton Act empowered individuals to file private lawsuits 
against EU companies who were acting in compliance with the terms of 
their domestic laws.
    Accordingly, the EU demanded that the US suspend the right of 
anyone to sue an EU company under Helms-Burton.
    The EU also filed suit in the World Trade Organization against the 
U.S., seeking a ruling that Helms-Burton violated international trade 
laws. Eventually, the matter was resolved through a remarkable 
diplomatic effort undertaken by then Under Secretary of State Stuart 
Eizenstat, which enabled all the parties to back off from turning a 
disagreement over policy and property rights into a trade battle.
    While Helms-Burton only affected issues pertaining to property in 
Cuba, one country among some 180 UN member states, the Privacy 
Directive is global in its application to data that flows out of the 
EU's borders, and governs not merely real estate or business property 
but all personal data, except that deemed public under the laws of 
individual countries. As a result, the Privacy Directive has the 
consequence of turning the processing of information by anyone, 
anywhere, at least in a business context, into a regulated industry. 
The EU's contention that the Privacy Directive only affects information 
that is exported from the EU and is not extra-territorial makes a 
debating point, but one that is at odds with the plain facts. In a 
wired world, literally millions of communications containing personal 
information go back and forth between the U.S. and the EU every day. A 
standard that insists that all such information flows adhere to an EU 
privacy regime is a standard that imposes EU law on the entire world.
    It is not unfair to characterize the Privacy Directive as the 
``EU's Helms-Burton Act,'' except perhaps to the authors of Helms-
Burton, who never dreamed of defining property rights so globally and 
so extraterritorially.
    Indeed, last week, I participated in a conversation with a senior 
official from the European Commission who explicitly acknowledged this 
fact in connection with the issuance of new ``model contracts'' to 
enable foreign companies to come into compliance with the Directive. 
She said that the new model contracts soon to be issued by the EU as a 
base-line for the handling of data from the EU to other countries would 
have ``world-wide application.''
    The Privacy Directive goes beyond anything contemplated by Helms-
Burton in providing for extraterritorial impact on U.S. companies, 
interference with the sovereign rights of the U.S. to legislate over 
its own citizens and companies, and permitting EU citizens--and indeed, 
under certain circumstances--U.S. citizens, to sue U.S. companies for 
actions that would be legal under domestic U.S. law in connection with 
the processing of personal data by giving the EU's citizens a global 
property right in all of their personal information.3
---------------------------------------------------------------------------
    \3\ Elsewhere, I have expressed concerns about the risk to the 
public space caused by turning personal information into a property 
right. If every fact about every person, beginning with his or her name 
and address, becomes private data that he or she controls, what space 
is left for public communication about public matters? This is a very 
serious political and policy issue which assumes Constitutional 
dimensions in the United States, given our history of support for free 
expression about all matters--including other people--as set forth I 
the First Amendment. See e.g. ``Regulating the Free Flow of 
Information: A Privacy Czar as the Ultimate Big Brother?'', Jonathan M. 
Winer, The John Marshall Journal of Computer & Information Law, 
December 2000.
---------------------------------------------------------------------------
6. THE OBLIGATIONS IMPOSED BY THE PRIVACY DIRECTIVE AS IT IS NOW BEING 
    INTERPRETED ARE POTENTIALLY VERY BURDENSOME, ESPECIALLY FOR B2C 
                              BUSINESSES.

    It can be difficult to make sweeping statements about the meaning 
the Privacy Directive because different EU entities and persons have 
interpreted the Directive differently at different times. At one point, 
for example, the European Commission issued a statement reporting that 
the Directive protected solely the data of European citizens or 
residents. Later, this was judged to be incorrect, and the EU made it 
clear that it applied to all personal data that was being processed 
within the EU. Moreover, the guardians of privacy within the EU, 
represented by the EU's ``Article 29'' Committee, have issued an ever 
accreting set of standards, guidance, and opinions, with the professed 
intention of systematically strengthening privacy protection. The 
result is that the obligations for companies under the Directive are to 
some considerable extent a moving target.
    The ultimate level and vigor of the enforcement of the Privacy 
Directive by EU Member States remains uncertain, and a number of 
matters of detail pertaining to privacy are still under development by 
the European Commission. Nevertheless, the parameters of the possible 
obligations of companies based in the U.S. and other countries whose 
national laws have not been deemed to be adequate by the EU, currently 
appear to include:

 Agreeing to submit all of their data processing facilities, 
        files and documents to audit by companies in the EU who are 
        sending them data, and by each of the Data Protection 
        Authorities established in the EU.
 Promising ahead of time to cooperate with each of the EU's 
        privacy czars on any inquiry they may make regarding data 
        processing and to abide by any order the privacy czar chooses 
        to give, regardless of whether the U.S. company considers the 
        order proper, lawful, or practical, and regardless of cost.
 Limiting the use of data only to the purposes for which the 
        data has been transferred.
 Storing the data only as needed to carry out the purposes for 
        which the data has been transferred, and then destroying it.
 Promising not to retransfer the data to an entity in a 
        jurisdiction whose laws are not deemed to offer adequate 
        protection unless the data subject has opted in to such 
        transfer in the case of sensitive data, or has been given an 
        opt-out opportunity in all other cases
 Providing the data subject access to all data relating to him 
        or her being processed in the U.S.
 Allowing the data subject the right to correct or delete data 
        that has become inaccurate.
 Allowing the data subject the right to object to the 
        processing of his or her data on compelling grounds based upon 
        his or her particular situation.
 Naming a privacy officer to handle inquiries from the EU.
 Agreeing to allow anyone whose personal data is transferred 
        from the EU to a firm located in the U.S. to sue as a ``third 
        party beneficiary'' for violation of any of the above 
        provisions under any contract that permits a U.S. company to 
        import their data. This right to sue would appear to include 
        not just European citizens, but any U.S. citizen whose data has 
        been moved through the EU back to the U.S. Since the right to 
        sue would be a contractual one, in theory that right might well 
        be enforceable by U.S. citizens against U.S. companies in U.S. 
        courts.4
---------------------------------------------------------------------------
    \4\ Some of the above provisions can probably be avoided by a U.S. 
company that enters the Safe Harbor, but only to the extent that the 
data flows go from the EU to the U.S. and do not also include, for 
example, another country such as India or Mexico.
---------------------------------------------------------------------------

 7. SOME OF THE BROAD PRIVACY PRINCIPLES LOOK GOOD IN THEORY, BUT MAY 
             NOT BE SMART (OR PROTECT PRIVACY) IN PRACTICE.

    Whether the obligations in the Privacy Directive are a good or a 
bad idea, they are not today the law in the U.S. Indeed, the U.S. 
Congress has to date declined to make them the law of the U.S. 
Important arguments can be advanced by reasonable people in favor of 
and against all of the EU obligations, many of which prove as complex 
to operate in practice as they are simple to articulate in principle.
    For example, the right of access, mandated by the Privacy 
Directive, states in essence that every person should have to review 
and correct all the data that is held by any company about them. Stated 
simply, the right sounds unobjectionable. But many, perhaps most 
companies around the world, especially large ones, do not centralize 
their data bases on individuals. Rather, bits and pieces of information 
about individuals may be contained in many locations at a company. For 
example, in a Congressional office, each staffer of each Congressman 
may have their own personal contact directories set up, or case files 
pertaining to handling the needs of constituents. While some 
Congressional offices might centralize such data, most would not, and 
might even view such centralization of data as a potential threat to 
the privacy of the constituents. To implement a right of access, a 
company would need to be able to assemble all of its personal data 
about people easily into one place, for the review of the data subject. 
The process of assembling and centralizing that data carries with it 
real risks to privacy, especially if such data can be subpoenaed in 
civil cases or criminal investigations, both of which are permitted 
under the Directive. The problem becomes especially severe with large 
companies which have many different consumer divisions that handle 
personal information. Is it really good privacy policy to require such 
companies to centralize all of the data they may possess on all data 
subjects in order to permit them to easily provide consumers a right of 
access and correction? In the case of an internet service provider, 
would that include all identifiable references to these persons on the 
e-mail traffic processed by the company? Certainly, there are fair 
arguments to suggest that such centralization may in fact threaten, 
rather than protect, privacy.
    These issues become even more complex when they are taken beyond 
the context of mainframe computers--the technology that was the main 
concern at the time the Directive was conceived--to intranets, 
extranets, e-mails, telecopies, the World Wide Web, lap top computers, 
smart phones, and hand-held wireless communicators, all of which are 
theoretically fully subject to the Privacy Directive's requirements for 
consent, notice, access, uses limited to consent, right to correct, and 
so on.
    Other privacy rights guaranteed in the Directive may prove to of 
equal simplicity in statement, and equal complexity in practice. As 
former Clinton Administration privacy czar Peter P. Swire and Brookings 
Professor Robert E. Litan have written about the Directive, in their 
book ``None of Your Business,'':
        ``Under the European Directive, many routine and desirable 
        transfers of information would apparently be restricted. For 
        instance, as written, the Directive would appear to hinder 
        pharmaceutical research, could post a major obstacle to 
        investment banks' collection of important information about 
        companies, and would call into doubt many mainframe and 
        intranet applications that involve processing data in the 
        United States or other third countries.'' 5
---------------------------------------------------------------------------
    \5\ Swire and Litan, ``None of Your Business,'' Brooking 
Institution, 1998, p. 153. The complexity of the compliance issued 
raised by the Privacy Directive is illustrated by Swire and Litan in 
Appendix B to their book, which consists of a 12 page chart summarizing 
some of the potential effects and coverage of the Directive. Among the 
areas Swire and Litan list as affected by the Directive as mainframes, 
client-server systems, intranets, extranets, e-mail, telecopies, the 
World Wide Web, laptop computers and personal organizers, human 
resources records, auditing and accounting functions, business 
consulting, calling centers and other worldwide customer service, 
payment systems for financial services, sale of financial services to 
individuals, investment banking and market analysis, investment banking 
``hostile takeovers,'' which Swire and Litan believe become barred by 
the Directive; investment banking due diligence, investment banking 
private placements, mandatory securities and accounting disclosures, 
individual credit histories, corporate credit histories, the press, 
nonprofit organizations generally, international educational 
organizations, international conferences, non-European governments, 
pharmaceutical and medical device research and marketing, business and 
leisure travel reservation systems, business and leisure travel 
frequent flyer and other affinity programs, internet service providers, 
traditional direct marketing, and direct marketing over the Internet. 
Id. pps. 248-260.
---------------------------------------------------------------------------
     8. NON-COMPLIANCE WITH THE DIRECTIVE WITHIN THE EU IS MASSIVE.

    Professors Swire and Litan go on to note that EU officials tell the 
U.S. not worry about the Directive, that the EU will proceed with 
implementing the Directive sensibly and incrementally, by encouraging 
good privacy practices and imposing few penalties on individual 
organizations. The problem with these assurances, as Swire and Litan 
state explicitly is that:
        ``Europe cannot strictly enforce the letter of the Directive 
        and at the same time announce that organizations can routinely 
        ignore it. It violates the rule of law and fundamental fairness 
        to enforce a law strictly against some while allowing others to 
        violate the same law in the same way . . . An often expressed 
        concern of U.S.-based firms is that they might be targeted for 
        enforcement, even when they follow the same privacy practices 
        as their Europe-based competitors. This targeting may fit the 
        perception that American companies are less careful on privacy 
        issues, and the focus may be politically popular in Europe.'' 
        6
---------------------------------------------------------------------------
    \6\ Id at p. 155.
---------------------------------------------------------------------------
    This anxiety is not one that is without merit. Some five years 
after the passage of the Privacy Directive, the European Commission 
continues to maintain court action against four of its member states, 
France, Germany, Ireland, and Luxembourg, for their non-compliance with 
the Directive. Perhaps more to the point, there is substantial 
practical evidence that non-compliance with the Directive is widespread 
throughout the European Union.
    Lawyers who practice commercial law involving international 
businesses see this every day. A few months ago, I was asked by an 
American company to look at the privacy policies and practices of an EU 
company that it was purchasing, as part of due diligence, in order to 
assess the potential risks of liability for the U.S. firm in connection 
with the purchase. The EU company was in a consumer business that 
caused it to acquire, process, and manipulate sensitive consumer 
personal data hundreds or thousands of times every day of the kind 
theoretically protected by the Privacy Directive. The EU company had no 
on-line privacy policy. It also turned out to have no off-line privacy 
policy. In fact, it had no privacy policy at all, and after due 
diligence, we found no evidence that the EU company, had ever 
undertaken steps to comply with the Directive. Ultimately, we advised 
the U.S. company, which has comprehensive privacy policies in place, to 
seek indemnifications from the EU company in case the EU privacy 
regulator decided to sanction it. The EU company was happy to do so: it 
advised the U.S. company that in this EU country at least, the actual 
issuance of penalties for non-compliance with the Privacy Directive and 
with national privacy laws, was almost unknown.
    Thus, it is not surprising that EU consumers groups recently found 
that Internet users' privacy is better protected in the U.S. than in 
Europe, despite the Directive and all of the EU's tough national 
privacy laws. As Consumers International, a UK-based federation of 263 
consumer organizations, with members in 100 countries, found in a 
report released January 25, 2001, assessing 750 top world-wide web 
sites:

 Despite tight EU privacy legislation, researchers did not find 
        that sites based in the EU gave better information or a higher 
        degree of choice to their users than sites based in the US. 
        Indeed, U.S.-based sites tended to set the standard for decent 
        privacy policies.
 Many EU sites are failing to comply with EU rules that state 
        that they must provide the data subject with the opportunity to 
        opt out if their data is to be used for direct marketing 
        purposes.
 The most popular U.S. sites were more likely than the EU ones 
        to give users a choice about being on the company's mailing 
        list or having their name passed on, despite the existence of 
        legislation which obliges EU-based sites to provide users with 
        a choice.7
---------------------------------------------------------------------------
    \7\ Privacy@net, An international comparative study of consumer 
privacy on the internet, January, 2001, published by Consumers 
International, and available at www.consumers
international.org.
---------------------------------------------------------------------------
    In short, the ongoing efforts by the EU to require other countries 
to adopt the EU's standards for the protection of privacy is preceding, 
rather than following, the EU effectively securing enforcement of its 
laws within the borders of its Internal Market. The EU is demanding 
that companies based overseas comply with a Directive that is subject 
to massive non-compliance within the EU itself.

    9. THE FURTHER THREAT POSED BY THE EU'S NEW ``MODEL CONTRACTS.''

    There is little reason for the Congress to delay in considering 
these kinds of options. The current stand-still on enforcement by the 
EU is currently due to end on July 1, 2001, at which time U.S. firms 
who have not entered the Safe Harbor, or who like financial 
institutions are not eligible for the Safe Harbor, are potentially at 
risk from EU sanctions. The EU has not stood still while the Safe 
Harbor process has continued, but has developed as an alternative to 
Safe Harbor the approach of Model Contracts. These amount to contracts 
of adhesion whereby non-EU data importers must agree to the 
jurisdiction, choice of law, substantive law, authority, regulation and 
oversight by EU data exporters and the EU's privacy czars. These model 
contracts, discussed in greater depth below, have many risky elements 
for U.S. firms. Among the most troubling are the requirement in these 
Model Contracts for joint and several liability for U.S. firms with 
their EU counterparts for any alleged violation of anyone's privacy; 
the requirement that data subjects be given the right to sue the U.S. 
firms for any alleged violation of their privacy; and the requirement 
that U.S. firms pre-emptively capitulate to whatever the EU chooses to 
order them to do in the event any EU entity judges them to have 
violated someone's privacy.
    The EU is currently planning to adopt these Model Contracts as a 
recommended minimum floor of data protection to be enforced by each of 
the EU's privacy czars as early as this July. In the future, these 
Model Contracts, or provisions similar to them, or based upon them, 
could become the de facto minimum standard for the processing of all 
data by the private sector regarding persons that leaves the EU (other 
than limited categories of public data.) Their potential risks for U.S. 
competitiveness, and the risks they pose of creating an unfair burden 
on non-EU entities throughout the world, can hardly be overstated. Just 
last week, a senior European Commission official acknowledged that most 
countries' privacy laws would never be found to be ``adequate'' under 
the Directive, and that the Model Contracts would therefore have global 
application.
    It is very important to the components of U.S. industry that are 
outside the Safe Harbor, including financial services, that the Model 
Contracts not be used as a mechanism to force them into undertaking 
obligations that vastly exceed the obligations undertaken by companies 
permitted to enter the Safe Harbor. It is also important that the Model 
Contract process not be permitted to overtake, and overwhelm, the 
ongoing talks between the US and the EU on obtaining a finding of 
adequacy for the Gramm-Leach-Bliley Act and the Fair Credit Reporting 
Act, with their detailed regulations, under the Directive. The EU needs 
to understand that U.S. laws, too, need to be respected, just as the 
laws of its Member States must be.

          10. OPTIONS FOR U.S. POLICY MAKERS AND THE CONGRESS.

    In light of the potential impact of the Privacy Directive on U.S. 
trade, the exercise of First Amendment rights, and U.S. 
competitiveness, the U.S. Congress should take a careful look at its 
range of options. These could include the following, which offered as 
an illustrative, and incomplete list of possibilities:

 Enacting U.S. federal laws that mimic those of the European 
        Union, granting every person whose information is processed in 
        the United States the right to sue anyone who has used that 
        information for any purpose without their consent. This option 
        risk running into substantial First Amendment and other 
        Constitutional limitations, for the reasons expressed in great 
        detail by Professor Volokh in his testimony before this 
        Committee last week. Exercising this option would also turn 
        every processor of information in the private sector into a 
        member of a regulated industry, requiring a dramatic expansion 
        of government control of the U.S. private sector, providing new 
        opportunities for crowding U.S. courts with allegations of 
        privacy torts, by Americans and overseas persons 
        alike.8
---------------------------------------------------------------------------
    \8\ See also Swire and Litan, id, at p. 122. ``A strict 
interpretation of the Directive could ban a great many practices by the 
press. The tension between the press and privacy laws is clear enough: 
an important responsibility of the press is to publicize personally 
identifiable information. In reporting on politics, business, 
entertainment, and sports, journalists routinely discuss named 
individuals. Often the reporting is done without the consent of the 
subject . . . Under Article 9 of the Directive, member states can make 
exemptions for the press, but the exemptions must be `solely for 
journalistic purposes' and `only if they are necessary to reconcile the 
right to privacy with the rules governing freedom of expression.' This 
language seems to emphasize privacy rights and give relatively little 
scope to protecting free expression. As governed by Article 9, the 
press will face compliance difficulties when it transfers personal 
information out of Europe.''
---------------------------------------------------------------------------
 Pressing the EU to recognize, as international consumer groups 
        have, that the U.S. system for protecting privacy is in 
        practice at least as effective as that of the EU, and therefore 
        constitutes adequate protection, eliminating the risk of the 
        disruption of data flows.
 Doing as the EU did in response to Helms-Burton, and treating 
        any efforts by the EU to enforce its Privacy Directive against 
        U.S. companies in a fashion that is extraterritorial as an 
        improper restraint of trade suitable for resolution by the 
        World Trade Organization.
 Doing as Canada did in response to Helms-Burton, and imposing 
        a blocking statute that in effect, prohibits firms from 
        complying with the Directive to the extent that it is 
        inconsistent with U.S. law, and allowing U.S. firms to ``claw 
        back'' damages from any EU counterparts caused by their use of 
        the Privacy Directive to the injury of the U.S. firm.
 Creating a ``Safe Harbor'' for U.S. firms that adhere to U.S. 
        federal privacy laws, by making compliance with such a laws a 
        ``per se'' defense to any private cause of action for alleged 
        breach of privacy or related claims in any court based in the 
        U.S.
 Further developing a regime of informed consent, under which 
        companies that provided mechanisms for consumers to exercise 
        informed consent were given a safe harbor against privacy 
        claims in U.S. courts, so long as they lived up to their 
        contractual obligations to data subjects.
 Asking the U.S. Trade Representative to consider recommending 
        to the President the use of appropriate sanctions under Super 
        301 or other trade authorities to insure adequate protection of 
        U.S. firms through proportionate measures to respond to any 
        injuries to U.S. companies by the EU.
    The Congress has some less dramatic additional interim options 
which could do much both to protect privacy, the First Amendment, and 
to simultaneously protect American competitiveness and trade. These 
include:

 Asking the Executive Branch to secure from the EU a detailed 
        assessment of the existing compliance with the Privacy 
        Directive by firms based in the EU, prior to negotiating 
        further obligations for U.S. firms to comply with the 
        Directive.
 Seeking and obtaining assurances from the EU that no action 
        will be taken against U.S.-based firms for alleged violations 
        of the Directive, until the EU can provide evidence that most 
        EU-based firms have come into compliance with the Directive.
 Seeking and obtaining assurances from the EU that no action 
        will be taken against U.S.-based firms for alleged violations 
        of the Directive until the EU can demonstrate that it has 
        effective mechanisms in place to prevent similar alleged 
        violations by other countries around the world that process 
        substantial amounts of personal data from the EU, including 
        Brazil, China, Egypt, India, Indonesia, Israel, Japan, 
        Malaysia, Russia, South Africa, South Korea, Sri Lanka, Taiwan, 
        Thailand, among others.
 Insuring that EU Member States do not in practice force U.S. 
        firms to enter into ``Model Contracts'' in order to import 
        personal data from the EU that would create contractual rights 
        for data subjects that would enable them to fill U.S. courts 
        with privacy litigation, including class actions.
 Asking the GAO to determine the regulatory capacity of the 
        U.S. to enforce the existing Safe Harbor and/or the broader 
        parameters of the Privacy Directive were it applied to all 
        processing of personal data by U.S. companies, and to estimate 
        the potential cost of developing the regulatory capacity to 
        administer the equivalent of the Directive in the U.S.
 Asking the Department of Commerce and the Office of the Trade 
        Representative to develop a menu of possible options to respond 
        to any cut-offs of data flows from the EU to the United States 
        and to provide a report to Congress specifying these options.
 Asking the Office of the Trade Representative to review 
        whether data protection laws at the national or EU level may 
        violate the free trade rules administered by the World Trade 
        Organization, a recommendation advocated for consideration 
        several years ago by Professors Litan and Swire, and to develop 
        the analytic and factual basis for making such a case in the 
        event that the EU improperly imposed sanctions on U.S.-based 
        firms.
 Asking the Department of Commerce to catalogue the benefits of 
        maintaining the existing data flows, and to assess the damage 
        that might be done were they to be impeded by enforcement 
        action by the EU under the Privacy Directive,

                          11. FINAL THOUGHTS.

    In conclusion, your Committee has taken on an enormous issue in 
focusing on the impact of the Privacy Directive on the U.S. The 
Directive is not, unfortunately, a unique provision. Bit by bit, in its 
effort to harmonize its own laws for its internal market, the EU is 
developing other Directives that will come to have an increasingly 
global impact in setting standards for the whole world. Some of these 
Directives will surely contain sensible and useful elements. Others may 
reflect mistaken choices in policy. In either case, the U.S. needs to 
develop mechanisms to provide early warning on the impact of such 
Directives on the U.S., on U.S. competitiveness, and on U.S. 
Constitutional and policy values. The U.S. and the EU come from 
different histories, and in some areas, such as the area of what is 
appropriate governmental regulation, from different philosophies. The 
U.S. economy has been the strongest in the world throughout the years 
of the ongoing information revolution and the development of the 
world's new economy. It would be a tragedy if the laws and rules of 
other jurisdictions were permitted to put our economy at risk, and to 
threaten the free flow of information so necessary to the world's 
further economic development, however noble the intentions or lofty the 
goals.
    With your permission, I would like to include with this testimony 
more detailed analyses of the major provisions of the Privacy Directive 
and the US-EU Safe Harbor, and of the new Model Contracts being 
proposed by the EU for adoption and application world-wide later this 
year.
    Thank you. I look forward to responding to any questions, and to 
providing the Committee with any form of assistance you may request.
                            *      *      *
        Analysis of the EU Privacy Directive and the Safe Harbor

                      A. THE EU PRIVACY DIRECTIVE.

    The European Union's Privacy Directive became effective on October 
25, 1998. The Directive:

 Embraces individual privacy as a fundamental human right;
 Applies to the processing and transfer of personal data 
        concerning EU residents;
 Requires the EU individual's consent for gathering and 
        dissemination of personal information;
 Applies to all entities that gather, store or use personal 
        data concerning EU residents, including those in the U.S. and 
        every other country;
 Covers personal data transfers not only among affiliates, but 
        even within a single corporate entity if the data is exported 
        beyond the EU;
 Includes all data, electronic and non-electronic;
 Demands that data must be destroyed when no longer needed for 
        the original purpose;
 Is enforced in each EU Member State by the Data Protection 
        Authority, which operates independently of the government;
 Provides for civil suits with damages; and
 Provides extraterritorial protections that restrict the 
        transfer of covered personal data to only those non-EU 
        countries that provide an ``adequate'' level of privacy 
        protection.

