A breakthrough came with the recognition by the Commission and the member states that self-regulation can provide effective privacy protections. At the outset, the concept of self-regulation was no pun intended foreign to the EU privacy experts. They saw self-regulation as the fox guarding the chicken coop. I have had to explain how our various self-regulatory codes are backed up by state and federal fraud statutes and the Federal Trade Commission. Self-regulation is embedded in our law through prohibitions on deceptive business practices.
Violators can be and have been successfully prosecuted.
Moreover, the trade and professional associations that develop self-regulatory codes can subject outlaws to professional ostracism and potentially ruinous adverse publicity. Based on the progress we made in our discussions, we advanced a proposal that we believe bridges our different systems. Each organization subscribing to the safe harbor principles would be presumed to be providing adequate privacy protections. Data transfers from the European community to them would continue. Enforcement would include a dispute resolution process, backed up by existing strong legal sanctions against U.S. violators, as administered by the Federal Trade Commission and other state and Federal agencies with authority to act against unfair and deceptive practices.