The principles' basic rule is opt-out. Of interest to the health community is that information about medical or health conditions is defined as sensitive information. Consequently, health organizations wishing to comply with the principles will have to extend opt-in privileges to all Europeans from whom they collect data. As noted above, the Safe Harbor agreement applies only to personal data of Europeans. Data is to be protected against loss, misuse and unauthorized access, disclosure, alteration, or destruction.
Individuals have the right to access and to correct inaccurate information.
These components are at least intended to be relatively severe. Complying organizations must agree to recourse to third parties to resolve disputes, to damages where applicable law or the private sector initiative invoked so provides, to follow-up procedures for verifying compliance with privacy practices, and to acknowledge their obligation to remedy failures to comply with the principles. Apart from the general provisions, the principles include the following rules that both tighten and loosen their application to medical data. Second, medical and pharmaceutical research data is generally covered by the principles, requiring users of such information from Europe to adhere. U.S health institutions that use European data are likely to find themselves compelled to adhere to the principles.