                     B. THE SAFE HARBOR AGREEMENT.

    The Safe Harbor Privacy Principles, negotiated between the U.S. 
Department of Commerce and the European Union and agreed to in July 
2000, grant U.S. companies who are subject to the jurisdiction of the 
FTC or the Department of Transportation a presumption of ``adequacy'' 
of protecting personal data for purposes of the Directive, thereby 
allowing data transfers from the EU to continue to that company. U.S. 
organizations that choose not to qualify for the Safe Harbor will only 
be able to transfer data from the EU under one of the allowed 
exceptions or with an alternative safeguard, such as an EC-approved 
contract with the EU entity transferring the data--an approach 
permitted in theory but not yet available due to the European 
Commission's failure thus far to adopt model contract provisions. In 
the meantime, the negotiations over treatment of financial services 
companies have not been completed, leaving banks, savings and loans, 
and credit unions, other than their affiliates under certain 
conditions, outside the Safe Harbor.
    Briefly, the Safe Harbor:

 Consists of the seven principles of notice, choice, onward 
        transfer, security, data integrity, access, and enforcement;
 Is voluntary;
 Applies forever to all EU personal data received during the 
        company's participation, even if the company later leaves the 
        Safe Harbor;
 Has been available since November 1, 2000 to U.S. 
        organizations through two qualifying options: (1) joining a 
        self-regulatory organization; or (2) implementing appropriate 
        self-regulatory privacy policies;
 Offers protection against direct enforcement by EU Data 
        Protection Authorities (``DPAs''), although if an individual 
        DPA working in conjunction with the FTC finds a violation or 
        ``substantial likelihood'' of a violation, it will be permitted 
        to bring enforcement against a U.S. company; and
 Does not protect U.S. organizations against private rights of 
        action by EU residents, who may initiate privacy actions under 
        their respective national laws.

1. Signing Up for the Safe Harbor Program.
    The U.S. Department of Commerce has had the Safe Harbor program in 
place and available for participation by U.S. companies on November 1, 
2000. As of March 5, 2001, 26 U.S. companies had signed up for the Safe 
Harbor. There is as yet no fixed date by which U.S. organizations must 
either join the Safe Harbor or risk disruptions in the transfer of 
information from EU Member States. The current stand-still on 
enforcement by the EU runs out on July 1, 2001, although EU officials 
have privately told U.S. officials that they anticipate extending the 
standstill for a further period as they continue to efforts to secure 
compliance with the Directive within the EU's Internal Market..
    Safe Harbor members remain subject to the substantive requirements 
of the Directive and open to private rights of action by EU residents.

2. Qualifying for the Safe Harbor.
    There are several methods by which organizations may qualify for 
the Safe Harbor. An organization may self-certify to the Department of 
Commerce that:

 It has joined a self-regulatory organization that adheres to 
        the Principles;
 It has implemented privacy policies that conform with the 
        privacy principles of the Directive; or
 It is subject to a statutory, regulatory, administrative or 
        other body of law that effectively protects personal privacy 
        consistent with the Directive. (Note: To date, the EU has not 
        accepted that any U.S. law meets this standard, so this option 
        is not currently available to U.S. companies.)
    Alternatively, an organization may enter into EU-approved contracts 
directly with the entities in the EU that transfer data to the U.S. 
(Note: This option is also not yet available in practice, as such 
contracts must follow forms approved by the European Commission, which 
has not yet issued such forms. However, the Model Contracts are nearing 
the completion phase, and are due to be recommended by the relevant 
committee overseeing the Directive, the so-called ``Article 31'' 
Committee, in late March, 2001. Further discussion of the Model 
Contracts is set forth below.)
    Organizations that rely on self-regulation and self-certification 
are subject to FTC enforcement for unfair or deceptive trade practices 
with respect to any misrepresentations concerning their adherence to 
the Principles. Companies that choose to self-regulate and self-certify 
must provide the Department of Commerce a self-certification letter on 
an annual basis. The Department of Commerce has agreed to establish and 
maintain a publicly available list of companies adhering to the 
Principles. An organization that fails to submit an annual self-
certification letter will be removed from the list and Safe Harbor 
benefits will no longer be assured via this mechanism. Safe Harbor 
benefits begin on the date an organization self-certifies to the 
Department of Commerce. Once an organization joins the Safe Harbor, it 
must apply the Principles to covered data for as long as it stores, 
uses or discloses the data, even if it subsequently leaves the Safe 
Harbor.

3. Applying the Safe Harbor's Seven Privacy Principles (Building a 
        Privacy Program).
    The Principles are comprised of the basic concepts of notice, 
choice, onward transfer, security, data integrity, access, and 
enforcement. Any organization qualifying for the Safe Harbor program 
must develop a privacy policy that complies with these seven basic 
principles.
    a) Notice. The U.S. organization must provide EU individuals with 
clear and conspicuous notice regarding the purposes for which it 
collects and uses their personal information; how to contact the 
organization with inquiries or complaints; the types of third parties 
to which it discloses the information; and the choices and methods 
available to the individual for limiting its use and disclosure (the 
Notice). Personal data and information are defined in the Principles as 
``data about an identified or identifiable individual that are within 
the scope of the Directive, received by a U.S. organization from the 
European Union, and recorded in any form.''
    The organization must supply the Notice when individuals are first 
asked to provide personal information or as soon thereafter as 
practicable, but prior to disclosing the information to a third party 
or using it for any purpose other than that for which it was originally 
collected. When disclosing information to a third party that is 
operating as an agent (such as an outsourcer or other third party 
service provider), the organization is not required to provide Notice.
    b) Choice. A qualifying organization must allow individuals to opt 
out of: (a) disclosing their information to a third party; and (b) 
using their information for a purpose other than that for which it was 
originally collected. The Principles do not define the term 
``organization,'' leaving unanswered the question of whether an 
organization may share data with its affiliates without a formal opt-
out procedure.
    Individuals must affirmatively consent (opt in) to an 
organization's disclosure of sensitive personal information to a third 
party or using it for a purpose other than that for which the 
information was originally collected. Sensitive information includes 
personal information specifying medical or health conditions, racial or 
ethnic origin, political opinions, religious beliefs, trade union 
memberships, information specifying the sex life of the individual, and 
any information submitted by a third party as sensitive information. 
There are limited exceptions; for instance, opt-in approval is not 
required when the sensitive information is necessary to carry out the 
organization's employment obligations.9
---------------------------------------------------------------------------
    \9\ See Draft, Frequently Asked Questions (FAQs) FAQ 1--Sensitive 
Data (all FAQs are accessible from http://www.ita.doc.gov/td/ecom/
menu.html; hereinafter referenced as ``FAQ ____'').
---------------------------------------------------------------------------
    c) Onward Transfer. Organizations may only disclose personal 
information to third parties consistent with the principles of notice 
and choice. With respect to transfers of personal data to a third party 
acting as an agent, an organization must determine either that the 
Agent subscribes to the Principles or is subject to the Directive, 
before transferring the data. If the agent does not meet one of these 
requirements, the contract between the organization and the agent must 
obligate the agent to provide at least the same level of privacy 
protection as required under the Principles. If an organization 
complies with this requirement, it will not be held responsible for an 
agent's improper processing of the personal data, unless it knew or 
should have known that the third party would process the information 
improperly.
    d) Security. Organizations that collect, maintain, use or disclose 
personal information must take reasonable precautions to protect such 
personal information from loss, misuse and unauthorized access, 
disclosure, alteration and destruction.
    e) Data Integrity. Organizations may collect only that personal 
information relevant to the purpose for which it will be used and must 
take reasonable steps to ensure that such personal data is not only 
reliable for its intended use, but is also accurate, complete and 
current. If an organization is serving merely as a conduit for personal 
data transmitted by third parties (e.g., ISPs, telecommunications 
carriers, or others that merely transmit, route, switch or cache 
information) and does not determine the purposes and means of 
processing such data, it will not be held responsible for any violation 
of the Principles by the third parties transmitting such 
data.10
---------------------------------------------------------------------------
    \10\ See FAQ 3.
---------------------------------------------------------------------------
    f) Access. The right of access is considered fundamental to the 
Principles, but it is not absolute. Organizations must give individuals 
access to their personal information and the ability to correct, amend 
or delete inaccurate information, except where the burden or expense of 
providing access is disproportionate to the individual's privacy rights 
at issue or where the rights of persons other than the requesting 
individual would be violated.11 Individuals are not 
obligated to justify any request for access to their own personal data 
and organizations are permitted to charge a reasonable fee for such 
access. If an organization decides to deny access, it must be for a 
specific reason and the organization must provide an explanation of its 
decision to the requesting individual.12
---------------------------------------------------------------------------
    \11\ See FAQ 8.
    \12\ See FAQ 8 for a detailed explanation of the access principle.
---------------------------------------------------------------------------
    g) Enforcement. Safe Harbor organizations must implement compliance 
procedures or mechanisms. At a minimum, this must include: (a) readily 
available and affordable independent recourse mechanisms by which an 
individual's complaints are investigated and resolved and damages 
awarded as provided under applicable law or private sector initiatives; 
(b) follow-up procedures for verifying that the assertions businesses 
make about their privacy practices are true and have been implemented 
as presented; and (c) obligations to remedy problems arising out of 
failure to comply with the Principles and consequence for violators.
    An organization may satisfy the dispute resolution requirements set 
forth in (a) and (c) above by: (1) agreeing to cooperate with DPAs 
located in the European Union; (2) complying with private sector-
developed privacy programs that incorporate the Principles into their 
rules and that include effective enforcement mechanisms of the type 
described in the enforcement principle; (3) complying with legal or 
regulatory supervisory authorities that provide for the handling of 
individual complaints and dispute resolution; or, (4) any other 
mechanism devised by the private sector that meets the requirements of 
the enforcement principle.
    An organization may fulfill the verification requirement of (b) of 
the enforcement principle either through self-assessment or outside 
compliance reviews. Under the self-assessment approach, an organization 
must issue an annual written verification statement, signed by a 
corporate officer or other authorized representative and made available 
upon request. 13 Under the outside compliance approach, 
reviews should be conducted at least once a year and should demonstrate 
that an organization's privacy policy conforms to the Principles, and 
that the organization is in compliance.14
---------------------------------------------------------------------------
    \13\ See FAQ 7.
    \14\ See FAQ 7.
---------------------------------------------------------------------------

4. How Violations May Be Enforced .
    Violations of the Safe Harbor Privacy Principles may be enforced in 
several ways. An organization that chooses to subject itself to DPA 
enforcement must agree to: (a) cooperate with the DPAs in the 
investigation and resolution of complaints brought under the Safe 
Harbor; (b) comply with any advice given by the DPAs, including 
remedial or compensatory measures; and (c) provide the DPAs with 
written confirmation that such action has been taken. Organizations 
must comply with the advice of the DPAs within 25 days. If the 
organization has not complied, or proffered a satisfactory explanation 
for its non-compliance, the DPA will submit the matter to the FTC or 
other U.S. federal or state body with statutory powers to take 
enforcement action. Any failure to cooperate with the DPAs or to comply 
with the Principles will be actionable as a deceptive practice under 
Section 5 of the FTC Act.15
---------------------------------------------------------------------------
    \15\ See FAQ 5.
---------------------------------------------------------------------------
    The FTC has agreed to review on a priority basis any complaints of 
Safe Harbor violations referred by privacy self-regulatory 
organizations (such as TRUSTe and BBBOnline) or EU member nations. If 
the FTC finds a violation, it may seek an administrative cease and 
desist order (with potential civil penalties) or file a complaint in a 
federal district court (with potential civil or criminal contempt 
charges). If an organization persistently fails to comply with the 
Principles, it will be denied the benefits of the Safe Harbor.

5. Exceptions to the Principles.
    The Principles provide for exceptions in certain limited 
circumstances. These include: (a) where necessary to meet national 
security, public interest or law enforcement requirements; (b) where 
statutes, government regulations or case law create conflicting 
obligations or explicit authorizations, provided an organization can 
demonstrate that its non-compliance is limited to the extent necessary 
to meet the overriding legitimate interests furthered by such 
authorization; or (c) where the effect of the Directive or a Member 
State's law is to allow exceptions, provided they are applied in 
comparable contexts.

6. Current Data Transfers Protected for the Time Being.
    Pursuant to Article 26 of the Directive, Member States may permit a 
transfer or a set of transfers of personal data to a third country that 
does not ensure an adequate level of protection if: (a) the data 
subject has given his consent unambiguously to the proposed transfer; 
(b) the transfer is necessary for the performance of a contract between 
the data subject and the controller or the implementation of pre-
contractual measures taken in response to the data subject's request; 
(c) the transfer is necessary for the conclusion or performance of a 
contract in the interest of a data subject between the controller and a 
third party; (d) the transfer is necessary or legally required on 
important public interest grounds; (e) the transfer is necessary to 
protect the vital interests of the data subject; or (f) the transfer is 
made from a register which, according to laws or regulations, is 
intended to provide information to the public and which is open to 
public consultation.

7. Effectiveness to Be Evaluated in 2001, 2003.
    The Commission will review the initial progress of the Safe Harbor 
program in mid-2001. This interim evaluation will be conducted by the 
Department of Commerce and the Commission to determine whether any 
organizations have joined the Safe Harbor and whether their privacy 
programs have been successful. If U.S. organizations are either not 
participating in the Safe Harbor, or are not complying with the Safe 
Harbor requirements, the Department of Commerce and the Commission will 
re-evaluate the Safe Harbor and may at that time set a date by which 
U.S. organizations must comply or risk disruptions in data transfers 
from Member States. The Commission will then conduct a more formal 
review of its decision and the effectiveness of the Safe Harbor in 
2003.

8. Timing of Safe Harbor Decision.
    For most U.S. companies, there have been three natural 
opportunities to make judgments about whether to enter the Safe Harbor: 
(1) the initial period after November 1; (2) the spring of 2001, 
following the formation of a new Administration and the resumption of 
U.S. and EU negotiations over financial services; and (3) June, 2001, 
before the current enforcement stand-still is theoretically due to 
expire. As set forth above, very few U.S. companies took advantage of 
the initial period, nor does their currently appear to be a rush to 
sign up. Most companies have been well-advised to defer their decisions 
until close to the deadline for the end of the stand-still, when it may 
become easier to assess actual EU enforcement intentions.

9. Safe Harbor Intended to Provide Predictability and Harmonization.
    The Department of Commerce has described the Safe Harbor as 
providing ``predictability and continuity for U.S. and EU companies 
that are sending and receiving personal information from Europe.'' 
16 The principal benefit ascribed to the Safe Harbor is that 
it makes automatic the approval by all EU Member States of data 
transfers to participating U.S. companies, giving a presumptive finding 
of adequacy for any company that has signed up, articulated its 
commitment to the Principles, and specified its agreement to an 
enforcement mechanism. In addition, the Directive is designed to be 
implemented by laws in each of the fifteen countries that are members 
of the EU. These laws vary significantly. By providing a single set of 
data protection rules, the Safe Harbor may offer advantages for 
companies that operate in more than one EU country.
---------------------------------------------------------------------------
    \16\ The Safe Harbor Privacy Principles, Frequently Asked Questions 
and other supporting final documents, including further information on 
the Safe Harbor list and European Commission supporting documents, are 
available from the DOC at: http://www.ita.doc.gov. Organizations will 
also be able to sign up for the Safe Harbor list at this Web site.
---------------------------------------------------------------------------
    At the same time, these benefits come at a significant cost. 
Participation requires U.S. companies to undertake substantive privacy 
obligations that go far beyond those required under current U.S. law. 
The Principles require not merely notice and choice for consumers, but 
a commitment by the Safe Harbor participant not to transfer personal 
data to any third party unless the Safe Harbor participant is assured 
that the third party also adheres to the Principles. Participating 
companies must also provide access for each individual to all of their 
personal information held by the organization, and the right to 
correct, amend or delete inaccurate information. In general, U.S. 
companies that sign on to the Safe Harbor automatically submit 
themselves to the jurisdiction of the Federal Trade Commission (FTC), 
which will have the authority to enforce the Safe Harbor by treating 
failures to comply with posted privacy policies as unfair or deceptive 
trade or business practices. Companies that do not abide by their Safe 
Harbor commitments may also be subject to civil actions for damages 
brought directly by individual European citizens.

10. Key Terms Still Ambiguous.
    Applying the Safe Harbor could be especially complex for U.S. 
companies whose structure includes multiple corporate units handling 
different kinds of personal information for different purposes. Key 
terms used in the Principles, such as ``organization'' and ``third 
party,'' remain intentionally undefined because of differences between 
the U.S. and the EU over the meaning of the terms. These ambiguities 
make it difficult to determine whether a transfer of personal 
information is within the ``organization'' and permissible or to a 
``third party,'' requiring consumer consent. Differing interpretations 
of the law by the individual EU Privacy Commissioners raise other 
uncertainties, as does the mix of enforcement mechanisms in the U.S. 
and in the EU.

11. Status of U.S. Financial Institutions Remains To Be Negotiated.
    Financial institutions, as broadly defined under the Financial 
Services Modernization Act of 1999 (the ``Gramm-Leach-Bliley'' bill or 
``GLB,'') face separate issues. The U.S. and the European Commission 
were unable to reach agreement that GLB adequately protects privacy, in 
large part because GLB permits the sharing of personally identifiable 
information among affiliates. As a result, compliance with GLB for 
financial institutions is not at this time deemed by the EU to 
constitute compliance with either the Directive or the Safe Harbor. 
Because the FTC's underlying authority excludes banks, savings and 
loans and credit unions from FTC jurisdiction, these financial 
institutions may not participate directly in the Safe 
Harbor.17 The Department of Commerce has advised that 
applications from such institutions for the Safe Harbor will not be 
accepted, because of the absence of FTC jurisdiction.
---------------------------------------------------------------------------
    \17\ See 15 U.S. C. Sec. 45(a)(2) and Sec. 45(a)(f)(1), for a 
description of the FTC's jurisdictional limits.
---------------------------------------------------------------------------
    The U.S. and the European Commission have agreed in principle to 
renew talks in an effort to secure an agreement covering financial 
services, but these negotiations have yet to move forward in a 
substantive fashion. In the meantime, the EU stand-still for financial 
services is expected to remain in place until at least July 1, 2001, 
and from then, until some agreement is reached between the U.S. and the 
EU on an enforcement mechanism to permit their participation in the 
Safe Harbor or compliance with the Directive through other means.

12. How Safe Harbor Works.
    When a company signs up for the Safe Harbor, it is obligated to 
apply the Principles to all data transferred after the date it enters 
the Safe Harbor, except data that is manually processed. That 
obligation remains regarding that data forever, even if the company 
later withdraws from the Safe Harbor. To qualify, a company must also 
specify to which enforcement agency's jurisdiction it is submitting. At 
this time, only two U.S. agencies have been granted recognition by the 
EU for this purpose: (1) the Department of Transportation, for airline 
carriers, computer reservation systems and other entities it regulates; 
and (2) the FTC for all other U.S. businesses (except as noted above).

