Source: http://djilp.org/5003/one-size-wont-fit-all-multinational-corporations-compliance-with-privacy-regulations-part-1-of-3/
Timestamp: 2019-04-21 05:18:58+00:00

Document:
Part 1: What Does “Privacy” Mean?
This is the first post in a three part series examining the issues multinational corporations face in complying with privacy regulations in the U.S. and abroad. This post will explore privacy generally by analyzing privacy as the concept is understood and applied in the European Union, in China, and in the United States. The second post will review two case studies to introduce specific issues multinational corporations have run into in attempting to comply with the three privacy regimes described in the first post. The third post will provide recommendations on privacy strategies companies can implement to mitigate some of the issues identified in the second post. These posts do not attempt to provide an exhaustive list of privacy issues multinational corporations encounter, but they are intended to show the importance of privacy concerns and to highlight the need to confront compliance issues in a proactive manner.
The amount of personal data that is available via the internet is astounding, and that data is valuable. Stores are eager to employ “predictive analytics” in order to understand “not just consumers’ shopping habits but also their personal habits, so as to more efficiently market to them.” The more information a store can obtain about an individual, the easier it is to send them individualized advertisements geared specifically to that person’s needs. For instance, it is now possible, based off consumer purchasing habits, to track an individual’s pattern of purchases and predict when that individual is experiencing a major life change. Once an individual’s purchasing patterns change, the company can respond with targeted advertising to the changed circumstances. Another example is how GPS information in your car has the potential to be shared with businesses to provide targeted advertisements for nearby restaurants.
Although businesses are eager to use information on consumer habits, many people view this kind of information gathering and dissemination as an invasion of privacy. Unsurprisingly, legislators in the U.S. have sought to introduce laws curtailing the ability to collect consumer information without the consumer’s permission. But laws aimed at protecting consumer information must first answer a fundamental question: what exactly is “privacy”? Although it is beyond the scope of these posts to provide an exhaustive list of the ways in which scholars have defined “privacy,” it is important to understand the context in which debates over privacy occur in order to better understand the conflicts multinational corporations face in complying with differing privacy regimes.
The definition of privacy has greatly expanded since The Right to Privacy was first published. One scholar has recently claimed that “[c]urrently, privacy is a sweeping concept, encompassing (among other things) freedom of thought, control over one’s body, solitude in one’s home, control over information about oneself, freedom from surveillance, protection of one’s reputation, and protection from searches and interrogations.” Other interests identified as falling under the privacy umbrella include the protection of consumer data, credit reporting, workplace privacy, discovery in civil litigation, the dissemination of personal images, or shielding criminal offenders from public exposure.
Privacy is so broad because “[c]onceptualizing privacy not only involves defining privacy but articulating the value of privacy. The value of privacy concerns its importance – how privacy is to be weighed relative to other interests and values.” Such a balancing of competing interests contemplated by the term “privacy” is going to depend on the cultural and historical context in which the interests are examined. For example, a right to privacy for most Americans would include the right to choose the names of their children without any interference. In contrast, it is permissible for French and German courts to determine that a name given to a newborn is contrary to the child’s best interests. Similarly, Americans cleave tightly to the notion that a “broadly defined freedom of the press assures the maintenance of [America’s] political system and an open society.” In China, in contrast, the notion of an independent press is absent; the majority of “print media, broadcast media, and book publishers were affiliated with the [Chinese Communist Party] or a government agency.” Whether privacy means ensuring parents’ ability to name their own children or the right to an independent press, how privacy is defined is largely dependent on cultural influences.
Same Principle, Different Approaches: Privacy in the E.U., China, and the U.S.
Privacy in the E.U. is further protected as a result of the adoption of Directive 95/46/EC of the European Parliament and of the Council (“E.U. Directive”). The E.U. Directive creates a legal floor for the minimum amount of privacy protection member states must afford to their citizens, and it specifically limits processing of personal data. Significantly, the E.U. Directive allows member states to craft laws penalizing parties for non-compliance with its provisions and laws ensuring that processing personal information is only permissible after the subject “unambiguously” gives his or her consent.
Just as the development of privacy law in Europe was governed by Europe’s historical social context, so too has America’s privacy been determined by its unique social history. Conceived in the context of overthrowing the monarchical control Britain held over its colonies, it is no surprise that privacy in the U.S. is rooted in a deep mistrust of the government. Therefore, the primary privacy concern of Americans might be generalized as protection of the sanctity of the private home against government interference. Because such a privacy concern is defined broadly, U.S. approaches to privacy have focused on specific remedial efforts rather than comprehensive action.
