European privacy commissioners are skeptical that either the United States or Canada have the needed adequate protections addressing the transfer of personal data to private-sector recipients. Although all the details have not been worked out, the CSA code would provide the floor by which private sector privacy codes would be measured. In other words, the CSA code, which is a good solid piece of privacy policy already, would be the minimum standard to measure the performance of private industry. Industry groups could adopt tougher protections, but could not offer less than the CSA code. Probably the federal privacy commissioner and the various provincial commissioners would be charged with monitoring performance and helping to hold industry accountable to the code.
Judicial remedies are also likely to be available.
The United States is moving much more cautiously, but there are some developments that could help it pull itself up. While Canadian Justice Minister Allan Rock was telling the International Conference of Data Commissioners at their meeting last September in Ottawa that Canada would have legislation in place by the year 2000, Sally Katzen, head of the Office of Information and Regulatory Affairs at the U.S. Office of Management and Budget told the same group that the sectoral approach was the position of choice for the United States. One American attendee at the conference said Katzen's speech sounded like one he had heard four years earlier during the Bush administration. However, there is an American initiative coming out of the Federal Trade Commission. Commissioner Christine Varney, something of a protege of President Clinton, has supported the idea that the FTC could use its statutory authority to police unfair business practices as both a carrot and a club in convincing business to provide adequate privacy protections.