13. Qualifying for the Safe Harbor.
    The DOC is administering the Safe Harbor and has posted rules for 
signing up.18 The rules include:

    \18\ See http://www.ita.doc.gov.
---------------------------------------------------------------------------
 Notification to the DOC by a corporate officer by mail or 
        through www.ita.doc.gov/ecom that the organization adheres to 
        the Principles;
 A request to be put on the Safe Harbor List;
 Public declaration by the organization that it adheres to the 
        Principles and the inclusion of this statement in a published 
        privacy policy; and
 Specification that it is subject to the jurisdiction of the 
        FTC or the Department of Transportation, and further 
        specification of any self-regulatory body, such as TRUSTe or 
        BBBOnline, whose rules it is applying as a means to adhere to 
        the Principles.

 C. ANALYSIS OF THE NEW EU MODEL CONTRACT FOR PERSONAL DATA TO COMPLY 
                     WITH THE EU PRIVACY DIRECTIVE

    As part of securing global compliance with its Directive on Data 
Protection (the Directive), the European Union is nearing adoption of 
``Model Contracts'' to govern the transfer of personal data from the EU 
to the United States. New draft Model Contracts are currently under 
review at the European Commission in Brussels, and final action could 
come as soon as June, 2001. To date, the U.S. government has not taken 
a position on the Model Contracts, despite their broad potential impact 
on U.S. companies.
    The new Model Contracts obligate U.S. importers of data to comply 
with substantive EU data privacy law containing requirements far more 
onerous than those applicable in the United States. Compliance with the 
legal obligations embodied in the Model Contracts could create very 
substantial costs for U.S. companies and impact the U.S. and global 
economies.
    Once approved by the EU, the Model Contracts would permit an EU 
entity to send personal data to a company located in a country, such as 
the U.S., that the EU has not yet deemed to have ``adequate 
protection'' in place for personal data. The Directive indicates that 
adoption of a Model Contract is one means of achieving adequate 
protection. Under the terms of the U.S.-EU Safe Harbor agreement on 
data privacy made in July, 2000, entry by a U.S. company into the Safe 
Harbor is another means of achieving adequacy of protection. However, 
the Safe Harbor is not available to certain types of companies such as 
financial institutions and telecommunications companies, leaving them 
potentially no alternative to the Model Contracts. Furthermore, recent 
comments by EU officials may cast doubt upon the Safe Harbor as a fully 
sufficient means of satisfying EU regulatory requirements. As no other 
means of providing adequacy of protection has been approved by the EU, 
Model Contracts may come to be required for many U.S. companies 
receiving personal data from the EU.19 Notably, the EU 
intends to create an exception to this requirement for a non-EU company 
that is merely processing data on behalf of an EU company and that 
exercises no control over the data.
---------------------------------------------------------------------------
    \19\ It is not yet clear the extent to which existing contracts 
between EU and US firms governing the processing of personal data from 
controller to controller will be grandfathered and renewable. The 
European Commission has informally stated that it anticipates existing 
contracts will remain lawful, but that the Data Protection Authorities 
will have the discretion to require tougher privacy obligations as such 
contracts are renegotiated.
---------------------------------------------------------------------------
    The Model Contracts raise questions of U.S. sovereignty. Under the 
Model Contracts, U.S. firms would be required to apply EU substantive 
privacy law to their operations extraterritorially and to submit to EU 
jurisdiction and auditing of their facilities. They also would have to 
accept joint and several liability, as well as the right of all data 
subjects whose data is exported from the EU to sue for alleged 
violations. U.S. parties to the Model Contracts would have to provide 
all EU data subjects the right to access and correct all of their 
personal data, and the right to stop its use for any purpose beyond the 
original consent.
    The Model Contracts have come in ``under the radar'' while 
attention was focused on the Safe Harbor, negotiated last year between 
the U.S. and the European Union.20 The Safe Harbor provides 
U.S. firms who sign up to it a finding of ``adequacy'' under the 
Directive, thus protecting them from possible disruptions in data flows 
by EU Member States. But to date, only a handful of U.S. firms have 
signed up to the Safe Harbor. As such, the EU's drive to create the 
Model Contracts and its apparent move to require them for transactions 
not covered by the Safe Harbor appears to be an attempt to fill the 
wide gap left by the narrow impact of the Safe Harbor.
---------------------------------------------------------------------------
    \20\ See Alston & Bird LLP Electronic Commerce and International 
Regulatory Advisory, ``The EU Safe Harbor--Should Your Company Sign on 
Now?,'' dated October 30, 2000 and located at: http://www.alston.com/
docs/Advisories/199709/The__EU__Safe__Harbor.pdf.
---------------------------------------------------------------------------
    The EU has advised that it intends to move forward with the 
adoption of the Model Contracts sending them to the European Parliament 
for consideration, over the course of the spring. The Commission has 
advised that the Model Contracts could enter into force as early as 
July 1, 2001, the end of the current standstill for enforcement of the 
Directive against U.S. firms. In practice, this deadline, like any 
political timetable, remains subject to change. Significantly, July 1, 
2001 is also the deadline for compliance by U.S. financial institutions 
with the privacy provisions of the Gramm-Leach-Bliley Act.

               U.S. ADMINISTRATION CONSIDERING RESPONSE.

    The Bush Administration is currently in the process of considering 
responses to EU queries regarding the Model Contracts. Newly arrived 
policymakers at the Departments of Commerce and Treasury are now 
considering whether to act to slow the EU's adoption of the Model 
Contracts, given their potential impact on substantial sectors of the 
U.S. economy and on trans-Atlantic data flows.
    If the Model Contracts are adopted, and the U.S. government does 
not object, U.S. firms who control personal data that comes from the 
EU, and are not part of the Safe Harbor, will, in essence, be forced to 
rapidly adopt new information management practices required by EU 
regulations. Such companies may wish to examine their current 
information management practices against the emerging laws, 
regulations, codes, and guidelines in the EU, to determine the 
feasibility and costs of compliance.
    For now, U.S. companies concerned about the potential impact of the 
Model Contracts may wish to express their views to the key players in 
the Bush Administration, which, in addition to the Departments of 
Commerce and Treasury, include the Office of the Trade Representative, 
the National Economic Council, and the U.S. Department of State.

                  AN OVERVIEW OF THE MODEL CONTRACTS.

What Are the Model Contracts?
    Under the Directive, the EU has the right to develop Model 
Contracts that can be used as mechanisms to ensure that EU Data 
Exporters (Data Exporters) have secured adequate assurances from non-EU 
Data Importers (Data Importers). The Directive does not, however, 
specify what elements need to be in the Model Contracts. The EU first 
promulgated possible text of the Model Contracts on September 29, 2000, 
providing a two-week window for comment. In mid-January, EU 
representatives advised the U.S. Department of Commerce of the EU's 
likely adoption of the Model Contracts in February or March. At the 
same time, the EU group given the responsibility of developing the 
Model Contracts by the Directive (known as the ``Article 29'' 
Committee), suggested that all data flows from the EU to any non-EU 
entity would have to be governed by either the Model Contracts or more 
stringent measures that might be enacted by individual EU Member States 
who choose to provide even higher levels of protection.

Relationship of Model Contracts to Safe Harbor.
    In the past, the EU characterized the Model Contracts as a possible 
alternative to the Safe Harbor for U.S. firms, and the fundamental 
alternative for U.S. entities such as financial institutions and 
telecommunications firms that could not participate in the Safe Harbor. 
This position finds direct support in the language of the EU-US Safe 
Harbor agreement. Now, however, comments by EU officials in the 
``Article 29'' Committee that has endorsed the contracts, have advised 
that the Model Contracts should be viewed as a mandatory ``floor'' of 
protections for personal data being exported from the EU. As a result, 
according to the ``Article 29'' Committee, the provisions of the Model 
Contract, or other contracts providing equivalent or greater 
protections, must be agreed to by any non-EU entity from a country that 
is deemed to have inadequate privacy laws. For the U.S., the provisions 
of the Model Contracts would therefore presumably apply to all U.S. 
firms importing personal data from the EU over which they exercise 
control, other than U.S. firms that have actually entered the Safe 
Harbor.21
---------------------------------------------------------------------------
    \21\ As set forth in footnote 18, one likely near term exception 
would grandfather existing contracts already approved by EU data 
protection authorities for the export of data. Whether or not these 
contracts could be renewed with their existing provisions if they 
failed to contain such provisions as guaranteeing data subjects the 
right to sue as third party beneficiaries, and joint and several 
liability, is not certain. The Article 29 Committee's statements 
suggest that such provisions will be mandatory. However, to a 
considerable extent the Member States will remain free to determine how 
to use the Model Contracts as they apply the domestic laws in 
conformity with the requirements of the Directive.
---------------------------------------------------------------------------

Who Would Be Covered by Model Contracts?
    If the new EU position is adopted unhindered, sectoral coverage 
under the Model Contracts would be extremely broad, reaching most 
Trans-Atlantic flows of personal data. The EU would require the Model 
Contracts to be used whenever there was a transfer of personal data 
within an international or multinational group of companies, within a 
consortium of independent organizations set up to process international 
transactions, between independent entities where both companies 
exercise control over the data, between providers of professional 
services (such as lawyers, accountants, financial advisers, 
stockbrokers, and surveyors), or for direct marketing, and insolvency 
and bankruptcy sales.

Required Elements of Model Contracts.
    In the current draft of the Model Contracts, contracts entered into 
between Data Exporters and Data Importers must create an adequate level 
of protection for personal data transferred to the non-EU country. The 
contracts must be entered into for the explicit ``benefit of Data 
Subjects,'' which would create a private cause of action for anyone who 
deemed themselves injured by an infringement of their data rights. 
Under the Model Contracts, the data subjects would have the explicit 
right to enforce the terms of the contracts as third party 
beneficiaries. In this instance, the data subject would be free to 
choose dispute resolution in the forum of his or her choice, including 
mediation, the courts of the exporting Member State, a forum for 
disputes provided by the DPA in the exporting Member State, or an 
arbitration body chosen by the data subject. Although the Model 
Contracts do not explicitly address the issue of the enforcement of 
contract rights outside the EU, in theory, a U.S. person whose data is 
exported from the EU to the US in alleged violation of a provision of a 
Model Contract would also be a third party beneficiary to the contract, 
with the right to sue under the contract in the courts of their 
domicile, such as in the U.S.

Obligations of the Data Exporter.
    The draft Model Contracts would require all Data Exporters to 
warrant that: they have met the Directive's obligations in collecting 
and processing personal data; they have, before any data is 
transferred, explicitly informed data subjects that their data could be 
transferred to a third country if the importing entity entered into a 
contract containing protective clauses provided by law for this 
purpose; and they will make the protective clauses available upon the 
request of any data subject.

Obligations of the Data Importer.
    Under the proposed Model Contracts, Data Importers will essentially 
be required to meet the full obligations of EU entities in handling 
data. Indeed, in some respects, the Model Contracts go beyond the 
literal requirements of the Directive itself, and in pursuit of the 
ostensible goals of the Directive, would impose entirely new 
obligations on Data Importers. Among their most significant 
obligations, the Model Contracts would require Data Importers to:

 Agree to submit all of their data processing facilities, files 
        and documents to audit by the Data Exporter and the DPAs in the 
        EU.
 Cooperate with the DPA in any inquiries regarding data 
        processing and abide by the advice of the DPA if given.
 Process data in accordance with a body of laws approved by the 
        EU as offering adequate protection, which may include, at the 
        Data Exporter's option, the laws of the exporting EU country, a 
        set of newly-promulgated Mandatory Data Protection Principles, 
        or the laws of the country where the Data Importer is based if 
        found by the EU to offer adequate protection (but only if the 
        importer is not already subject to such laws). Any of these 
        alternatives may include more stringent requirements than the 
        Directive itself.
 Use the data only for the purposes for which the data has been 
        transferred.
 Store data only as needed to carry out the purposes for which 
        the data has been transferred.
 Not retransfer the data to an entity in a jurisdiction whose 
        laws are not deemed to offer adequate protection unless the 
        data subject has opted in to such transfer in the case of 
        sensitive data, or has been given an opt-out opportunity in all 
        other cases. Alternatively, the Data Importer may put a Model 
        Contract in place with its intended transferee.
 Allow the data subject access to all data relating to him or 
        her being processed in the U.S.
 Allow the data subject the right to correct or delete data 
        which has become inaccurate.
 Allow the data subject the right to object to the processing 
        of his or her data on compelling grounds based upon his or her 
        particular situation.
 Name a privacy officer to handle inquiries from Data Exporters 
        and the DPAs.

EU Laws Would Govern Liability for U.S. Firms.
    The Model Contract process would not permit U.S. Data Importers 
freedom of contract with Data Exporters with respect to liability 
issues. Rather, it would automatically require all Data Exporters and 
Data Importers to agree to be held jointly liable for damages to data 
subjects resulting from any unlawful processing or act incompatible 
with the national laws adopted pursuant to the Directive. The parties 
remain free to provide for mutual indemnification by contract, but the 
risk of insolvency in the Data Exporter is thus passed on to the U.S. 
Data Importer, leaving the data subject protected with the U.S. Data 
Importer's assets for breaches by either party. Although the U.S. Data 
Importer may be exempt from liability if it can prove that the Data 
Exporter is solely responsible for the violation, the burden of proof 
is shifted onto the U.S. Data Importer in such cases.

Non-EU Firm Must Agree To Abide By EU Decisions Over Privacy 
        Violations.
    To import personal data from the EU, Data Importers from countries 
deemed to have inadequate personal data protections, would be required 
to abide by the data subject's choice for a dispute resolution forum, 
in the event that the data subject is a party to the dispute. 
Permissible choices include a mediation forum, the EU court in the 
Member State where the Data Exporter is established, a body for dispute 
resolution provided by the DPA in the Member State where the Data 
Exporter is established, or an arbitration forum in a country which is 
party to the conventions on enforcement of arbitration awards. Note 
that the Data Importer must also agree in advance to abide by the 
decisions of the DPAs in the EU as if it were a party to the 
proceedings, even if it has not actually participated in them.

             COST AND FEASIBILITY OF COMPLIANCE UNCERTAIN.

    This summer, the EU plans to review the effectiveness of the 
Directive in meeting its goals. As it does, the EU will face the 
reality that compliance with the Directive is spotty. In some EU 
countries, such as Spain and the United Kingdom, DPAs have begun to 
initiate enforcement actions and require privacy violators to pay 
substantial fines. In other EU countries, including France and Germany, 
the European Commission is still taking legal action to force the 
Member State to enact required privacy laws.
    In the meantime, neither the European Commission nor any EU country 
has yet to conduct any published study that would provide guidance as 
to either how costly compliance might be, or whether complete 
compliance with the Directive is actually possible, either for larger 
firms with complex corporate structures, or for smaller and medium-
sized enterprises that have limited resources for information 
management. On the other hand, pressed by the threat of information 
cut-offs, a number of other countries, including Argentina, Australia, 
22 Canada, 23 Hong Kong, Hungary, New Zealand, 
and Switzerland have now passed data protection laws similar to those 
of the EU. The tension between the growing web of international data 
protection laws, and the very limited history of the enforcement of 
these laws, creates an uncertain and potentially difficult business, 
information management, and legal environment for many companies who 
process personal data across national borders.
---------------------------------------------------------------------------
    \22\ See Alston & Bird LLP Electronic Commerce and International 
Regulatory Advisory, ``Foreign Privacy Laws Proliferate: New Laws in 
Argentina and Australia Have Extraterritorial Application,'' dated 
December 19, 2000, and located at: http://www.alston.com/docs/
Advisories/199709/Foreign__Privacy__Laws.pdf.
    \23\ See Alston & Bird LLP Electronic Commerce and Financial 
Services Advisory, ``New Canadian Privacy Law Now in Effect; Potential 
Impact on U.S. Firms Obtaining Personal Information from Canada,'' 
dated January 23, 2001, and located at http://www.alston.com/docs/
Advisories/199709/new__canadian__privacy.pdf.
---------------------------------------------------------------------------

                             IMPLICATIONS.

    The new EU Model Contracts have the potential to go well beyond the 
Safe Harbor to impact information practices of U.S. firms. The EU's 
Article 29 Committee has suggested that it intends to encourage the 
Member State's DPAs to apply the Model Contracts to most international 
data flows involving countries that it has not deemed to have adequate 
personal data protections. Although existing contracts governing data 
protection would likely be grandfathered for the near term, over time, 
the DPAs would use the Model Contracts, or their functional 
equivalents, to ensure that EU jurisdiction, choice of law, regulation, 
and sanctions govern all data that leaves Europe to such places as the 
U.S. This approach would deprive non-EU entities of independent 
recourse in disputes, requiring them to submit to and abide by whatever 
the data subjects or DPAs decide. In short, it would subject the Data 
Importer to the full power of the European Union's national authorities 
and laws, regardless of where the Data Importer is located.

                            RECOMMENDATIONS.

    Any U.S. company that receives customer or employee personal data 
from the EU should review its existing information management systems, 
human resources practices, information collection practices, and 
information dissemination practices against the requirements of the 
Model Contracts to determine the extent to which existing systems and 
practices are in compliance. An assessment should be made of compliance 
costs for meeting the Model Contracts requirements, including the 
provisions regarding access rights for data subjects. In light of the 
fact that the EU Model Contracts have yet to be promulgated, 
potentially affected firms may wish to consider providing their views 
on the Model Contracts to relevant policymakers in both the EU and the 
United States.

    Mr. Stearns. Thank you.
    Professor Reidenberg?

                 STATEMENT OF JOEL R. REIDENBERG

    Mr. Reidenberg. Thank you very much, Mr. Chairman, members. 
I would also like to commend you for holding today's hearing to 
explore and understand the international dimensions of the 
global information marketplace.
    As background to the hearing today, I have authored--co-
authored two books related specifically to the subjects that we 
are talking about, and over the last decade have served an 
expert advisor both to the Congress at the Office of Technology 
Assessment, the Federal Trade Commission, and to the European 
Commission. I am here today, though, as a scholar on data 
protection law and policy.
    I prepared a written statement that I ask you to include in 
the record.
    Mr. Stearns. By unanimous consent, all of the written 
statements will be made part of the record.
    Mr. Reidenberg. Thank you. And would like to highlight in 
these remarks three areas from that statement.
    The first are the implications of the EU directive here in 
the United States. From the business perspective, the directive 
I think has both positive and negative trade effects. On the 
positive side, which we have not really heard about in today's 
hearing, the directive harmonizes in the EU marketplace for the 
15 member states privacy standards, and establishes their 
single market for flows of information.
    I think that is something that is very important. That is a 
benefit for American businesses. It means that they operate 
with one more or less uniform set of standards as opposed to 15 
radically different country laws.
    On the negative side, the directive will force intense 
scrutiny and limits on international data flows. This--I would 
disagree with the assessments that this is an extraterritorial 
application of European law, because I think that it is the 
European Union saying, ``If it is European origin data, we want 
to be sure that our local privacy rules are not circumvented 
overseas.''
    For U.S. citizens, the directive I think highlights that 
American citizens are becoming second-class citizens in the 
privacy world, the global level. Why? American law has simply 
not kept up with the technology. The directive is being 
followed around the world. Countries prefer the European 
approach to the United States treatment of personal 
information.
    And the consequence for that is that citizens outside the 
United States will have better legal protection for their 
privacy in the global marketplace than those citizens within 
the United States.
    The second point that I would like to highlight in my 
testimony is that the safe harbor solution to assure 
international data flows I believe is completely illusory. Safe 
harbor is not going to be a satisfactory way of rectifying the 
serious weaknesses in American law.
    The legal basis for safe harbor in the United States I 
think is very questionable. The safe harbor is predicated on 
Federal Trade Commission enforcement under Section 5 and the 
availability of legal recourse in the United States.
    And if we look at the Federal Trade Commission statutory 
authority, I do not believe that the Federal Trade Commission 
has the authority to protect foreign consumers under the unfair 
and deceptive practices jurisdiction in order to advance U.S. 
business interests. And, in fact, the Supreme Court has 
interpreted the FTC's authority rather narrowly, and Congress 
has yet to specifically authorize the FTC to protect foreign 
consumers.
    The proposed recourse I think is rather meaningless. The 
memorandum that was submitted to the European Commission and 
approved as part of the package refers, for instance, to tort 
rights that are available under American law. Well, they don't 
exist yet. We do not have cases in the United States where 
court have enforced tort rights for data privacy cases.
    The Seal Organizations that are also touted under the safe 
harbor--and when we look at the membership lists, I think we 
find it a who's who of privacy scandal-plagued companies. And I 
think that is very troubling.
    If you look at the scope of safe harbor, it is extremely 
narrow. Most of e-commerce will be outside the scope of the 
safe harbor because of the choice of law provisions that one 
finds in the directive. I think that we are going to see the 
national supervisory authorities within Europe very reluctant 
to follow safe harbor, and at the same time, as a result, 
increase the risk for non-safe harbor companies that their data 
flows will be suspended.
    The third and last area I want to focus on are a couple of 
recommendations, two in particular. The first is that I think 
the best approach for the U.S. Congress is to establish clear 
legal privacy rights in the United States. The United States is 
very rapidly becoming a rogue country when we look at the 
information marketplace and a haven for unfair treatment of 
personal information. I think that is something we have to 
rectify as a matter of good, domestic public policy.
    At the international level, I think that it will be 
particularly important for us to push toward an international 
treaty to deal with privacy. Privacy implicates core democratic 
values and markets, market issues, and I think only a treaty 
will enable us to resolve many of the conflicts that will go--
that we will see in the future. That I believe to be the best 
way to solve some of the problems we have on the horizon with 
the European Union.
    With that, I would like to conclude, and thank you very 
much for this opportunity.
    [The prepared statement of Joel R. Reidenberg follows:]

PREPARED STATEMENT OF JOEL R. REIDENBERG, PROFESSOR OF LAW AND DIRECTOR 
       OF THE GRADUATE PROGRAM, FORDHAM UNIVERSITY SCHOOL OF LAW