In contrast to the omnibus approach of the E.U. toward privacy protection, the U.S. has adopted a sectoral approach to privacy regulation. The sectoral approach places significance on industry self-regulation while trusting to case law and highly specific legislation to protect particular aspects of privacy law. For example, U.S. Supreme Court cases have recognized a right to privacy regarding family planning and intimacy as “penumbras” emanating from the Bill of Rights despite the lack of an enumerated right of privacy. Industry self-regulation must give way, however, when Congress perceives a failure on the part of industry to adequately protect privacy. Although there are many examples of interest-specific protections, such as the Health Insurance Portability and Accountability Act, one example of specific legislation with particular importance to these posts is the Sarbanes-Oxley Act (“SOX”).
Although SOX amended many government statutes, of primary concern here is the Whistleblower Protection for Employees of Publicly Traded Companies provision. The whistleblower provision delivers employees a cause of action against employer retaliation for the employee’s disclosure of the employer’s illegal conduct. Further, SOX amended the Securities and Exchange Act of 1934 to require procedures for receiving whistleblower complaints and ensuring that whistleblowers are able to make communications in a confidential, anonymous manner.
The Chinese Constitution provides citizens with privacy protections by stating that the “personal dignity,” residence, correspondence, and ability to criticize the government are given to the people. In the case of correspondence, the Constitution permits the suspension of private communication “to meet the needs of State security.” China’s General Civil Code also provides for certain privacy protections, including the “right of portrait,” the use of which without the owner’s permission is not permitted. However, despite the promise of these privacy rights, they are frequently violated. As a condition of foreign companies operating in China, the Chinese government requires compliance with its monitoring activities.
The interests protected under the term “privacy” will vary between jurisdictions because of unique historical and social contexts. The E.U.’s omnibus approach to privacy protection traces its inception to the need to protect human dignity, which is furthered only if people have access to and control over their personal information. In contrast, the sectoral approach adopted in the U.S. is the offspring of a mistrust of government intervention; the government should not be permitted to intrude into a citizen’s homes or intrude in how companies operate, so long as companies are acting fairly. China, like the E.U., has adopted an omnibus privacy regulatory scheme, but the protections enumerated in its laws are frequently in conflict with the government’s censorship regime. Although derived from cultural and ideological differences, the differing interests protected by the various privacy regimes have practical consequences for companies operating in multiple jurisdictions. The next post in this three part blog series will use two case examples to illustrate the issues companies must face in operating in the global economy.
Greg Henning is a 3L at the University of Denver Sturm College of Law and a General Editor for the View From Above.
 Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193, 197 (1890).
 See id. at 195 (internal citations omitted).
 Daniel J. Solove, Conceptualizing Privacy, 90 Cal. L. Rev. 1087, 1088 (2002).
 See James Q. Whitman, The Two Western cultures of Privacy: Dignity Versus Liberty, 113 Yale L.J. 1151, 1156 (2004) (referring to the types of interests European privacy laws seek to protect) (internal citations omitted).
 See Helen Nissenbaum, Privacy as Contextual Integrity, 79 Wash. L. Rev. 119, 156 (2004) (“[N]orms of privacy in fact vary considerably from place to place, culture to culture, period to period . . ..”).
 Time, Inc. v. Hill, 385 U.S. 374, 389 (1967).
 Country Reports on Human Rights Practices for 2012: China (Includes Tibet, Hong Kong, and Macau), U.S. Dept. of State (last visited Feb. 17, 2014), http://www.state.gov/j/drl/rls/hrrpt/humanrightsreport/index.htm?year=2012&dlid=204193.
 See Whitman, supra note 5, at 1165.
 See Council Directive 95/46/EC, art. 13 1995 O.J. (L 281) 31, 42.
 Charter of Fundamental Rights of the European Union, art. 8, 2000 O.J. (C 364), 1, 10.
 See Whitman, supra note 5, at 1211.
 See Anna E. Shimanek, Do You Want Milk With Those Cookies?: Complying with the Safe Harbor Privacy Principles, 26 J. Corp. L. 455, 465-66 (2001).
 Griswold v. Connecticut, 381 U.S. 479 (1965).
 Lawrence v. Texas, 539 U.S. 558 (2005).
 See Griswold, 381 U.S. 479, 484.
 See 15 U.S.C. § 78j-1 (2010).
 See Ann Bartow, Privacy Laws and Privacy Levers: Online Surveillance Versus Economic Development in The People’s Republic of China, 74 Ohio St. L.J. 853, 855 (2013).
 See Country Reports on Human Rights Practices for 2012: China (Includes Tibet, Hong Kong, and Macau), U.S. Dept. of State (last visited Feb. 17, 2014), http://www.state.gov/j/drl/rls/hrrpt/humanrightsreport/index.htm?year=2012&dlid=204193.
 See David Scheffer & Caroline Kaeb, The Five Levels of CSR Compliance: The Resiliency of Corporate Liability Under the Alien Tort Statute and the Case for a Counterattack Strategy in Compliance, 29 Berkeley J. Int’l L. 334, 389-90 (2011).

References: v. 
 art. 13
 art. 8
 v. 
 v. 
 § 78