    Mr. Chairman and Members of the Committee, I would like to thank 
you for the invitation to testify and to commend you for convening this 
hearing on the European Union's Data Privacy Directive. My name is Joel 
Reidenberg. I am a Professor of Law and the Director of the Graduate 
Program at Fordham University School of Law. As an academic, I have 
written and lectured extensively on data privacy issues and have co-
authored two books related to today's hearing.1 I am a 
former chair of the Association of American Law School's Section on 
Defamation and Privacy and have also served as an expert advisor on 
data privacy issues for the European Commission, the U.S. Federal Trade 
Commission and, during the 103rd and 104th U.S. Congresses, the Office 
of Technology Assessment. I appear today as a scholar on data privacy 
law and policy and do not represent the views of any organization with 
which I have had affiliations.
---------------------------------------------------------------------------
    \1\ Paul Schwartz and Joel R. Reidenberg, Data Privacy Law: A Study 
of US Data Protection Law and Practice (Michie: 1996); Joel R. 
Reidenberg and Paul M. Schwartz, Online Services and Data Protection 
and Privacy: Regulatory Responses (Eur-OP: 1998). These books were 
prepared with funding from the European Commission for DG XIII and 
DGXV, respectively.
---------------------------------------------------------------------------
    My testimony will focus on four points: (1) the philosophy and 
content of the EU Data Protection Directive, (2) the implications of 
the European Directive for US privacy policy, (3) the false hope of the 
US-EU safe harbor agreement, and (4) recommendations for Congressional 
action.2
---------------------------------------------------------------------------
    \2\ Parts of this testimony are based on excerpts from three 
articles that I have published: Resolving Conflicting International 
Data Privacy Rules in Cyberspace, 52 STANFORD L. REV. 1315 (2000); A 
Movement toward Obligatory Standards for Fair Information Practices in 
the United States, in VISIONS FOR PRIVACY IN THE 21st CENTURY, Colin 
Bennet & Rebecca Grant, eds., (Univ. of Toronto Press: 1999); Restoring 
Americans' Privacy in Electronic Commerce, 14 BERKELEY TECH. L. J. 771 
(1999)
---------------------------------------------------------------------------

                  1. THE EU DATA PROTECTION DIRECTIVE

a) Background and Underlying Philosophy of European Data Protection
    While there is a consensus among democratic states that information 
privacy is a critical element of civil society, the United States has, 
in recent years, left the protection of privacy to markets rather than 
law. In contrast, Europe treats privacy as a political imperative 
anchored in fundamental human rights. European democracies approach 
information privacy from the perspective of social protection. In 
European democracies, public liberty derives from the community of 
individuals and law is the fundamental basis to pursue norms of social 
and citizen protection. This vision of governance generally regards the 
state as the necessary player to frame the social community in which 
individuals develop and information practices must serve individual 
identity. Citizen autonomy, in this view, effectively depends on a 
backdrop of legal rights. Law, thus, enshrines prophylactic protection 
through comprehensive rights and responsibilities. Indeed, citizens 
trust government more than the private sector with personal 
information.
    In this context, European democracies approach data protection as 
an element of public law. Since the 1970s, European countries have 
enacted comprehensive data privacy statutes. Under the European 
approach, cross-sectoral legislation guarantees a broad set of rights 
to assure the fair treatment of personal information and the protection 
of citizens. In general, European data protection laws define each 
citizen's basic legal right to ``information self-determination.'' This 
European premise of self-determination puts the citizen in control of 
the collection and use of personal information. The approach imposes 
responsibilities on data processors in connection with the acquisition, 
storage, use and disclosure of personal information and, at the same 
time, accords citizens the right to consent to the processing of their 
personal information and the right to access stored personal data and 
have errors corrected. Rather than accord pre-eminence to business 
interests, the European approach seeks to strike a balance and provide 
for a high level of protection for citizens.

b) Adoption of the Directive
    As data protection laws proliferated across Europe during the 
1980s, there were significant divergences among those laws and 
harmonization became an important goal for Europe.3 In 1995, 
following the Maastricht Treaty of European Union, the European Union 
adopted Directive 95/46/EC of the European Parliament and of the 
Council of 24 Oct. 1995 on the protection of individuals with regard to 
the processing of personal data and on the free movement of such data 
4 [the ``European Directive''] to harmonize the existing 
national laws within the European Union. The European Directive sought 
to assure that all Member States provided satisfactory privacy 
protection and to assure the free flow of personal information across 
Europe through the respect of basic, standardized protections.
---------------------------------------------------------------------------
    \3\ For a discussion of divergences in Member State law related 
specifically to online services, see Reidenberg & Schwartz, supra note 
1.
    \4\ 1995 O.J. (L281) 31 (Nov. 23, 1995)
---------------------------------------------------------------------------
    Under European Union law, a ``directive'' creates an obligation on 
each Member State to enact national legislation implementing standards 
that conform to those defined in the directive. The European Directive 
requires that national law protect all information about an identified 
or identifiable individual whether or not the data is publicly 
available. The European Directive requires that an individual's consent 
be obtained prior to processing personal information for purposes other 
than those contemplated by the original data collection. The European 
Directive allows Member States to further restrict the processing of 
defined ``sensitive'' data such as health information.5 The 
European Directive restricts the collection and use of personal 
information not relevant for the stated purpose of processing. The 
processing of personal information must be transparent with notice 
provided to individuals for the treatment of their personal 
information. Organizations processing personal information must provide 
the data subjects with access to their personal information and must 
correct errors. The European Directive further requires that 
organizations maintain appropriate security for the processing of 
personal information.
---------------------------------------------------------------------------
    \5\ For insightful discussions of the flaws in consent as a model 
of privacy protection, see the series of articles written by Paul 
Schwartz: Beyond Lessig's Code for Internet Privacy: Cyberspace 
Filters, Privacy Control and Fair Information Practices, 2000 Wisc. L. 
Rev. 743; Internet Privacy and the State, 33 Conn. L. Rev. 815 (2000); 
Privacy and Democracy in Cyberspace, 52 Vanderbilt L. Rev. 1609 (1999)
---------------------------------------------------------------------------
    For global information networks and electronic commerce, the 
comprehensive approach inevitably invokes some tension. Without the 
statutory authority to restrict transborder data flows, the balance of 
citizens' rights in Europe could easily be compromised by the 
circumvention of Europe for processing activities. Consequently, the 
European Directive includes two provisions to assure that personal 
information of European origin will be treated with European standards. 
A choice of law clause in the European Directive assures that the 
standards of the local state applies to activities within its 
jurisdiction and a transborder data flow provision prohibits the 
transfer of personal information to countries that do not have 
``adequate'' privacy protection.6
---------------------------------------------------------------------------
    \6\ See European Directive 95/46/EC, at Art. 4 (choice of law) and 
Art. 25 (export prohibition).
---------------------------------------------------------------------------
    In terms of enforcement, each Member State must maintain an 
independent, national supervisory authority for oversight and 
enforcement of these privacy protections.7 Significantly, 
the European Directive also mandates that Member State law require any 
person processing personal information to notify the national 
supervisory authority and the supervisory authority must keep a public 
register of data processors.8
---------------------------------------------------------------------------
    \7\ European Directive 95/46/EC, art. 28.
    \8\ Id., art. 18-19.
---------------------------------------------------------------------------

c) Implementation Issues
    The European Directive provided a transition period through October 
1998 for Member States to transpose the standards into national law. 
However, as is not uncommon in the European system, nine Member States 
failed to comply strictly with the deadline. By January 2000, the 
European Commission began proceedings before the European Court of 
Justice against France, Germany, Ireland, Luxembourg, and the 
Netherlands for their delays in transposition. Although each of these 
countries had strong, existing data protection statutes, the European 
Commission argued that not all of the standards contained in the 
European Directive were satisfactorily addressed in the national laws. 
At present, proceedings before the European Court of Justice continue 
against France, Germany, and Luxembourg.
    Notwithstanding the transposition delays, the harmonization 
achieved by the European Directive is significant, but does not remove 
all divergences and ambiguities in the European national 
laws..9 By and large, the European Directive creates a 
strong baseline of protection across Europe. But, small divergences and 
ambiguity will inevitably exist where the principles must be 
interpreted by different supervisory agencies in each of the Member 
States. These remaining divergences in standards can pose significant 
obstacles for the complex information processing arrangements typical 
in electronic commerce. For example, the European Directive requires 
that privacy rights attach to information about any ``identifiable 
person''.10 Yet, the scope of this definition is not the 
same across the Member States; what some Member States consider 
``identifiable'' others do not.11 Similarly, the disclosures 
that must be made to individuals prior to data collection may still 
vary within Europe.12 These differences can distort the 
ability and desirability of performing processing operations in various 
Member States since potentially conflicting requirements might apply to 
cross-border processing of personal information.
---------------------------------------------------------------------------
    \9\ For an analysis of these divergences, see Reidenberg & 
Schwartz, supra note 1; Peter Swire & Robert Litan, None Of Your 
Business: World Data Flows, Electronic Commerce, And The European 
Privacy Directive 188-196 (1998)
    \10\ European Directive 95/46/EC, at art. 2(a).
    \11\ See Reidenberg & Schwartz, supra note 1, at 124-126.
    \12\ Reidenberg & Schwartz, supra note 1, at 133-34.
---------------------------------------------------------------------------
    The effect of this challenge to comprehensive standards is, 
however, mitigated by consensus building options and extra-legal policy 
instruments that are available in the European system. The European 
Directive creates a ``working party'' of the Member States' national 
supervisory authorities.13 The Working Party offers a formal 
channel for data protection officials to consult each other and to 
reach consensus on critical interpretive questions.
---------------------------------------------------------------------------
    \13\ European Directive 95/46/EC, art. 29.
---------------------------------------------------------------------------
    Compliance with the national laws has also been an issue in Europe. 
The notice and registration requirements, in particular, appear to have 
a spotty reception. One study conducted for the European Commission 
questioned whether data processors were adequately notifying their 
treatment of personal information to the national supervisory 
authorities 14 and a recent study by Consumers International 
found that European web sites were not routinely informing web users of 
their use of personal information.15 Nonetheless, the 
existence of the national laws and the penalties do allow for 
enforcement actions to be taken in these cases of non-compliance.
---------------------------------------------------------------------------
    \14\ Douwe Korff (ed.), Existing case-law on compliance with data 
protection laws and principles in the Member States of the European 
Union, Annex to the Annual Report 1998 of the Working Party Established 
by Article 29 of Directive 95/46/EC (Eur. Comm: 1998).
    \15\ Consumers Intenrational, Privacy@Net: An International 
Comparative Study of Consumer Privacy on the Internet (Jan. 2001).
---------------------------------------------------------------------------

                 2. IMPLICATIONS FOR THE UNITED STATES

    The European Directive exerts significant pressure on U.S. 
information rights, practices and policies. The Directive facilitates a 
single information market place within Europe through a harmonized set 
of rules, but also forces scrutiny of US data privacy. In this context, 
the lack of legal protection for privacy in the United States threatens 
the flow of personal information from Europe to the United States. At 
the same time, the EU Directive is having an important influence on 
privacy protection around the world and leaves Americans with legal 
protections as second class citizens in the global marketplace.

a) The Harmonized European Market Place
    Despite implementation divergences, the overall harmonization 
effect of the European Directive creates a common set of rules for the 
information market place in Europe. Companies operating within the 
European Union have the benefit of common standards across the Member 
States rather than 15 diverse sets of conflicting national rules. This 
creates a large, level playing field for the treatment of personal 
information in Europe. With a high level of legal protection available 
on a cross-sectoral basis, Europeans do not face the same privacy 
obstacles for ecommerce that currently threaten the American 
experience. The culture of legal protection in Europe provides European 
companies with a competitive privacy advantage doing business in Europe 
over the many American companies that are unaccustomed to applying fair 
information practices to personal information.

b) Scrutiny of US Data Privacy and European Export Prohibitions
    The European Directive requires the national supervisory 
authorities in each of the Member States and the European Commission to 
make comparisons between European data protection principles and 
foreign standards of fair information practice.16 The 
European Directive further requires that foreign standards of fair 
information practice be ``adequate'' in order to permit transfers of 
personal information to the foreign destination.17
---------------------------------------------------------------------------
    \16\ European Directive 95/46/EC, art. 25
    \17\ Id.
---------------------------------------------------------------------------
    For the United States, this means that both national supervisory 
authorities and the European Commission must assess the level of 
protection offered in the United States to data of European origin. 
Because the United States lacks directly comparable, comprehensive data 
protection legislation, the assessment of ``adequacy'' is necessarily 
complex. The European Commission and national supervisory authorities 
recognize that the context of information processing must be considered 
to make any determination of ``adequacy.''
    Under the European Directive, the national data protection 
supervisory authorities and the European Commission must report to each 
other the non-European countries that do not provide adequate 
protection. This bifurcated assessment of foreign standards means that 
intra-European politics can play a significant role in the evaluation 
of US data practices. While a European level decision is supposed to 
apply in each Member State, the national supervisory authorities are 
independent agencies and will still have a degree of interpretive power 
over any individual case.
    The end result for the United States and for American companies is 
that US corporate information practices are under scrutiny in Europe 
and under threat of disruption when fair information processing 
standards are not applied to protect European data. Some commentators 
have predicted that any European export prohibition might spark a trade 
war that Europe could lose before the new World Trade 
Organization.18 While, in theory, such a situation is 
possible, an adverse WTO ruling is unlikely.19
---------------------------------------------------------------------------
    \18\ See Peter Swire & Robert Litan, None Of Your Business: World 
Data Flows, Electronic Commerce, And The European Privacy Directive 
188-196 (1998)
    \19\ See e.g. Gregory Shaffer, Globalization and Social Protection: 
The Impact of EU and International Rules in Ratcheting Up of U.S. 
Privacy Standards, 25 Yale J. Int'l L. 1, 50 (2000).
---------------------------------------------------------------------------

c) International Influence of the EU Directive
    Even with the difficulties of the European approach, countries 
elsewhere are looking at the European Directive as the basic model for 
information privacy, and significant legislative movements toward 
European-style data protection exist in Canada, South America, and 
Eastern Europe.20 This movement can be attributed partly to 
the pressure from Europe arising from scrutiny of the adequacy of 
foreign privacy rights, but is also due in part to the conceptual 
appeal of a comprehensive set of data protection standards. In effect, 
Europe through the European Directive has displaced the role that the 
United States held since the famous Warren and Brandeis article 
21 in setting the global privacy agenda.
---------------------------------------------------------------------------
    \20\ See, e.g., Council of Europe, Chart of Signatories and 
Ratifications /www.coe.fr/tablconv/108t.htm>(visited March 31, 
1999) (listing countries that have ratified the treaty on data 
privacy); Industry Canada, Task Force on Electronic Commerce: The 
International Evolution of Data Protection (Oct. 1, 1998) (visited on 
March 31, 1999) /ecom.ic.gc.ca/english/fastfacts/43d10.htm> 
(justifying the Canadian proposal for a comprehensive privacy law by 
reference to the European initiative); Hong Kong, Personal Data 
(Privacy) Ordinance, Chap. 486 /www.pco.org.hk/ord/
section__00.html>(Hong Kong statute following European comprehensive 
model); Hungarian Republic, The First Three Years of the Parliamentary 
Commissioner for Data Protection and Freedom of Information 68-72 
(1998)(discussing the influence of the European Directive for Hungarian 
data protection law); Pablo Palazzi, Data Protection Materials in Latin 
American Countries (Dec. 2000) (http://www.ulpiano.com/DataProtection-
LA-links.htm) (detailing the emergence of data protection legislation 
in Latin America.)
    \21\ See Samuel Warren & Louis Brandeis, The Right of Privacy, 4 
Harv. L. Rev. 193 (1890)
---------------------------------------------------------------------------

d) Second Class Privacy for US Citizens
    With the imposition by the European Directive both of harmonized 
European legal requirements for the fair treatment of personal 
information and of limitations on transborder data flows outside of 
Europe, U.S. companies recognize that they will have to respect 
European legal mandates. Unless American companies doing business in 
Europe chose to flout European law, US multinational businesses must 
provide stringent privacy protections to data of European origin when 
processing that data in Europe or in the United States.
    Concurrently, American law and practice allows those same companies 
to provide far less protection, if any, to data about American 
citizens. This is a particularly troubling aspect of US opposition to 
the European Directive's standards. American companies will either 
provide Europeans with better protection than they provide to Americans 
or they will treat Americans in accordance with the higher foreign 
standards and disadvantages those citizens doing business with local US 
companies.
    In effect, the proliferation of European style data protection 
measures around the world means increasingly that American citizens 
will be left with second class privacy in the United States and 
afforded greater privacy protection against American companies outside 
US borders.

         3. THE FALSE HOPES OF THE US-EU SAFE HARBOR AGREEMENT

    In response to the risk that Europe would block data flows to the 
United States, the Department of Commerce entered into negotiations 
with the European Commission to create a ``safe harbor'' agreement that 
would assure Europe of the adequacy of protection for data processed by 
US businesses. In the absence of statutory protection in the United 
States, the concept was that the European Commission would endorse a 
voluntary code of conduct that would meet the ``adequacy'' standard. 
American businesses could then publicly commit to adhere to this code 
for the treatment of European origin data and be assured of 
uninterrupted data flows from Europe.
    The lengthy and troubled negotiations on the code began in 1998 
between the Department of Commerce and the European Commission. Toward 
the end of the negotiations, several of the particularly difficult 
issues were the existence of a public commitment for companies adhering 
to the code, the access rights and enforcement in the United States. A 
final set of documents including an exchange of letters, the Safe 
Harbor Privacy Principles, Frequently Asked Questions setting out 
interpretative understandings of the principles, and various annexes 
and representations made to the European Commission by the Department 
of Commerce and the Federal Trade Commission (collectively the ``Safe 
Harbor'') was released in July 2000 22 and approved by the 
European Commission.23
---------------------------------------------------------------------------
    \22\ Dept. of Commerce, Int'l Trade Adm, Notice: Issuance of Safe 
Harbor Principles and Transmission to European Commission, 65 Fed. Reg. 
45665-45686 (July 24, 2000)
    \23\ Commission Decision of 26 July 2000, Eur. Comm. Doc. 00/520/
EC, O.J. L 215 (25/8/2000)
---------------------------------------------------------------------------
    While the approval was an important short-term political victory 
for both the US and the European Commission, the safe harbor agreement 
is unworkable for both sides and will not alleviate the issues of weak 
American privacy protection.

a) The Political Dimension
    For the European side, the United States posed a major problem. 
American law did not provide comparable protections to European 
standards and fair information practices in the United States were 
rather spotty. Yet, European regulators did not want to cause a 
disruption in international data flows. The prospect of change in US 
law seemed remote and the European Commission would have serious 
political difficulty insisting on an enforcement action against data 
processing in the United States prior to the full implementation of the 
European Directive within the European Union. Similarly, an aggressive 
enforcement strategy by a national supervisory authority while 
transposition remained incomplete could have hampered the national 
legislative debates on transposition. The Safe Harbor offered a 
mechanism to delay facing tough decisions about international privacy 
and, in the meantime, hopefully advance US privacy protections for 
European data.
    On the US side, the Department of Commerce faced strong pressure 
from the American business community to block the European Directive. 
The United States was not prepared to respond to the Directive with new 
privacy rights and the United States wanted to prevent interruptions in 
transborder data flows. The Safe Harbor became a mechanism to avoid a 
showdown judgment on the status of American law and defer action 
against any American companies.
    As such, the acceptance in July 2000 of the Safe Harbor by the 
European Union was a transitory political success.

b) The Dubious Legality of Safe Harbor
    In the United States, however, the Safe Harbor faces a serious 
jurisdictional obstacle to its enforcement--one of the key European 
criteria for acceptance. The Department of Commerce issued the Safe 
Harbor documents ``to foster, promote, and develop international 
commerce.'' 24 The agreement is predicated on the 
enforcement powers of the Federal Trade Commission under Section 5 of 
the Federal Trade Commission Act.25 Indeed, as part of the 
negotiations, the Federal Trade Commission represented to the European 
Commission that it ``will give priority to referrals of non-compliance 
with safe harbor principles from EU member states.'' 26 Yet, 
the underlying legal authority of the FTC to enforce the Safe Harbor is 
questionable.
---------------------------------------------------------------------------
    \24\ Letter, dated July 21, 2000, from Robert S. LaRussa, Acting 
Under Secretary for International Trade Administration, U.S. Department 
of Commerce to John Mogg, Director, DGXV, European Commission /
www.export.gov/safeharbor/USLETTERFINAL1.htm>
    \25\ 15 U.S.C. Sec. 45(a)
    \26\ Letter, dated July 14, 2000, from Robert Pitofsky, Chairman, 
Federal Trade Commission to John Mogg, Director, DGXV, European 
Commission.
---------------------------------------------------------------------------
    As originally enacted by the Federal Trade Commission Act in 1914, 
Section 5 applied only to unfair methods of competition.27 
Jurisdiction over any ``unfair or deceptive act or practice'' was 
extended to the FTC by the Wheeler-Lea Act of 1938.28 The 
stated Congressional purpose was to enable the FTC to ``restrain unfair 
and deceptive acts and practices which deceive and defraud the public 
generally.'' 29 Indeed, contrary to the purpose of the Safe 
Harbor that protects US business interests in international trade, the 
Wheeler-Lea Act amendments sought to protect the general public from 
unscrupulous business practices. In fact, at the time of the enactment, 
the FTC's jurisdiction expressly excluded foreign commerce not to 
mention the protection of foreign consumers as envisioned by Safe 
Harbor.
---------------------------------------------------------------------------
    \27\ 15 U.S.C. 45
    \28\ Ch. 49, 52 Stat. 111 (Mar. 21, 1938)
    \29\ S. 1077: Report of the Senate Committee on Interstate 
Commerce, S. Rep. No. 221, 75th Cong., 1st Sess. (March 19, 1937).
---------------------------------------------------------------------------
    While the McGuire Resale Price Maintenance Act of 1952 
30 expanded FTC jurisdiction into foreign commerce with 
respect to monopolistic pricing, the U.S. Supreme Court had 
specifically held that only Congressional amendments could expand the 
scope of the FTC's authority under Section 5.31 In Bunte 
Bros. v. FTC, the Commission unsuccessfully sought an expansion of its 
interstate commerce authority in the context of anti-trust 
enforcement.32 Congress eventually responded with the 
Magnuson-Moss Warranty--Federal Trade Commission Improvement Act of 
1975 33 that was, according to the Senate Conference Report, 
designed ``to improve [the FTC's] consumer protection activities.'' 
34 The 1975 amendments extended the jurisdiction to acts and 
practices ``in or affecting commerce,'' but at no time contemplated 
protecting American business interests or foreign consumers.
---------------------------------------------------------------------------
    \30\ Ch. 745, 66 Stat. 632 (July 14, 1952)
    \31\ Bunte Bros. v. F.T.C., 312 U.S. 349 (1941).
    \32\ Id.
    \33\ Pub. L. 93-637, 88 Stat. 2193, Sec. 201, 15 U.S.C. Sec. 45 
(1970 ed., Supp. IV)
    \34\ Magnuson-Moss-Warranty-Federal Trade Commission Improvement 
Act, Pub. L. No. 93-637, Senate Conf. Report No. 93-1408 (Dec. 18, 
1974)
---------------------------------------------------------------------------
    Hence, the assertion by the Department of Commerce and the FTC that 
the Safe Harbor comes within the Section 5 jurisdiction is a radical 
departure from the stated legislative purposes of the statute and in 
direct opposition to the Supreme Court's restrictive interpretation of 
Section 5 authority.
    Within Europe, the legality of Safe Harbor is also open to 
question. Under the European Directive, ``adequacy'' must be assesed in 
light of the prevailing ``rules of law, both general and sectoral, in 
force in the third country in question and the professional rules and 
security measures which are complied with in that country.'' 
35 However, the Safe Harbor was not yet in existence at the 
time of the approval by the European Commission. The European 
Parliament specifically noted this problem shortly before the approval 
by the European Commission.36 Similarly, according to the 
European Directive, the European Commission only has authority to enter 
into negotiations to remedy the absence of ``adequate'' protection 
after a formal finding that the non-European country fails to provide 
``adequate'' protection.37 Yet, in the context of the Safe 
Harbor negotiations, the European Commission never made a formal 
finding.38 These would appear to be significant 
administrative law defects. Although the European Commission maintains 
that the European Parliament did not say that the Commission acted 
outside its powers and the Member States voted unanimously in the 
political committee to accept the Safe Harbor, 39 this 
administrative process problem remains an open question that only the 
European Court of Justice can resolve and gives the independent 
national supervisory authorities grounds to vitiate Safe Harbor through 
strict interpretations of the European Commission's ruling.
---------------------------------------------------------------------------
    \35\ European Directive 95/46/EC, art. 25(2)
    \36\ European Parliament Resolution A5-0177/2000 on the Draft 
Commission Decision on the adequacy of the protection provided by the 
Safe Harbour Privacy Principles and related Frequently Asked Questions 
issued by the US Department of Commerce (C5-0280/2000-2000/2144(COS)) 
(July 5, 2000)
    \37\ European Directive 95/46/EC, art. 25(5).
    \38\ The procedure for a formal finding is established in European 
Directive 95/46/EC, art. 25(4).
    \39\ See Eur. Comm. Press Release: Frits Bolkestein tells 
Parliament Committee he intends to formally approve ``safe harbor'' 
arrangement with US on data protection, July 13, 2000 /
europa.eu.int/comm/internal__market/en/media/dataprot/news/harbor5.htm>
---------------------------------------------------------------------------
    In addition, the European Parliament pointed out:
        ``the risk that the exchange of letters between the Commission 
        and the US Department of Commerce on the implementation of the 
        'safe harbour' principles could be interpreted by the European 
        and/or United States judicial authorities as having the 
        substance of an international agreement adopted in breach of 
        Article 300 of the Treaty establishing the European Community 
        and the requirement to seek Parliament's assent (Judgment of 
        the Court of Justice of 9 August 1994: French Republic v. the 
        Commission--Agreement between the Commission and the United 
        States regarding the application of their competition laws 
        (Case C-327/91))'' 40
---------------------------------------------------------------------------
    \40\ European Parliament Resolution A5-0177/2000 on the Draft 
Commission Decision on the adequacy of the protection provided by the 
Safe Harbour Privacy Principles and related Frequently Asked Questions 
issued by the US Department of Commerce (C5-0280/2000-2000/2144(COS)) 
(July 5, 2000), Sec. E(2).
---------------------------------------------------------------------------

b) The Limited Applicability
    Notwithstanding the validity in either legal system, the scope of 
the Safe Harbor is very narrow. First, Safe Harbor by its terms can 
only apply to activities and U.S. organizations that fall within the 
regulatory jurisdiction of the FTC and the Department of 
Transportation. As a result, many companies and sectors will be 
ineligible for Safe Harbor including particularly the banking, 
telecommunications and employment sectors that are expressly excluded 
from the FTC's jurisdiction.41 Second, the Safe Harbor will 
not apply to most organizations collecting data directly in Europe. 
Article 4 of the European Directive provides that if a data controller 
is located outside of the European Union, but uses equipment within the 
European Union, the law of the place where the equipment is located 
will be applicable. This provision establishes a choice of law rule 
that greatly reduces the availability of the Safe Harbor to 
international business. This provision of the Directive is especially 
significant in the context of web based businesses where interactive 
computing means that a European user will always make use of computing 
resources at the user's location. The courts of Member States, such as 
France, have shown in other areas a clear willingness to apply the 
substantive law of the place where an Internet user is 
located.42 Hence, in many cases, particularly in the context 
of ecommerce, the substantive law of a Member State will apply rather 
than the Safe Harbor.
---------------------------------------------------------------------------
    \41\ 15 U.S.C. Sec. 45(a)(2)
    \42\ See e.g. UEJF c. Yahoo!, TGI de Paris, Ord. en refere du 22 
nov. 2000.
---------------------------------------------------------------------------
c) Increased Risk to Non-Safe Harbor Transfers
    By implication, the Safe Harbor raises the risks for data transfers 
by companies that do not subscribe to the code. The approval by the 
European Commission of Safe Harbor as an ``adequate'' basis to transfer 
personal information to the United States implicitly acknowledges that 
transfers outside the scope of the Safe Harbor will not be adequately 
protected. Consequently, non-Safe Harbor transfers must be covered by 
one of the other exceptions to the transborder data flow rules, such as 
a transfer pursuant to a contractual arrangement.43
---------------------------------------------------------------------------
    \43\ European Directive 95/46/EC, art. 26.
---------------------------------------------------------------------------
    Ironically, Safe Harbor simplifies the task for national 
supervisory authorities to block data flows to the United States. The 
national agencies will readily be able to identify those US companies 
that do not subscribe to Safe Harbor and have not presented a data 
protection contract for approval under the European Directive's Article 
26 exceptions. In such cases, the presumption must be that the 
protection is ``inadequate'' and the data flow must, under European 
law, be prohibited.
    For the United States, the Safe Harbor approach might, thus, 
compromise many US businesses in a way that a legislative solution 
would not.
d) Weakening of European Standards and Illusory Enforcement Mechanisms
    For the national supervisory authorities in Europe, the Safe Harbor 
poses a weakening of European standards.44 In particular, 
the permissible derogations from Safe Harbor without a loss of coverage 
are significant. The Safe Harbor exempts public record information 
despite its ordinary protection under European law. Similarly, the Safe 
Harbor exempts any processing pursuant to any ``conflicting 
obligation'' or ``explicit authorization'' in US law whether or not 
such processing would be permissible under European standards. The 
access standard set out in the Safe Harbor and FAQs also includes 
derogations that do not exist in European law.
---------------------------------------------------------------------------
    \44\ See Working Party: Opinion 4/2000 on the level of protection 
provided by the ``Safe Harbor Principles'', Opinion 4/2000, Eur. Comm. 
Doc. DG MARKT CA07/434/00 WP 32 (16 May 2000)
---------------------------------------------------------------------------
    Most importantly, however, the Safe Harbor weakens European 
standards for redress of data privacy violations. Under the European 
Directive, victims must be able to seek legal recourse and have a 
damage remedy.45 The Department of Commerce assured the 
European Commission that Safe Harbor and the US legal system provided 
remedies for individual European victims of Safe Harbor violations. The 
European Commission expressly relied on representations made by the 
Department of Commerce concerning available damages in American 
law.46 The memorandum presented by the Department of 
Commerce to the European Commission, however, made misleading 
statements of US law.47 For example, the memorandum provides 
a lengthy discussion of the privacy torts and indicates that the torts 
would be available. The memorandum failed to note that the 
applicability of these tort actions to data processing and information 
privacy has never been established by US courts and is, at present, 
purely theoretical. Indeed, the memorandum cites the tort for 
misappropriation of a name or likeness as a viable damage remedy, yet 
all three of the state courts that have addressed this tort in the 
context of data privacy have rejected it.48 The Safe Harbor 
is also predicated on dispute resolution through seal organizations 
such as Truste. Yet, only one seal organization, the Entertainment 
Software Rating Board, proposes any direct remedy to the victim of a 
breach of a privacy policy and other organizations' membership lists 
look like a ``Who's Who'' of privacy scandal plagued companies.
---------------------------------------------------------------------------
    \45\ European Directive 95/46/EC, art. 22-23
    \46\ Commission Decision of 26 July 2000, Eur. Comm. Doc. 00/520/
EC, O.J. L 215 (25/8/2000), Art. 1(b)
    \47\ U.S. Dept. of Commerce, Damages for Breaches of Privacy, Legal 
Authorizations and Mergers and Takeovers in U.S. Law (July 14, 2000)
    \48\ See Shibley v. Time 45 Ohio App. 2d 69 (1975); Dwyer v. 
American Express 273 Ill. App. 3d 742 (1995); Avrahami v. U.S. News & 
World Report, 1996 Va. Cir. LEXIS 518 (1996).
---------------------------------------------------------------------------
    Lastly, the enforcement provisions of the Safe Harbor rely on the 
FTC. Even if the FTC has jurisdiction to enforce the Safe Harbor, the 
assertion that the FTC will give priority to European enforcement 
actions is hard to believe. First, although the FTC has become active 
in privacy issues recently, the agency's record enforcing the Fair 
Credit Reporting Act, one of the country's most important fair 
information practices statutes, is less than aggressive. Second, were 
the FTC to devote its limited resources to the protection of Europeans' 
privacy, Americans should and will be offended that a US government 
agency charged with protecting American consumers has chosen to commit 
its energies and US taxpayer money to the protection of European 
privacy in the United States against US businesses at a higher level 
than the FTC asserts for the protection of Americans' privacy.
    Sadly, though, for many American companies, even these weakened 
European standards impose substantially greater obligations than US 
law. In particular, the notice, choice, access and correction 
requirements are only sporadically found in US law. As a result, 
pitifully few American companies have subscribed to Safe Harbor; 
indeed, as of March 7, 2000 fewer than 30 companies have signed 
up.49
---------------------------------------------------------------------------
    \49\ U.S. Dept. of Commerce, Safe Harbor List, http://
web.ita.doc.gov/safeharbor/shlist.nsf/webPages/safe+harbor+list 
(reflecting only 27 certifications)
---------------------------------------------------------------------------
    The upshot of these sui generis standards, unenthusiastic reception 
and enforcement weaknesses is a likelihood that the national 
supervisory agencies will be dissatisfied with the Safe Harbor and that 
the Member States will face great political pressure to suspend the 
Safe Harbor once transposition is completed.

                           4. RECOMMENDATIONS

    The United States is rapidly on the path to becoming the world's 
leading privacy rogue nation. Just a cursory examination of the data 
scandals over the last year and consumer privacy concerns for ecommerce 
suggest that our national policy of self-regulation will not work to 
assure public confidence and trust in the treatment of personal 
information, cannot work to guarantee citizens their political right to 
freedom of association and privacy, and will leave American businesses 
at a competitive disadvantage in the global information market place. 
At a time when Internet growth rates are greater outside the United 
States and non-US web content is becoming an absolute majority of 
available Internet content, United States interests are ill-served by 
avoiding the creation of clear legal privacy rights.
    Congress needs to act to establish a basic set of legal protections 
for privacy in the United States. Any such regulation must recognize 
that technologies will be essential to assure privacy protections in 
the global environment across divergent sets of rules. In fact, 
technical decisions are not policy neutral. Technical decisions make 
privacy rules and, more often than not, these rules in the United 
States are privacy invasive. For technology to provide effective 
privacy protection, three conditions must be met: (a) technology 
respecting fair information practices must exist; (b) these 
technologies must be deployed; and (c) the implementation of these 
technologies must have a privacy protecting default configuration. 
Legal rights in the United States should provide an incentive structure 
that encourages these developments.
    In conjunction with the establishment of a legal baseline in the 
United States, Congress should promote the negotiation of a ``General 
Agreement on Information Privacy'' within the World Trade Organization 
framework.50 Whether desired or not by various interest 
groups and countries, the WTO will be unable to avoid confronting 
international privacy issues as a result of the biennial ministerial 
conferences and the inevitable trade-in-services agenda. Many of the 
core differences among nations on the implementation of privacy 
principles touch upon fundamental governance and sovereignty questions. 
These types of problems will only be resolved at an international 
treaty level like the WTO.
---------------------------------------------------------------------------
    \50\ See Joel R. Reidenberg, Resolving Conflicting International 
Privacy Rules in Cyberspace, 52 Stanford L. Rev. 1315, 1359-1362 (2000)

    Mr. Stearns. Thank you.
    Ms. Lawler, your opening statement, please? Thank you.

                   STATEMENT OF BARBARA LAWLER

    Ms. Lawler. Yes. Thank you, and thank you for having me 
here today. Mr. Chairman, members of the subcommittee, thank 
you for the invitation to appear today to discuss the EU Data 
Protection Directive.
    My name is Barbara Lawler, and as Customer Privacy Manager 
for Hewlett Packard I have global responsibility for HP privacy 
policy management, implementation, compliance, education, and 
communication, in both the online and offline worlds.
    As you, Mr. Chairman, stated in calling for this hearing, 
the European privacy directive has implications for how we in 
the United States conduct and address our domestic privacy 
issues. I am pleased, therefore, to have this opportunity to 
talk about HP's participation in the safe harbor agreement, 
which provides legal protection and a framework for allowing 
the safe transfer of personal information from the EU countries 
to the U.S.
    I am pleased to say that HP is the first major technology 
company to join the safe harbor. But, first, let me start by 
giving you an overall picture of how we manage privacy at 
Hewlett Packard.
    HP applies a universal, global privacy policy built on the 
fair information practices. Notice, choice, accuracy and 
access, security and oversight. Whether in English, French, or 
Spanish, the core commitments are the same with very minimal 
localization required to reflect local country laws.
    Key elements of our policy include no selling of customer 
data, no sharing of data outside HP without permission, 
customer access to core contact data, and a customer feedback 
mechanism. The policy can be viewed in online form in the lower 
left-hand corner of every HP.com web page.
    The guiding principles that we operate under for managing 
privacy are customers control their personal information. We 
give choices that enhance trust, and, therefore, enhance our 
business. We put the customer in the lead to determine their 
relationship with HP and to have the highest integrity and 
practices, responses, and partners.
    A sample of some of our current global efforts in privacy 
management include moving to opt-in for marketing content, 
especially e-mail, company-wide training on new privacy 
standards, new application development and business rules for 
company-wide multiple customer data base consolidation, and 
platform for privacy preferences implementation for our most 
active websites.
    I want to underscore some important distinctions around the 
opt-in discussion and hopefully add some clarity. As I 
mentioned, it is HP policy never to sell or lease our customer 
data. We have many business relationships with other companies, 
companies that act as suppliers and service providers. Those 
companies are required under contract and through non-
disclosure agreements to abide by our privacy policy.
    A different class of business relationships are our 
strategic partners and co-marketing partnerships. As stated 
earlier, it has always been HP policy that there is no sharing 
of customer data outside HP without permission from the 
customer. This is an opt-in policy for data-sharing with third 
parties.
    Applying the opt-in standard for marketing contact with HP 
is another order of magnitude more difficult, and let me tell 
you why. We are committed, because this is absolutely the right 
thing to do for our customers. What it requires us to do is to 
evaluate all customer data bases, our customer privacy data 
choice elements, the data itself, reengineer those data 
structures, the systems, and all of the associated business 
processes, change the format of the privacy question we ask our 
customers, and then develop implementation guides and tools and 
communicate that new standard HP-wide.
    Some of the challenges we are facing is managing 
conflicting customer choices and a large volume of unknown 
privacy data choice.
    We do conduct a substantial amount of cross-border 
commercial and consumer business activity between the U.S. and 
EU, which require direct communications between EU country-
based HP offices, independent suppliers and customers, and 
involves the movement of personal information on a regular 
basis.
    In order to have HP's European offices come into compliance 
with the EU privacy directive, a multi-country assessment of 
data collection use, storage, and movement was conducted out of 
which we identified compliance matches and gaps. Some of our 
current HP specific efforts in Europe include consolidating our 
customer e-mail response process and customizing privacy 
implementation guides for marketing by country.
    On January 29 of this year, HP became the first high-tech 
company to certify under the safe harbor. This demonstrates our 
continued leadership to strong privacy practices in the U.S., 
and we believe it is important because it offers consistency 
and continuity for business operations connected between HP 
sites located in the U.S. and the EU--critical for a global 
enterprise.
    We believe that consumer confidence will be enhanced by 
ensuring privacy rights on and offline in a global commerce 
environment through the safe harbor. E-commerce will grow 
faster if consumer confidence is reinformed by company efforts 
to ensure consumers have an effective recourse for privacy 
complaints through agreements like safe harbor.
    Our privacy policy has always been consistent with the safe 
harbor principles, and we found it consistent with our long-
term membership with the BBB Online Privacy Seal Program. We 
view safe harbor compliance as really the ultimate self-
regulatory approach and the next logical commitment in our step 
to privacy.
    And, finally, let me put this into perspective with the 
larger transborder privacy issue and consumer confidence in the 
global marketplace, because we know consumers not only are 
concerned about their privacy but they are also concerned about 
whether their credit cards are safe online, and if they order a 
blue vase from a website in Paris that they will get what they 
ordered.
    HP is working with 70 businesses from around the world 
through the global business dialog for electronic commerce to 
develop worldwide consensus on standards for consumer redress 
systems and ADR. Current concerns about consumer confidence 
must not be allowed to turn into barriers for empowering 
consumers----
    Mr. Stearns. Ms. Lawler, we need you just to sum up, if you 
would.
    Ms. Lawler. I am. HP believes that the safe harbor 
agreement is a significant step in the right direction, and we 
welcome the opportunity to work with this subcommittee in the 
development of national policies governing the collection and 
use of personal information.
    [The prepared statement of Barbara Lawler follows:]

   PREPARED STATEMENT OF BARBARA LAWLER, MANAGER, CUSTOMER PRIVACY, 
                        HEWLETT-PACKARD COMPANY

    Mr. Chairman, Members of the Subcommittee thank you for the 
invitation to appear today to discuss the EU Data Protection Directive.
    My name is Barbara Lawler, and as HP Customer Privacy Manager, I 
have global responsibility for Hewlett Packard privacy policy 
management, implementation, compliance, education and communication, in 
both the online and offline worlds.
    By way of background, HP is a leading provider of computing and 
imaging solutions and services. As a company we are focused on making 
technology and its benefits accessible to individuals and businesses 
through networked appliances, beneficial e-services and an ``always 
on'' Internet infrastructure. HP has 88,500 employees worldwide and a 
total revenue of $48.8 billion in its 2000 fiscal year.
    As you Mr. Chairman, stated in calling this hearing, the European 
Privacy Directive has implications for how we in the United States will 
address our domestic privacy issues. I am pleased therefore, to have 
this opportunity to discuss Hewlett-Packard's participation in the 
``safe harbor'' agreement . The safe harbor provides legal protection 
and a framework allowing for the safe transfer of personal information 
from European Union countries to the United States. I am pleased to say 
that HP is the first major technology company to join the safe harbor.
    As a high-tech company that sells to the consumer market, we take 
the privacy issue very seriously. HP believes that self-regulation and 
credible third-party enforcement ``such as the Better Business Bureau 
privacy seal program--is the single most important step that businesses 
can take to ensure that consumers'' privacy will be respected and 
protected online. We also believe that there should be a ``floor'' of 
uniform consumer protections which all companies must adhere to; based 
upon clear and conspicuous disclosure of privacy policies. HP testified 
last Congress in favor of the McCain/Kerry privacy bill (S. 2928) which 
we think meets the test of reasonable, practicable privacy protections. 
And, as I will discuss further, with our own websites, we are moving as 
quickly as we can, wherever possible, to an ``opt-in'' environment.

Managing Privacy at Hewlett Packard
    Let me start by giving you an overall picture of how we manage 
privacy at Hewlett Packard. HP applies a universal, global privacy 
policy built on the fair information practices: notice, choice, 
accuracy & access, security and oversight. Whether in English, French 
or Spanish, the core commitments are the same, with minimal 
localization required to reflect local country laws. Key elements of 
the policy include no selling of customer data, no sharing of customer 
data outside HP without permission, customer access to core contact 
data and a customer feedback mechanism.
    The policy can be viewed in online form at the lower left-hand 
corner of every hp.com web page: http://www.welcome.hp.com/country/us/
eng/privacy.htm
    The guiding principles for managing privacy in HP are:

 customers control their own personal data
 give choices that enhance trust and therefore enhance the 
        business
 put the customer in the lead to determine their relationship 
        with HP
 have the highest integrity in practices, responses and 
        partners
    HP people apply the privacy policy to marketing, support, e-
services and product generation using a set of HP-developed tools 
called the ``Privacy Rulebook'' and the ``Web Site Data and Privacy 
Practices Self-Assessment Tool''.
    A sample of current HP global privacy initiatives include:

 moving to opt-in for marketing contact, especially e-mail
 company-wide training on new privacy standards
 new application development and business rules for company-
        wide multiple customer database consolidation
 Platform for Privacy Preferences (P3P) implementation for our 
        most active web sites
    I want to underscore some important distinctions around the ``opt-
in'' discussion and add some clarity. It's HP policy to never sell or 
lease our customer data. HP has many business relationships with other 
companies. Companies that act as service providers or suppliers are 
required under contract and through a Confidential Non-Disclosure 
Agreement to abide by HP's privacy policy.
    A different class of business relationships is HP's strategic 
partnerships and co-marketing partners. As stated earlier, it's always 
been HP policy that there is no sharing of customer data outside HP 
without permission from the customer. This is an opt-in policy for data 
sharing with third parties.
    Applying the opt-in standard for marketing contact within HP is an 
order of magnitude more difficult, but we're committed because it's the 
right thing to do for our customers. Implementing opt-in for marketing 
contact requires us to evaluate all customer databases and customer 
privacy choice data elements, re-engineer the data structures, systems 
and associated processes, change the privacy question format itself, 
develop implementation guides and tools, and communicate the new 
standard hp-wide. Some of the challenges we face are in the areas of 
managing a program-specific customer privacy choice with a ``top-down'' 
HP request and resolving a large volume of ``unknown'' privacy choice 
data.
Managing the EU directive in an intra-European environment
    In addition to the core universal HP privacy practices already 
described, HP has developed specific standards, practices and tools to 
operate within the framework of the European Data Protection Directive 
in our European country organizations. These were developed out of a 
cross-functional HP task force with representatives from Customer 
Information, Human Resources, Privacy Management, Legal, Risk 
Management, Information Technology and Workers Council delegates.
    HP conducts a substantial amount of cross-border commercial and 
consumer business activity between the US and EU countries. This 
requires direct communications with EU country-based HP offices, 
independent suppliers and customers, and involves the receipt and 
sharing of personal information from them on a regular basis. In order 
to have HP's European offices to come into compliance with the EU 
privacy directive, a multi-country assessment of data collection, use, 
storage, and movement was conducted, out of which were identified 
compliance matches and gaps. Industry benchmarking was conducted 
concurrently. From there specific action plans were developed and the 
following deliverables completed:

 IT/Application Data Privacy Sensitivity and Development 
        Checklist
 Confidential Non-disclosure agreement for contracts with 
        suppliers
 Personal Data(base) Access Standards for employees
 Data Protection Clause--Individual Undertaking Agreement for 
        employees
 Data Protection Officer for HP Germany
 Data Protection Officer--HP European Region (in process)
 Customer Privacy Manager--HP European Region (in process)
 Establishment of European Region Privacy Council (pending)
    Current HP European-specific efforts include consolidating the 
customer email response process for privacy questions and customized 
privacy implementation guides for marketing programs by country.
Managing the EU directive requirements in the US (Safe Harbor)
    On January 29th, 2001, HP became the first high-tech company to 
certify with the U.S. Department of Commerce for Safe Harbor. This 
demonstrates our continued leadership to strong privacy practices in 
the U.S. The Safe Harbor framework offers consistency and continuity 
for business operations conducted between HP sites located in the 
United States and the European Union, critical for a global enterprise. 
HP has certified data collected by online, offline and manually 
processed methods. HP conducts a substantial amount of cross-border 
commercial and consumer business activity with direct involvement of EU 
country-based HP offices and independent suppliers.
    We believe that consumer confidence will be enhanced by ensuring 
customer privacy rights on- and off-line in a global commerce 
environment. E-commerce will grow faster if consumer confidence is 
reinforced by company efforts to ensure consumers have an effective 
recourse for privacy complaints through agreements like the Safe 
Harbor.
    The practices described in the HP privacy policy have long been 
consistent with the Safe Harbor principles. As a member of the Safe 
Harbor compliant BBBOnLine Privacy Seal program for the last 16 months, 
we were pleased to see close alignment between our existing privacy 
policy and the Safe Harbor Principles. The verification requirements 
mapped well to existing internal HP privacy standards and practices.
    HP views Safe Harbor compliance as a self-regulatory bridge to 
different approaches to data privacy between the United States and 
European Union; it's the ultimate ``self-regulatory'' approach. Joining 
the Safe Harbor is the next logical step in our commitment to privacy 
protection.
    Finally, I would like to put the trans-border privacy issue into 
the larger perspective of consumer confidence in the global electronic 
marketplace. While consumers are concerned about their privacy online, 
they are also concerned about whether their credit cards are safe 
online, and whether if they order a blue vase from a website in Paris 
or Tokyo, they will get what they order in the quality and condition 
they expected. In order for online businesses to truly earn the trust 
of consumers, we need to expand ongoing efforts to ensure that the 
global electronic marketplace a clean, well-lighted venue for both 
consumers and businesses. For example, consumers need to have 
confidence that when they do business across national borders, that 
there will be a redress system in place should anything go wrong with 
the transaction.
    HP is working with 70+ businesses from around the world through the 
Global Business Dialogue for electronic commerce to develop worldwide 
consensus standards on consumer redress systems, of ADR. In this 
effort, we are working with consumer groups and the FTC and the 
European Commission to ensure that consumers and businesses will 
quickly, fairly and efficiently resolve complaints related to online 
transactions.
    Current concerns about consumer confidence must not be allowed to 
turn into barriers to empowering consumers through global e-commerce. 
Hewlett-Packard believes that the safe harbor agreement is a 
significant step in the right direction, and we welcome the opportunity 
to work with this subcommittee in the development of national policies 
governing the collection and use of personal information.

    Mr. Stearns. Thank you.
    Mr. Henry, your opening statement?

                   STATEMENT OF DENIS E. HENRY

    Mr. Henry. Thank you, Mr. Chairman, for this invitation.
    As you mentioned, I am with Bell Canada, so let me begin by 
telling you who we are. Bell Canada and its affiliates have a 
wide variety of consumer-facing business activities, and as a 
result we have been keenly interested in the privacy issue for 
many years.
    We are the largest telecommunications carrier and internet 
service provider in Canada, and in keeping with the convergence 
trend we also have a number of investments on the content side 
of the business, including an internet portal, broadcast 
television, direct-to-home satellite----
    Mr. Stearns. Mr. Henry, we would ask you just to move your 
microphone just a shade up there.
    Mr. Henry. Certainly.
    Mr. Stearns. That is good.
    Mr. Henry. Direct-to-home satellite, and, most recently, a 
national newspaper we have added to the portfolio.
    Now, let me turn now to Canada's approach to privacy and 
our response to it. With the advent of new technologies, a 
number of options to address the concern about protecting 
personal information have been debated in various circles 
around the world. And I would characterize the Canadian 
approach as lying somewhere in the middle of the spectrum of 
options.
    It is not a detailed and prescriptive regulatory regime. On 
the other hand, it is not an approach that relies primarily on 
market forces.
    Back in 1996, in response to rising concerns about privacy, 
the Canadian Standards Association released its model code for 
the protection of personal information, which we call the CSA 
Code, as a voluntary national standard. The CSA Code was based 
on the OECD privacy guidelines and was the product of a 
consensus-building process involving government, consumers, and 
key industry sectors.
    However, following development of the CSA Code, consumer 
concerns about privacy persisted. Faced with this environment, 
the government of Canada undertook broad public consultations 
to explore the possibility of a legislative approach. These 
discussions revealed broad support for a self-regulatory 
approach but assisted by framework legislation that would 
encourage industry groups to develop sectoral codes based on 
the CSA Code.
    And this ultimately led the Canadian government to enact 
Federal privacy legislation last year, which is to come into 
effect or came into effect January 1st of this year. Its 
objective has been to establish harmonized national rules 
across the country based on a light-handed and flexible 
legislative framework.
    The Act is also intended to meet the adequate data 
protection requirements of the EU Data Protection Directive.
    This new piece of Federal privacy legislation requires all 
organizations that collect, use, or disclose personal 
information to comply with the CSA Code which is appended to 
the Act, and the Act reflects a flexible approach that does not 
prescribe particular treatment of personal information, but, 
rather, organizations can develop codes and practices tailored 
to their particular business circumstances.
    The legislation also requires commercial organizations to 
identify the purposes for which personal information will be 
collected, used, and disclosed, and to obtain consent of 
individuals. Consent can be either express or implied, 
depending on the circumstances and depending on the sensitivity 
of the information, and, again, reflecting a flexible approach.
    The Act also establishes a Federal privacy commissioner as 
its prime overseer. This commissioner has broad powers to 
receive and investigate complaints and to conduct audits of 
company practices. Unresolved disputes can be taken before the 
Federal court of Canada for a hearing and enforcement, 
including the possibility of damages.
    Recently, the Bell companies released the Bell Code of Fair 
Information Practices, in compliance with the CSA Code and the 
new legislation. And in order to implement this code, the 
companies have embarked on a plan that incorporates a number of 
elements.
    First of all, procedures were put in place to ensure that 
customers and employees are able to review and correct company 
records that contain their personal information. Customer are 
also able to challenge the company's compliance with the code 
through the Bell privacy ombudsman.
    Second, companies have implemented a communications plan to 
inform customers of the privacy policies using, for example, a 
number of means, telephone directories, web pages, bill 
inserts, point of sale brochures, and so on. The companies are 
also undertaking an extensive training program to ensure that 
employees understand and uphold our privacy commitments.
    The companies have also undertaken a comprehensive review 
of their information systems to ensure that the provisions of 
the code will be respected. And, finally, regular internal 
audits will be employed to ensure ongoing compliance.
    The Bell companies and many other industry sectors in 
Canada have supported the Canadian government's steps in 
pursuing a new model for the protection of personal 
information, a model that builds on the voluntary efforts of 
consumer groups, industry, and governments.
    We recognize that protecting customers' privacy makes good 
business sense. But at the same time, this objective must be 
balanced against the legitimate need to use customer 
information for business purposes and to avoid overly costly 
and burdensome regulation.
    By enacting a flexible legislative framework, the Canadian 
privacy approach has attempted to strike an appropriate 
balance.
    I hope these comments, Mr. Chairman, have shed some light 
on our unique approach to privacy, and I would be happy to 
answer any questions.
    [The prepared statement of Denis E. Henry follows:]

 PREPARED STATEMENT OF DENIS E. HENRY, VICE PRESIDENT, REGULATORY LAW, 
                              BELL CANADA.

                             INTRODUCTION:

    Thank you, Mr. Chairman, for the invitation to appear before you 
and the members of the Sub-committee today on this very important 
subject.
    My name is Denis Henry and I am the Vice President of Regulatory 
Law with Bell Canada, the largest telecommunications carrier in Canada.
    As a group, the Bell Companies in Canada provide a full range of 
communications services to more than eight million residence and 
business customers. We are among the world's leading communications 
organizations, with core investments in telephone networks, both wired 
and wireless; Internet Protocol (IP)-based networks and solutions; 
electronic commerce; systems integration; directories and satellite 
networks. We are a major player in the local exchange, long distance 
and Internet access markets, including high speed access. On the 
content side of the business, we have investments in cable programming 
channels, broadcast television, a multi channel video program 
distributor through our direct-to-home satellite service, an Internet 
portal, new media and most recently a national newspaper. Given all of 
these varied business activities, most of which deal directly at the 
consumer level, we have been keenly interested in these issues for many 
years.
    I understand the Sub-committee is interested in hearing about 
Canada's approach to privacy as you consider the implications of the EU 
Data Protection Directive.

                   THE CANADIAN PRIVACY ENVIRONMENT:

    Part of Canada's electronic commerce strategy recognizes that the 
future growth of the information highway will allow Canada to 
capitalize on the full potential of electronic commerce, with its 
ensuing economic and social benefits. We have recognized that in order 
to ensure that business and consumers fully embrace electronic 
commerce, building trust is critical and building trust means providing 
reasonable protection of personal information and privacy. At the same 
time, in order for Canada to become a leader in the global knowledge-
based economy, the cost for business of managing personal information 
must also be reasonable and manageable.
    This concern about protecting personal information has attracted 
the interest of governments around the world and a number of options to 
address the issue have been debated in various circles. One approach is 
to adopt a comprehensive regulatory regime with a very detailed, 
prescriptive, all-encompassing set of privacy provisions that applies 
to all organizations in all industries. At the other end of the 
spectrum is an approach that relies almost exclusively on market forces 
with specific legislation on a sectoral basis to deal with the most 
serious abuses. The Canadian approach lies somewhere in the middle.

                   THE CANADIAN APPROACH TO PRIVACY:

    In October 1998, the Governments of the OECD Member countries 
attending the Ministerial Conference (A Borderless World: Realizing the 
Potential of Global Electronic Commerce) in Ottawa, Canada, adopted the 
Ministerial Declaration on Protection of Privacy on Global Networks 
which reaffirmed the importance of protecting privacy and recognized 
that the 1980 OECD Guidelines on the Protection of Privacy and 
Transborder Flows of Personal Data (the ``OECD Privacy Guidelines'') 
continue to provide an international foundation for the protection of 
privacy on any medium. The technology-neutral principles of the OECD 
Privacy Guidelines have formed the basis of self-regulatory and 
legislative initiatives internationally for almost two decades and 
continue to represent an international consensus for the collection, 
use and disclosure of personal information in any medium.
    Let me then describe how the Canadian approach to privacy has built 
upon and implemented these Guidelines.

a) The CSA Model Code for the Protection of Personal Information
    In the early 1990s, the level of concern of individuals over their 
privacy in general, and their lack of control over their personal 
information in particular, continued to rise coincident with the 
increased use of new technologies. In the face of this, the Government 
of Canada encouraged the business community to create a new Canadian 
standard for the protection of personal information. As a result, a 
Technical Privacy Committee of the Canadian Standards Association 
(``CSA'') was struck that broadly represented all key stakeholders: 
business, government and consumers. Those organizations that 
participated represented key industry sectors with vast consumer bases 
that had a large stake in establishing an effective standard for the 
protection of personal information, e.g. the telecommunications, cable, 
banking, insurance, credit reporting and marketing sectors.
    After a series of deliberations, the CSA Model Code for the 
Protection of Personal Information, CAN/CSA-Q830-96 (the ``CSA Code''), 
was finalized and released as a National Standard of Canada in March 
1996. The CSA Code is based on the OECD Privacy Guidelines and 
therefore represents a global standard. A summary of the CSA Code's 10 
Principles is appended as an attachment to this testimony.
    The Bell Companies participated actively in the development of the 
CSA Code. The Code's ten principles represent a cohesive and balanced 
set of fair information practices that reflect the needs and concerns 
of all parties. The Code clearly recognizes individual rights to 
control and limit personal information use, reflects the legitimate 
needs of companies to use information for business purposes, and 
establishes corresponding obligations for organizations to be 
accountable, obtain informed consent, safeguard personal data, and be 
open about policies and practices. As a ``model'' code, the CSA 
standard represents a set of minimum requirements and allows for the 
tailoring of the standard to meet the specific circumstances of an 
organization.

b) The Personal Information Protection and Electronic Documents Act
    Following development of the CSA Code, repeated surveys continued 
to underscore that Canadians were still concerned about the effect of 
new communications technologies on their privacy. While electronic 
commerce was starting to take off, many consumers were still reluctant 
to make purchases on-line because they lacked confidence in the 
security and privacy of on-line transactions. They were still unsure 
about what they could do or whom they could approach when something 
went wrong.
    Faced with that environment, the Government of Canada's Industry 
Department undertook broad public consultations to explore the 
possibility of a legislative approach. These discussions revealed broad 
support for self-regulation assisted by framework legislation that 
would encourage industry groups to develop sectoral codes based on the 
CSA Code.
    After much discussion and consultation with a broad array of 
representatives from government, industry and consumer groups, the 
Canadian government introduced in October 1998 draft legislation that 
was ultimately enacted in the form of the Personal Information 
Protection and Electronic Documents Act, S.C. 2000, c. 5 (the ``PIPED 
Act'') in April 2000. Its stated objective has been to establish 
harmonized national rules across the country. The PIPED Act is also 
intended to meet the adequate data protection requirements of the EU 
Data Protection Directive.
    This new piece of privacy legislation, which comes into force in 
basically two stages, is directed at the private sector and requires 
all organizations that collect, use or disclose personal information in 
the course of commercial activities to adhere to the CSA Code.
    Like the United States, Canada is a federal state. The federal 
government's approach to privacy also reflects a rather unique approach 
to the federal/provincial jurisdictional issue. As of January 1st of 
this year, the Act applies to all federal undertakings (e.g. 
telecommunications, broadcasting, airlines and banking industries), and 
those provincial undertakings that disclose personal information 
outside the province for consideration. In 2004, the provisions will 
apply more broadly to all organizations that collect, use, or disclose 
personal information in the course of commercial activities, including 
intra-provincial transactions. However, where and whenever a province 
adopts legislation that is ``substantially similar'' to the PIPED Act, 
the organizations covered will be exempted from the application of the 
federal law and the provincial law will instead govern.
    The purpose of the PIPED Act is to (s. 3):
        ``. . . establish, in an era in which technology increasingly 
        facilitates the circulation and exchange of information, rules 
        to govern the collection, use and disclosure of personal 
        information in a manner that recognizes the right of privacy of 
        individuals with respect to their personal information and the 
        need of organizations to collect, use or disclose personal 
        information for purposes that a reasonable person would 
        consider appropriate in the circumstances.''
    Due to legislative drafting conventions, it was recognized that it 
would indeed be difficult to incorporate the CSA Code principles and 
commentary directly into legislation, without significantly altering 
the carefully negotiated wording of the standard and compromising the 
flexible approach embodied in the standard. As a result the government 
adopted a novel approach to legislative drafting by having the 
legislation require compliance with the CSA Code, which in turn is 
reflected in a Schedule to the legislation.
    For the most part, the PIPED Act reflects a flexible approach that 
does not impose or mandate particular treatment of personal 
information. Rather, organizations can develop codes and practices 
tailored to their particular business circumstances. The very process 
of developing a tailored code forces an industry group or company to 
consider more thoroughly the manner in which to deal with information 
issues specific to its business activities. Furthermore, the process of 
developing a tailored code serves to educate participating industry 
sector members about their obligations and the need to develop 
corresponding practices and procedures.
    The legislation also requires commercial organizations to identify 
the purposes for which personal information will be collected, used and 
disclosed, and to obtain the consent of individuals from whom such data 
is collected. Consent can be either express or implied, depending on 
the circumstances and the sensitivity of the information--again 
reflecting a flexible approach. Commercial organizations, therefore, 
determine the scope of their identified purposes and consumers either 
accept them by continuing to do business with the organization or 
reject them by withdrawing consent or ``opting out'' of a particular 
proposed collection, use or disclosure.
    The PIPED Act establishes a federal Privacy Commissioner as its 
prime overseer. Individuals may direct to the Commissioner complaints 
about any aspect of an organization's compliance with the provisions 
relating to the protection of personal information in the PIPED Act. 
The Commissioner has general powers to receive and investigate 
complaints, including the summoning of witnesses and production of 
documents and other records. The Commissioner also has express powers 
to conduct audits and to attempt to resolve complaints by means of 
dispute resolution mechanisms such as mediation and conciliation. In 
fact, in framing the PIPED Act, the Canadian federal government clearly 
envisioned the Commissioner in an ombudsman role, with the stated goal 
of obtaining a resolution of privacy disputes in a non-confrontational 
manner. The Commissioner also has a mandate to develop and conduct 
information programs to foster public understanding of the privacy 
provisions of the PIPED Act.
    Unresolved disputes relating to certain matters can be taken before 
the Federal Court of Canada for a hearing. In addition to its normal 
powers, the Federal Court may order an organization to correct its 
practices and award damages to the complainant.
    By enshrining the CSA Code in legislation, the Canadian approach to 
protecting personal information recognizes that market forces alone 
will not provide the reasonable assurances that consumers require. At 
the same time, it avoids unnecessary and costly regulation that could 
stifle the growth potential of new technologies and provides necessary 
flexibility to tailor specific privacy practices to the unique 
circumstances of specific industry sectors. In our view, the Canadian 
approach reflected in the PIPED Act strikes an appropriate balance 
between a consumer's desire for privacy and the legitimate needs of 
business to collect and use personal information.
    Rather than imposing a common, detailed set of requirements and 
standards to be rigidly applied to all organizations in all industries, 
the Canadian framework legislation, recognizing that personal 
information needs vary tremendously across different industry sectors, 
accommodates maximum flexibility consistent with fair information 
practices.
    Most importantly, given the consensus process adopted, the CSA Code 
has the confidence of both consumer groups and the business community 
and represents, therefore, a fair and equitable basis upon which to 
build a legislative framework.

        THE BELL COMPANIES' CODE OF FAIR INFORMATION PRACTICES:

    Privacy and security of customer information is considered to be a 
key attribute of the Bell brand, and an important aspect of the 
relationship between the Bell Companies and their subscribers.
    The Bell Companies have long been committed--and continue to be 
committed--to maintaining the accuracy, confidentiality, security and 
privacy of customer and employee personal information. This is 
reflected in existing privacy and confidentiality provisions found in 
various Company policies and in applicable service rules approved by 
regulatory agencies over the years. It is also reflected in the high 
regard and trust with which customers and employees view the management 
of personal information by the Companies.
    Recently, the Bell Companies released the Bell Code of Fair 
Information Practices (the ``Bell Privacy Code''--copy attached). The 
Bell Privacy Code is a formal statement of principles and guidelines 
concerning the minimum requirements for the protection of personal 
information provided by the Companies to their customers and employees. 
The objective of the Bell Privacy Code is responsible and transparent 
practices in the management of personal information, in accordance with 
the CSA Code and the new legislation.
    The Bell Privacy Code stipulates that the Bell Companies can 
collect personal information only for the following purposes:

a) to establish and maintain responsible commercial relations with 
        customers and to provide ongoing service;
b) to understand customer needs;
c) to develop, enhance, market or provide products and services;
d) to manage and develop their business and operations, including 
        personnel and employment matters; and
e) to meet legal and regulatory requirements.
    As is the Companies' current practice, customers will continue to 
be able to review company records that contain personal information 
about them and update/correct any information contained in such 
records. Customers will also continue to be able to challenge any of 
the Companies' compliance with the Privacy Code through the existing 
office of the Bell Privacy Ombudsman. The office of the Ombudsman, 
which was established in 1992 in order to deal with unresolved privacy-
related complaints, has received very few such complaints in the 
ensuing years--an indication of the Companies' commitment to privacy 
protection and customer satisfaction.
    In order to implement the revised Bell Privacy Code, each of the 
Bell Companies has embarked on a plan that incorporates four elements: 
communications, training, systems and audit. The Companies are 
informing customers of the Companies' respective privacy policies and 
the implications thereof in a number of ways. The introductory pages of 
the white pages directory, bill inserts to customers, web pages and 
point of sale brochures all provide descriptions of the Companies' 
privacy policies. Business Office client representatives are also 
available to answer any questions that subscribers may have with 
respect to privacy. Copies of the Bell Privacy Code and other related 
documents are also available through these communication channels.
    In addition, the Companies are in the process of ensuring, through 
training and employee communications, that all employees understand and 
will uphold the commitments made in the Privacy Code and related 
documents. Particular attention is focused on employees who have 
routine access to subscriber personal information as part of their job 
function. All employees must sign-off annually that they understand the 
Privacy Code, and acknowledge that non-compliance with our privacy 
commitments could be grounds for dismissal.
    The Companies have also undertaken a review of their information 
systems to ensure that the provisions of the Privacy Code will be 
adhered to. Finally, regular internal audits will be employed to ensure 
ongoing compliance.
    The Bell Privacy Code will be reviewed at least every 5 years to 
ensure continued relevance and currency with changing technologies, 
laws and the evolving needs of the Companies, their customers and 
employees. New communications plans would precede adoption of any 
modifications to the Privacy Code.
    Finally, we intend to use technology to educate individuals about 
privacy issues, assist them to remain anonymous in appropriate 
circumstances and to exercise choice and control over the collection 
and use of their personal information.

                              CONCLUSION:

    In my view, the development by industry, government and consumers 
of the CSA Code has had a positive impact in influencing the Canadian 
government's approach to legislation in this area. The result is a 
piece of legislation that is flexible and far less intrusive and 
prescriptive than other possible legislative approaches. The Canadian 
legislation enshrines high-level privacy principles while avoiding 
unnecessary and costly regulation and providing necessary flexibility 
to tailor specific privacy practices to the unique circumstances of 
specific industry sectors.
    As leaders within our industry, we are committed to fair 
information practices within our individual companies, and to new 
voluntary initiatives that will further strengthen the level of privacy 
protection afforded to our customers and employees. Public education 
combined with market-developed technological solutions tailored to 
consumers' concerns and market demand will assist in providing the most 
efficient and effective means to protect personal information.
    The Bell Companies have supported the Canadian government's steps 
in pursuing a new model for the protection of personal information in 
the private sector, a model tailor-made for Canada which builds on the 
voluntary efforts of consumer groups, industry and governments.
    We believe the best model in Canada for private sector privacy 
legislation is a strong and consistent framework of harmonized federal-
provincial laws. Most importantly, only consistent harmonized privacy 
laws across all jurisdictions will provide the level of privacy 
protection that individuals seek and require for the growth of global 
electronic commerce.
    The Bell Companies remain committed to working with governments to 
promote effective privacy protection within a broader societal context.
    We wish you well in your deliberations.

                    CSA Code--Principles in Summary

    Principle 1--Accountability: An organization is responsible for 
personal information under its control and shall designate an 
individual or individuals who are accountable for the organization's 
compliance with the following principles.
    Principle 2--Identifying Purposes: The purposes for which personal 
information is collected shall be indentified by the organization at or 
before the time the information is collected.
    Principle 3--Consent: The knowledge and consent of the individual 
are required for the collection, use, or disclosure of personal 
information, except where inappropriate.
    Principle 4--Limiting Collection: The collection of personal 
information shall be limited to that which is necessary for the 
purposes identified by the organization. Information shall be collected 
by fair and lawful means.
    Principle 5--Limiting Use, Disclosure, and Retention: Personal 
information shall not be used or disclosed for purposes other than 
those for which it was collected, except with the consent of the 
individual or as required by law. Personal information shall be 
retained only as long as necessary for the fulfillment of those 
purposes.
    Principle 6--Accuracy: Personal information shall be as accurate, 
complete, and up-to-date as is necessary for the purposes for which it 
is to be used.
    Principle 7--Safeguards: Personal information shall be protected by 
security safeguards appropriate to the sensitivity of the information.
    Principle 8--Openness: An organization shall make readily available 
to individuals specific information about its policies and practices 
relating to the management of personal information.
    Principle 9--Individual Access: Upon request, an individual shall 
be informed of the existence, use, and disclosure of his or her 
personal information and shall given access to that information. An 
individual shall be able to challenge the accuracy and completeness of 
the information and have it amended as appropriate.
    Principle 10--Challenging Compliance: An individual shall be able 
to address a challenge concerning compliance with the above principles 
to the designated individual or individuals accountable for the 
organization's compliance.

    Mr. Stearns. Thank you, Mr. Henry.
    Let me start off. Mr. Winer, if we enacted--if we had the 
European Union privacy laws, what would be the cost to American 
taxpayers, American businesses? I mean, just give me a little 
brief scenario here. I have got lots of questions, so--I mean, 
it is going to be burdensome from your testimony, but, I mean, 
is there any kind of statistical or quantitative----
    Mr. Winer. I have never been able to find one, sir. I have 
asked the Europeans any number of times if they have ever done 
such a study.
    Mr. Stearns. Right.
    Mr. Winer. I believe the Department of Commerce may have 
requested that information from the EU and never gotten any 
response back.
    Mr. Stearns. Okay. Ms. Lawler, your company has signed the 
safe harbor, and there is less than 20. So you folks are out 
there early. And so I guess the real question, why--can you 
sort of let us in with a trade secret, why haven't the other 
technical companies signed on to this safe harbor? We all 
respect and admire your company, and it is one of the 
bellwether leaders in the industry. Why are you way ahead? Why 
haven't the other people done it?
    Ms. Lawler. Let me answer that by saying last month I was 
at a workshop on safe harbor that was conducted in the Bay 
area, which by the way was extremely well attended by many 
large global and national concerns.
    And what I heard in comments--I think the first thing to 
keep in mind is that while the safe harbor principles have been 
under discussion for a couple of years, the real final result 
that was available for American businesses to actually look at 
and evaluate what they needed to do to certify to the safe 
harbor has really only been available since November 1st.
    Now, for Hewlett Packard, we really had a running start 
because we had such a strong set of privacy policy and 
associated practices before the actual safe harbor agreement 
was even ratified, partly through our work with the safe 
harbor--I am sorry--with the BBB Online folks and that privacy 
seal program.
    What I heard from some of my peers in that area is that 
there is still concern about some of the jurisdictional issues. 
They are waiting to see the standard contracts that were 
discussed in the first panel, to see if that was a viable 
alternative.
    Mr. Stearns. The model directives, you mean?
    Ms. Lawler. Excuse me? I am sorry.
    Mr. Stearns. You are saying contracts.
    Ms. Lawler. The standard contracts that one would sign with 
each----
    Mr. Stearns. For safe harbor.
    Ms. Lawler. [continuing] protection authority.
    Mr. Stearns. Okay.
    Ms. Lawler. As opposed to safe harbor, evaluating that as 
an alternative. Some companies are actually looking at 
developing very elaborate express permission scenarios, very 
expensive.
    Frankly, a lot of companies just simply are not as far 
along in their internal practices and take safe harbor and the 
principles outlined very seriously. And so I think it is going 
to take them some time to evaluate where they are at, what they 
are doing, and it is probably about a year process for them.
    Mr. Stearns. Mr. Winer, does the safe harbor provide a 
prudent option for American companies to comply with the EU 
directives, in your opinion?
    Mr. Winer. If you are a company with a complex corporate 
structure, it is going to be very difficult because of the--
each company, each structure, is viewed to be a third party, 
and you have to agree not to transfer to third parties, which 
could include intra-company transfers. Of course, it can't 
apply to financials or telecoms because they are not within the 
jurisdiction.
    I think it is up to each company. The fact that so few have 
so far chosen to sign on is a vote with your feet proof that to 
date it has not been an attractive option for most companies. I 
think it would be terrifically valuable if we were able to get 
a cost assessment--as an answer to the question you asked me--
done by proper economists, properly trained people, to try and 
figure out what real compliance costs are likely to be.
    I noted in the testimony of my colleagues from HP, they are 
doing a very great job, but they confessed, I believe, at one 
point that there are some areas that they are finding some 
difficulty in completely meeting the terms of the directive as 
they develop their processes. So it is going to be a bit of 
work for everybody, and potentially an expensive one. We ought 
to know the costs.
    Mr. Stearns. Ambassador Aaron, you stated that the 
provisions of the safe harbor had to be more flexible than the 
directive and address real-world information practices on a 
reasonable basis. Yet only 26 companies and organizations have 
signed up for the safe harbor. Does this suggest that safe 
harbor is not a reasonable option for American companies?
    Mr. Aaron. I think it is a very reasonable option, and I 
might say that since we have had some of our panelists here say 
that it was either too tough and onerous, and others said it 
didn't mean anything and would not help, I think we have 
probably hit the sweet spot in trying to put this thing 
together.
    I think the main reason that companies haven't signed on 
yet is that it is very complicated, and they want to look at it 
carefully. I think you could tell, even from the discussion 
this morning with the European Data Protection Authorities, 
even there is some confusion on their part as to exactly how 
all of this would work.
    Well, I would be careful, too. And we are advising our 
clients that the safe harbor is a good way to go but that they 
have got to be very careful in how they do it, and that they 
have got to be sure that it is going to apply.
    My principal concern at this point has been the fact that 
the European Union has started to chip away at the safe harbor. 
First, in the final days of negotiation, they made changes to 
how employee data would be covered, making it much more 
difficult than the safe harbor ought to operate from the 
standpoint of enforcement.
    There are suggestions now that the--from the data 
protection authorities that if you send a cookie from the 
United States to a computer in Europe, that this somehow 
creates a facility in Europe, and, therefore, operates under 
European law, and, therefore, somehow the safe harbor doesn't 
apply; it has got to be European law.
    Well, I talked to the Commission personally on this issue, 
and they were rather horrified by this conclusion because it 
has implications for taxation and a whole lot of other things. 
And they are going to seek to get this clarified, but it is the 
kind of uncertainty that I think causes companies pause.
    Mr. Stearns. My time has expired.
    Mr. Towns?
    Mr. Towns. Thank you, Mr. Chairman.
    Let me continue with the Ambassador. Is there an organized 
effort by some in the business community to keep U.S. firms 
from signing on to the safe harbor?
    Mr. Aaron. I, frankly, don't know. I haven't personally 
encountered--I know there were some people toward the very end 
of the negotiation that raised some objections, some of them of 
the sort that we have heard here today. But I don't know of any 
organized effort to boycott it in any way.
    Mr. Towns. Well, in a recent article in Computer World, a 
representative of Dun & Bradstreet said that safe harbor 
allowed that company to obtain waivers for data transfers so 
that it could consolidate a UK-based data center with one in 
New Jersey. Do you believe that safe harbor helps keep data 
firms and jobs in the United States?
    Mr. Aaron. Well, there is no question about it. If--you 
know, there are two ways to run a business. One is you can 
totally decentralize, and if you are dealing with European 
employee data, customer data, that sort of thing, if you just 
keep it in Europe, but--particularly if there is obstacles to 
bringing it back to the United States.
    I have one client who is--that basically provides a service 
that involves employee evaluation, and they provide this 
service to companies all over the world. And so they get 
evaluations from superiors and subordinates and colleagues and 
self-evaluations, and so forth. They do all of this processing 
in the United States.
    Now, if they are not a member of the safe harbor, they are 
not going to be able to be in business. Now, they can go toward 
contracts, but I think, as Mr. Winer indicated, these contracts 
are enormously onerous. The basic principles are the same as 
the safe harbor, but then they tack on a whole series of other 
things about rights, private action, and all the rest, that 
this is not going to turn out to be an attractive alternative.
    So I think at this point you have basically got the safe 
harbor, you have contracts, and that is what you have got. And 
I think the safe harbor is a much more congenial, flexible 
tool, even though it may go further in some respects than we 
would like.
    Mr. Towns. Anybody disagree with that? Yes? You have a 
comment on that?
    The reason I--let me just say, the reason I ask that, not 
that I am interested in having a debate of any sort, but the 
point is that I just think this issue is just so serious that 
we need to make certain that we get as much information as 
possible before we move forward, because I am convinced that 
something is going to be done in this Congress. So I really 
want to get information.
    Yes?
    Mr. Reidenberg. I would hope you are right that this 
Congress will do something to protect privacy in the United 
States. I guess I disagree with at least one statement, that in 
the absence of signing up for safe harbor the companies will 
not be able to transfer data back to the United States.
    Article 26 of the directive has a series of derogations 
from safe harbor--or, excuse me, has a series of derogations 
from export prohibitions that are more extensive than simply 
having a contract between an American data importer and the 
European data exporter.
    The other thing that I think the committee ought to be 
aware of is that the export prohibition provision did not begin 
with the European directive. It began with member state law 
that preexisted the directive for many years.
    And many of the certainly larger American companies have 
been dealing with this as a fact of life for more than 20 years 
in some member states and have not had problems, because they 
have worked with the national data protection authorities in 
each of those member states, assuring them of treating the 
European data with fair standards in the United States.
    So if it is a company that is treating data fairly in the 
United States, I find it very perplexing that they have such 
difficulty either signing onto a contract for data protection 
or subscribing to something like the safe harbor, the 
substantive standards of the safe harbor.
    If they are indeed practicing privacy, these obligations 
should not be that--should not be burdensome for them. Again, 
keeping in mind if they are operating in Europe, they are under 
legal obligation in European countries to do that anyway.
    Mr. Towns. Thank you.
    Yes, Mr. Winer?
    Mr. Winer. Yes, sir. I would say that the devil is in the 
details in this area. And one of the reasons why so few 
companies have signed up is because you have to do a very 
detailed analysis of how the safe harbor applies to your actual 
operations and information systems. And if you have got a 
complex corporate structure or complex sets of information, you 
may not be able to live up to the safe harbor very easily. It 
may be expensive and difficult.
    So its value is very fact-dependent, and there are lots of 
gaps.
    Mr. Aaron. May I just add one point? This is true of any 
privacy policy. And one of the great and surprising things is 
that if you would talk to most companies about the privacy 
policy, you can often find out that they just borrowed it from 
some other company. They just went on the web, took the privacy 
policy, stuck it on there. It has nothing to do with their 
business.
    You talk to general counsels of major corporations about 
their privacy policy, and you ask them, ``Do you collect 
personal data? And who do you share it with?'' And they say, 
``We will get back to you,'' because they don't know. They have 
to go all the way down to the data base managers and find out 
what is really happening in those companies.
    This is true of any privacy policy. It goes to the heart of 
most companies and business operations, and it is a crucial 
thing, and it is going to cost money for everybody.
    Mr. Towns. All right. Mr. Chairman, my time has expired.
    But let me commend Ms. Lawler for her company in terms of 
their moving forward. I just wanted to let you know that we 
salute you for that.
    Ms. Lawler. Thank you, sir.
    Mr. Towns. Right. I yield back.
    Mr. Stearns. Mr. Buyer is recognized for 5 minutes.
    Mr. Buyer. Thank you, Mr. Chairman.
    Ms. Lawler, I have got your web page. Okay?
    Ms. Lawler. Okay.
    Mr. Buyer. One thing I do like about it, what appears to be 
open and conspicuous, and I don't know if it is redundant, but 
over here it says privacy statement. So you can click on it, 
right? And you get over into it, it says, ``Who do we share it 
with?'' i.e. obviously, the personal data.
    So you want to get in there, and it is--I heard your 
testimony. It sounds good. So let us examine what you said. HP 
will not sell, rent, or lease your personally identifiable 
information to others. And that is what your testimony was.
    Ms. Lawler. Correct.
    Mr. Buyer. Okay. Now let us go into the but. You then give 
permission to your partners----
    Ms. Lawler. What I said in my testimony is that we will not 
share with partners without customer permission. I can share 
some examples if you would like.
    Mr. Buyer. [continuing] that you provide online with other 
HP entities and/or business partners who are acting on behalf, 
and the uses are described, how we use it.
    Ms. Lawler. Business partners acting on HP's behalf. That 
was the scenario I described where their suppliers and service 
providers--they are required and covered under contract and on 
disclosure to abide by our privacy policy.
    Mr. Buyer. So all of your other subsidiaries or partners 
whom you do business with, you go all the way back to your 
customer. If I click on--my son clicks on and does something 
with HP, you are not going to give any of that data unless you 
go back and ask whether or not you can give it?
    Ms. Lawler. What that is saying is that if they are covered 
under contract, they are covered by the privacy policy. An 
example would be an advertising agency creating material for us 
or a shipper like, say, Federal Express shipping our product.
    Mr. Buyer. Let me ask this. Do you believe that there 
should be a level of comfort with someone who would use your 
site, that the information or their practice is not going to 
then be shared with your other business partners or 
arrangements or contractual partnerships that dominoes one 
after another?
    Can I turn to my constituents and say, ``Hey, what HP says 
is when you deal with them, none of that information is going 
to be shared with anyone else unless they come back to you''?
    Ms. Lawler. If you are referring to the situation we talked 
about with suppliers----
    Mr. Buyer. No, no, no, no. Don't go to what your situation 
is. Go to mine. See, I don't believe----
    Ms. Lawler. Can you give me a specific----
    Mr. Buyer. I don't believe you can stand by what you just 
said. That is what I am questioning. First, you give that one 
statement that is pretty emphatic, and then you go into the 
``unless.'' I always pay attention to the unless, however, but, 
comma.
    Ms. Lawler. That is not a but or unless, but I understand 
what your question is.
    Mr. Buyer. All right. I don't want to quibble with you.
    Ms. Lawler. Okay.
    Mr. Buyer. I just want to get the definition.
    Mr. Stearns. Will the gentleman yield for just a moment?
    Mr. Buyer. Yes.
    Mr. Stearns. Another question you might ask is, how are 
they enforcing against their partners?
    Mr. Buyer. Well, that is the real problem. If you have 
information which you say, ``Well, we are going to give it to 
one of our business partners,'' then you begin to lose control 
when that business partner has a second arrangement with 
another business partner, and all of a sudden it is three, four 
down the line and you have----
    Ms. Lawler. Okay. I need to go back to what I had been 
saying, which is that if it is a partner doing business on 
behalf of HP--in other words, we could have our own shipping 
organization that delivered packages to your door, we could 
have an in-house ad agency, we could have all in-house call 
centers for an example. An alternative is to outsource that 
effort.
    Outsourced efforts are covered under contract and legal 
non-disclosure agreements that the vendor--this is a vendor-
supplier relationship--that they sign. Therefore, they are 
protected. So they have the data, but they are not using it for 
their own business purposes. They are using it on behalf of HP 
contractually; therefore, legally protected.
    That is different from a business partnership, say, for 
example, with a software supplier. Say, for example, you bought 
a Hewlett Packard Pavillion PC, and you decided to register 
that product with Hewlett Packard, which, by the way, is your 
choice. You can also choose to register your software 
applications at the same time in one single approach, which 
many customers see as a benefit. Others prefer to register 
individually.
    So if we think of a major software provider, we provide you 
the option to transmit your personal data to that software 
provider to complete the registration process in one single 
effort. But we ask that permission question before that 
happens. And if you don't want to do that, it doesn't happen. 
You are in control.
    Mr. Buyer. Thank you.
    Mr. Stearns. The gentleman from Tennessee, Mr. Gordon?
    Mr. Gordon. Thank you. We only have 5 minutes just like you 
do, so I am going to try to be quick with three questions and 
hope you will be quick with three answers, or at least the 
first two.
    Ambassador Aaron, if you could help maybe clear up a 
question I had raised earlier concerning the safe harbor, and 
that is that if a company is within safe harbor, then FTC makes 
those determinations. My concern is, then, does the--is there a 
veto or an override in some regard by any of the EU countries 
to say that the FTC is not doing their job properly or they 
don't agree?
    Mr. Aaron. No, there isn't. Now, having said that--and that 
is part of the deal. Having said that, if Mr. Rodota, for 
example, should decide he didn't agree with that and he thought 
that some U.S.--some firm in Italy was sending information to a 
company in the United States that wasn't behaving properly, and 
he moved to enjoin that transmission of information, then it 
would be the responsibility of the European Commission to go 
after Mr. Rodota and to get together his various committees and 
make a determination as to whether Mr. Rodota was in his rights 
or was not.
    And they have made clear to us, in the course both of the 
negotiations, that they would move to insist that the national 
data----
    Mr. Gordon. So they can overrule the FTC.
    Mr. Aaron. They can overrule the----
    Mr. Gordon. Well, that is all I wanted to----
    Mr. Aaron. They can overrule the national--the Commission 
can overrule the national Data Protection Authority.
    Now, anybody can sue anybody. If somebody goes into court 
and says, ``I am not being protected in a European court,'' 
then the European Commission will weigh in on the side of the 
U.S. defendant if they are within the safe harbor.
    Mr. Gordon. But they still can overrule the FTC, the 
individual countries, can't they?
    Mr. Aaron. No, they cannot. The European Commission comes 
in and declares that action illegal or unacceptable.
    Mr. Gordon. But isn't that the same thing?
    Mr. Aaron. No. The action of the member state is illegal or 
unacceptable. In other words, any----
    Mr. Gordon. But can they rule that it is acceptable, their 
action is acceptable?
    Mr. Aaron. Well, I suppose that is conceivable, but then 
that is a violation of our agreement and that raises everything 
to a political level and we begin to----
    Mr. Gordon. So why would--okay. Well, maybe I just need to 
understand that more.
    Mr. Winer, you gave a lot of reasons why the EU should not 
go forward with the regulations that they have. Is there any 
reason that they can't make a bad decision? I mean, you said it 
is a bad decision. But do they have the right to make that bad 
decision?
    Mr. Winer. They certainly have the right to make a bad 
decision. The question is, what is the U.S. response when 
another country makes a bad decision?
    Mr. Gordon. That is the main thing I wanted to know.
    Mr. Winer. Yes, sir.
    Mr. Gordon. So they have the right to make that bad 
decision.
    And, finally, if I can--Mr.--I guess this is--Mr. 
Reidenberg, if I was a--from a business perspective, what makes 
me most concerned about dealing with the EU would be the 
uncertainty as well as maybe the arbitrariness of how some of 
the rulings, you know, could be arbitrated.
    I think you have what I would think is the best suggestion, 
and that is some type of international treaty which would go 
beyond EU into problems around elsewhere. What would be the 
vehicle for that international treaty?
    Mr. Reidenberg. The WTO, in particular, Telecoms Annex.
    Mr. Gordon. Yes, okay.
    Mr. Reidenberg. There is a specific exception for 
restrictions on trade and services and information under the 
Telecoms Annex for privacy. And the WTO agreements require 
biennial assessments at a ministerial level for----
    Mr. Gordon. Is there any kind of effort going on to develop 
some international standards in that regard?
    Mr. Reidenberg. There has been some suggestion that the WTO 
take it up. To my knowledge, that has not yet happened. I think 
it is inevitable that the WTO will have to focus on privacy 
issues. I would prefer to see the United States taking the lead 
than being the second seat at the table.
    If I may for a moment refer specifically--this goes back to 
your first question that you raised with Ambassador Aaron. 
Article 3 of the Commission decision of July 26th, which is the 
decision approving the safe harbor, specifically allows the 
member state data protection authorities to reject transfers to 
a company on the safe harbor list.
    So the specific answer is Article 3--it is specifically 
Article 3, clause 1(b), specifically says that the member 
states under certain circumstances can refer to recognize a 
company on--listed on the Commerce Department's listing of 
certified safe harbor companies.
    Mr. Gordon. Well, that was my understanding.
    Ambassador Aaron, I guess you can say it, but maybe I don't 
understand it, I mean, why do you see this differently than the 
rest of us?
    Mr. Aaron. Because the Commission has further powers. The 
Commission has the power to look at any decision made by a 
national Data Protection Authority and decide whether it is 
within the scope of the safe harbor or whether it is doing 
something aberrant. It has nothing to do with the safe harbor, 
trumping the FTC, doing something----
    Mr. Gordon. Right.
    Mr. Aaron. [continuing] of that sort.
    Mr. Gordon. So however you get there, but that is the same 
result. I mean, that they can overrule the FTC, can't they? But 
why don't you maybe----
    Mr. Aaron. No.
    Mr. Gordon. Again, I am just wondering, why do you see this 
differently than everyone else here?
    Mr. Aaron. I guess maybe because I negotiated it and I know 
what those words mean.
    Mr. Gordon. Or is that just editorial pride?
    Mr. Aaron. No, I don't think so. I don't think so. I don't 
think I actually wrote the words.
    Mr. Gordon. Okay.
    Mr. Aaron. What happens is that if the national--there are 
some exceptions, as you pointed out. But, basically, if the 
national data protection authorities do not recognize the safe 
harbor, the Commission has the right to come in and make them 
recognize it. That is the deal. So if they do something----
    Mr. Gordon. They have the right to, but does that mean that 
they have the obligation to?
    Mr. Stearns. The gentleman's time has expired.
    Mr. Aaron. Well, that----
    Mr. Gordon. I mean, if they don't have the obligation to, 
then it doesn't really matter, does it?
    Mr. Aaron. Well, they actually have the obligation to under 
their own rules.
    Mr. Gordon. Thank you.
    Mr. Stearns. The gentleman's time has expired.
    The gentleman from Georgia, Mr. Deal, is recognized for 5 
minutes.
    Mr. Deal. Thank you, Mr. Chairman.
    Mr. Henry, as I understand, what has happened in Canada is 
you started out with industry code that was industry derived, 
and that has now been backed up with legislation, but the 
legislation is very flexible and embodies the possibility for 
many variations of types of agreements. Is my understanding 
correct?
    Mr. Henry. Flexible in the sense that it allows--it sets 
out a number of obligations. But the manner in which you meet 
those obligations or fulfill them leaves some flexibility. So, 
for example, different industries, it actually envisages that 
different industries would develop different practices to 
reflect the particular business circumstances, still complying 
with the principles and having an obligation to comply with the 
principles.
    And consent as well is a flexible concept. The form of 
consent depends very much on both the sensitivity of the 
information and the circumstances, and so on.
    Mr. Deal. But these are national standards with----
    Mr. Henry. Right.
    Mr. Deal. [continuing] the right of territorial----
    Mr. Henry. Right.
    Mr. Deal. [continuing] variations.
    Mr. Henry. Right.
    Mr. Deal. I guess the next question, then, is, has the EU 
acknowledged your legislation and your code as an acceptable 
compliance with their directive?
    Mr. Henry. It is in the process of doing so. There is a 
couple of working group studies underway. I think Mr. Smith 
earlier acknowledged that it looks like they will accept it, 
and certainly----
    Mr. Deal. Will it be a blanket approval, or will it--since 
there is flexibility, would it be a case-by-case determination?
    Mr. Henry. Well, our hope and understanding, and the 
Canadian government's hope and understanding, is that it will 
be accepted. The EU is looking at it, and once they understand 
it we are confident that they will accept it. Yes, absolutely. 
And it was drafted not only with that in mind but certainly 
with that in mind, that it was to comply with the EU directive.
    Mr. Deal. All right.
    Mr. Henry. And if I could just add one other thing. When I 
say ``flexibility,'' it is flexibility on those points I talked 
about. On the enforcement side, I think it is much stricter. 
There is a privacy commissioner with a lot of power. There is 
possibilities to go to court. There is audits. There is public 
reports that the privacy commissioner can make. So it is quite 
strict in that sense.
    Mr. Deal. Professor Reidenberg, I believe your suggestion 
of trying to arrive at some standard initiated that would be 
acceptable to our country, and then going through WTO to see if 
we could arrive at a mutually agreeable standard, is probably a 
very good approach.
    But your comments also indicate that if American companies 
are really doing basically what they should be doing, they 
really shouldn't have that much trouble under the current 
arrangement, even though it is somewhat disjointed. Is that a 
fair summary of what I heard you say?
    Mr. Reidenberg. Yes and no. I think it is a fair summary, 
but it probably doesn't completely present an accurate picture. 
If American companies were doing what they were supposed to be 
doing, and by that I am going to treat that as an American 
standard, if companies were treating information fairly with 
the kinds of principles that we have long recognized in the 
United States going back to the OECD guidelines from the early 
1980's, if they were doing that, then substantively they should 
be in compliance with the kinds of obligations that the 
European directive imposes.
    It would not, however, alleviate the practical problem of 
having to prove their adequacy on a case-by-case basis, because 
there would be no obvious legal right to point to, no obvious 
enforcement ability to point to. They would have to go and show 
case by case, yes, we are doing these things. So----
    Mr. Deal. Mr. Winer, or Ambassador Aaron, do either of you 
disagree that going to a standard--WTO approved standard would 
be not a desirable goal to try to shoot for? Or is there a 
better way?
    Mr. Aaron. I think there is a better way, and I think the 
better way was reflected in the testimony we heard earlier, 
which is a thing called the global business dialog for e-
commerce. They are in the process of developing a number of 
private sector, international rules and standards, much along 
the lines that the Canadian private sector did, kind of a code 
of conduct.
    I think that is likely to be much more flexible, much more 
effective, much more widely accepted, and to try to go into an 
organization of 140 or 70, or I don't remember how many members 
there are now, including China and a couple of other countries, 
and try to negotiate privacy, this is not going to be an easy 
thing to do.
    Mr. Deal. Thank you, Mr. Chairman.
    Mr. Stearns. Thank you. I think--there are just a few of us 
left--we will take another quick round. Make sure you don't 
miss your planes.
    Mr. Henry, it seems like Canada has developed something 
with the participation of industry. So industry came in and 
participated in developing the code and practices, as I 
understand it, that is tailored to the different industry that 
applies.
    Did you find that industry's participation made it less 
burdensome? I mean, that relationship, did that make it 
palatable for them to take an all-encompassing law? I mean, you 
might give us just a little----
    Mr. Henry. Absolutely. What they did was develop a code 
that was at a higher level, and that code is a single code. 
That is a CSA Code. But that code itself allows and envisages 
that industry-specific sectoral codes could be developed to be 
in compliance with that code. And so----
    Mr. Stearns. Ambassador Aaron, you mentioned the global 
business dialog of e-commerce. So if you were in a position 
where you could wave a magic wand and put in place, for the 
United States or for world commerce, one consistent privacy 
practice, how would you do it, and what would it be?
    Mr. Aaron. Well, I think that the basic principles that 
were contained in the OECD privacy principles are a good place 
to start. But it is very important to recognize that different 
sectors of the economy have different privacy requirements and 
need different kinds of flexibility.
    So I would build from there, but I would try to realize 
that there are sectoral differences. For example, the Europeans 
don't accept our Gramm-Leach-Bliley and Fair Credit Reporting 
Act. I think this is a big mistake on their part. We provide 
tremendous----
    Mr. Stearns. They don't accept our what?
    Mr. Aaron. They don't accept that the Gramm-Leach-Bliley 
privacy protections and the Fair Credit Reporting Act 
protections----
    Mr. Stearns. Oh, okay.
    Mr. Aaron. [continuing] are adequate.
    Mr. Stearns. Okay.
    Mr. Aaron. They think that is not adequate privacy 
protection. I think that is entirely unacceptable for us. And, 
of course, we are going to come to the crunch on this issue 
pretty soon. But those two acts working together provide 
tremendous privacy protections, and they are enforced by the 
Fed and by the Office of Thrift Supervision and all the rest of 
it.
    But I really think you can't just spell out--well, I would 
be happy to do it at some point, maybe write a book about it, 
but I think you really have to think about--you know, you have 
to give notice; how much? You have to give choice; opt-in/opt-
out. You have to talk about third parties and your obligations.
    Mr. Stearns. Do you think in opt-in or opt-out there is a 
favorite in your mind?
    Mr. Aaron. I think that opt-out ought to be quite 
acceptable for many, many purposes.
    Mr. Stearns. So----
    Mr. Aaron. And, in particular, let me just say one thing. 
You know, the debate that took place in Gramm-Leach-Bliley, 
during that period, was whether there should be opt-in for 
sharing with affiliates. That was the big fight over that 
issue.
    Well, the Europeans say, ``No, you have to have''--what we 
were trying to do with that was to try to make us equal to the 
Europeans. The European banking institutions and financial 
institutions aren't structured the way we are. They have 
insurance. They have brokerage. They have banks. They are not 
affiliates. They are actual divisions of a company. So, 
therefore, they share this between each other all the time, 
with no difficulty.
    We are structured--many of our companies are structured 
differently. So all of a sudden you get this issue of affiliate 
sharing, and whether there should be opt-in or there should be 
opt-out. Well, I think we have got to be careful there because 
the fact of the matter is if we accepted either one of those 
procedures--and we did accept opt-out to some extent--we find 
ourselves at a competitive disadvantage.
    Mr. Stearns. Mr. Winer and Professor Reidenberg, both of 
you briefly tell me what you would do if you could wave a magic 
wand to get this privacy so that it would be a global business 
policy.
    Mr. Winer. For starters, the EU needs to recognize the US 
system for protecting privacy as adequate. Our system protects 
privacy in practice better than the EU system. You go in, you 
get privacy policies----
    Mr. Stearns. So they have got to recognize the Gramm-Leach 
bill.
    Mr. Winer. Absolutely. And Fair Credit Reporting. You look 
at the privacy policies companies put online. If you don't do 
that, you are going to have customer problems, you are going to 
have FTC problems, you going to have Attorney General problems.
    We have a system in this country of regulation and 
enforcement that is very aggressive. You go over to the EU they 
have got soft guidelines, and they have got much less 
enforcement. They don't have regulations for the most part.
    And the testament is, you get the consumer groups looking 
at it, and they are saying, ``Yes, America actually does it 
better, even though the EU standards are tougher.'' So the 
first thing would be they have to recognize our system and give 
due respect to our system. Yes, sir.
    Mr. Stearns. Okay. Professor?
    Mr. Reidenberg. I think it is nonsense that Gramm-Leach-
Bliley meets the standards contained in the European directive. 
I think we are bandying about the term ``adequate'' in 
different ways. Adequate, under the directive, means does it 
satisfy the obligations contained in the directive.
    We may talk about it as being adequate for the American 
context as an enacted by Congress. I personally have views much 
more akin to Mr. Markey's from this morning. But in terms of 
the Gramm-Leach-Bliley compared to the standards in the 
directive, Gramm-Leach-Bliley is essentially a notice and 
consent statute. The directive contains substantially more than 
that in terms of fair information practices.
    It contains data subject access rights. It contains 
security rights. It contains a whole host of things that Gramm-
Leach-Bliley is just simply silent on.
    Similarly, the Fair Credit Reporting Act is a very 
important piece of privacy legislation in the United States. 
But if you look at it carefully in the context of the 
directive, and if you look at it carefully in its own context, 
it has the most tortured set of definitions for what is covered 
under the Fair Credit Reporting Act of any recent legislation 
we have had.
    What I would do in the United States, I would enact the 
OECD guidelines and statutory obligations, and I think we need 
to look at some creative ideas like creating a mechanism such 
that--a safe harbor mechanism so that companies have a degree 
of certainty in particular contexts what their obligations are 
under a statutory enactment like the OECD guidelines.
    Mr. Stearns. My time has expired.
    Mr. Towns?
    Mr. Towns. Thank you very much, Mr. Chairman.
    Mr. Winer, I see from your statement that in the previous 
administration you served in the State Department and were 
engaged in negotiations with the EU. When you were at the State 
Department, were you a member of the United States delegation 
that negotiated the EU-U.S. safe harbor agreement?
    Mr. Winer. No, sir.
    Mr. Towns. So you are not appearing at this hearing as an 
expert witness based on any direct involvement in those 
negotiations. Is that correct?
    Mr. Winer. In those negotiations, no, sir. I did lots of 
other negotiations with the EU, however, sir.
    Mr. Towns. Your written statement says that you are 
affiliated with the law firm of Alston and Byrd, and that you 
spend much of your time, ``Counseling U.S. companies about 
privacy issues,'' including the EU privacy directive that is 
the subject of this hearing today.
    Are you representing clients this afternoon in your 
appearance before the subcommittee? And, if so, who are they?
    Mr. Winer. No, sir, I am not. These represent my views. No 
one from outside my law firm reviewed any aspect of my 
testimony prior to my writing it. It reflects my views. In 
fact, it reflects opinions that I held when I was in the 
Clinton Administration.
    Mr. Towns. Okay. Well, do your clients want to see the safe 
harbor agreement terminated?
    Mr. Winer. I have not asked that question of any client, if 
they want the safe harbor agreement terminated. I think what 
people want is a safe harbor that is going to work for them.
    I think what they want is respect for--when you are in 
compliance with U.S. law, that you are not going to be punished 
for when you act in compliance with U.S. law by somebody else, 
and that your compliance with U.S. law will buy you some 
protection against being punished elsewhere. I think that is 
what some people would like to see, sir.
    Mr. Towns. All right. Thank you.
    Ms. Lawler, you know, I am still back on the question that 
Congressman Buyer raised, if there was a violation. It is my 
understanding that if HP would actually be liable to its 
consumer if that occurred, and it would be my understanding 
that then HP would go after the vendor, is that correct?
    Ms. Lawler. Correct.
    Mr. Towns. Yes. So I couldn't quite understand where he was 
going with that. That was really, you know--I couldn't quite, 
you know--well, anyway, that is another issue. I am sorry he is 
not here, because I don't want to pursue it any further because 
I am sure he would have, you know, maybe a response. It is 
unfair I think to pursue it, you know, because of the fact that 
he is not present. But I just had to say that because I have 
thought about it.
    The other thing is that, basically, I wanted to raise with 
you, Ms. Lawler, it is my understanding that the EU has tried 
for years but so far has failed to agree on what a model 
privacy contract should look like. Nevertheless, contracts are 
being entered into every day.
    Do U.S. companies have sufficient commercial presence in 
the EU that they can hold their own in these contract 
negotiations? Or does the absence of a model contract mean that 
our companies are at the mercy of EU privacy directives?
    Ms. Lawler. I think the companies that are looking at this 
issue have significant presence in Europe, and not just in 
Europe, quite frankly, and have fairly sophisticated groups, 
both in legal and contracts, that certainly could hold their 
own if they chose to pursue that particular route.
    I know for Hewlett Packard we made a very distinct business 
strategy decision not to get into the contracts business if you 
will. Our business, as many technology companies--business 
changes so rapidly that you are essentially in an ongoing 
contract discussion that never ends. And we didn't feel that 
was a good business model for us.
    Mr. Towns. All right. Thank you.
    Professor Reidenberg, let me say we have something in 
common. You know, I was on staff at Fordham as well, I want to 
let you know, so we have that in common.
    Now I will ask you the question. The international treaty 
that you talked about to solve the privacy issue, what is the 
timetable, the timeframe, with that? You know, because when you 
think about these kinds of things you think about, you know, 
something going on and on and it might not even happen during 
my lifetime.
    Mr. Reidenberg. I can't predict how long it would take to 
negotiate such a treaty. It certainly would not happen 
overnight. But then, if we look at the basic privacy principles 
that the United States domestically has committed to over the 
years, and those in the directive, they have been around for 30 
years. They have been pretty enduring. So my guess is it would 
take a couple of years to negotiate it.
    At the WTO, they will--as I said, I think it inevitable 
that they will have to focus on privacy in the context of the 
trade and services assessments that take place every 2 years. 
Now, whether it will be this year or next year, I couldn't tell 
you, but I think it will be imminent that this will have to be 
on the agenda.
    Mr. Towns. Thank you very much, Mr. Chairman. My time has 
expired.
    Mr. Stearns. I thank my colleague.
    Mr. Deal, you are recognized for 5 minutes.
    Mr. Deal. Thank you, Mr. Chairman.
    Well, I omitted saying at the outset thanks to all of you 
for being here. I think we have heard some very good testimony 
and certainly this panel and the preceding panel have given us 
information that is important in our deliberations.
    But I suppose always there is, from our perspective, the 
question of, what is the starting point and what is the goal? 
And I have heard very divergent goals set forth here, and I 
guess I am probably at this point in time coming down on the 
side of saying that our approach maybe should be something 
similar to what the Canadians have some, and similar to what--
the position Mr. Winer has advocated.
    And that is, once we have legislatively determined what 
standards we feel are acceptable and agreeable for our 
constituency as citizens of our country, then we then move to 
the next stage of, do our trading partners agree with that? And 
if they don't, then what modifications, if any, should we come 
to? And, of course, we have not fully come to those 
conclusions.
    And, obviously, Professor Reidenberg, I have a connection, 
too. My son-in-law is a graduate of Fordham, so we will make 
that connection.
    But, obviously, yours is a much more long-term goal of 
having something in a more international context whereby you 
would have an agreement that was enforceable. But for the 
immediacy of the problem, I think we would all recognize that 
that is fraught with great difficulties.
    Obviously, some who are members of WTO think that 
government should know everything, and some of us think they 
should know nothing. And I think it would be very difficult in 
a short timeframe to come to a standard that would perhaps be 
acceptable without major deviations from it or exceptions 
carved out of it.
    I think from my perspective, our focus should be, in the 
short term, let us decide what standards our people want, and 
then, if at all possible, try to mesh those with our trading 
partners as they now exist. If those can be done, it seems to 
me then we have a very workable base from which to move to a 
broader WTO-type concept. Am I looking at it in an unrealistic 
fashion?
    Mr. Aaron. I don't think so, Mr. Deal. I think that one of 
the difficulties that I had in negotiating the safe harbor is 
that we really didn't have anything to sort of say, ``This is 
where we are.''
    Mr. Deal. Right.
    Mr. Aaron. And so I had to kind of negotiate off of their 
sheet of music. It would have been much better for me, as well 
as I think for the country, if we had had something of our own.
    The one thing, I would make one comment about the Canadian 
rules. They are really designed--they are very much in the mold 
of the European ones, and they have very strong enforcement 
provisions. And that is the one thing that I think is going to 
be very difficult for the United States.
    We looked at this back in the 1970's, at an idea of a 
comprehensive privacy program, what the privacies are, and all 
that kind of stuff. And we came to the conclusion that this 
might well threaten people's privacy. I mean, somebody 
independent----
    Mr. Deal. We don't want to tell anybody, so he can decide.
    Mr. Aaron. Yes. I mean, this is--so that very key thing--
and that is the key thing that makes it acceptable to the 
Europeans. So we still have something resembling a square that 
needs to be circled.
    Mr. Deal. Mr. Winer?
    Mr. Winer. Yes, sir. I think if you think of the U.S. 
approach with consumer issues, it is very often an approach of 
fairness in which you want to say, ``Has the person been 
informed about what is going to happen? Has the person 
consented to what is going to happen?'' If you have got a 
situation where somebody has been informed and consented, that 
tends to be acceptable in American commercial and consumer 
context in many, many situations.
    Now, of course, there are situations at the very extremes 
where you want to go beyond that. But informed consent is the 
heart of our system, and seems to me might be a basis for 
proceeding here, sir.
    Mr. Deal. Professor?
    Mr. Reidenberg. Let me come back I think first to your 
original query. I think you are absolutely correct. We first 
have to get our house in order and deal with privacy in the 
United States.
    Part of--and I agree completely with Ambassador Aaron, part 
of the difficulty in dealing with the rest of the world right 
now is that the rest of the world is looking to Europe for 
leadership on privacy and is no longer looking at the United 
Sates. We used to be the leaders. That is no longer the case.
    So I do think we do, first, indeed have to focus on what 
are the kinds of rights for the American democracy that we need 
to protect in the context of privacy. And in that context, we 
have to do more than just give window-dressing privacy. We need 
enforceable rights that have legal remedies for individual 
citizens who are victimized. That is something that is also 
very typical in the American context.
    And I think that in this area in particular there are some 
instances where informed consent is not likely to be 
satisfactory for us. We find privacy is a political right. 
Privacy has very important political implications, and we don't 
in the United States allow selling of votes. There are 
instances where we should not be in the position of forcing 
citizens to sell their privacy so that they can get an extra 
couple of dollars off. That essentially says rich people have 
privacy and poor people don't, and I don't think, as a society, 
we should accept that in the United States.
    Mr. Deal. Thank you, Mr. Chairman.
    Mr. Stearns. I thank my colleague, and I thank panel two, 
especially for your patience in waiting when we went through 
over an hour of voting. I appreciate your attendance, and I 
thank my colleagues for staying with us. This is very nuanced 
debate that will continue.
    With that, the committee is adjourned.
    [Whereupon, at 3:13 p.m., the subcommittee was adjourned.]

```