|
The European Union Privacy Directive
In October, 1998, the European Union (EU) adopted the Directive on Data Protection which sets forth strict rules for companies which handle personal data about EU citizens. This restriction includes US companies because of a small provision which prevents the transfer of data to any country which does not have "an adequate level of privacy." The US and EU are currently in discussions over how to best resolve the situation in which a ban on enforcement of the noted provision has been postponed numerous times. The US is seeking to allow industry to self-regulate, however, there have not been sufficient advances in its development to alleviate the EU's concerns about privacy abuse.
Specifically, the EU Directive includes the following elements:
- Companies must notify both employees and consumers about how information collected about them will be used;
- Companies can only use data for its intended purpose;
- Companies cannot transfer data on employees and consumers to countries with inadequate privacy protection laws;
- Consumers will have a right to access data collected about them;
- Consumers will have a right to have inaccurate data rectified;
- Consumers will have a right to know the origin of data about them (if this information is available);
- Consumers will have a right of recourse in the event of unlawful processing of data about them;
- Consumers will have a right to withhold permission to use their data (e.g. the right to opt-out of direct marketing campaigns for free without providing a reason);
- Companies need explicit permission of consumers to process sensitive information, including information on racial origin, political or religious beliefs, trade union membership, medical data, and sexual life.
According to Gerard de Graaf, a member of the European negotiating team with the US, "We would not accept a situation where the only way to deal with a problem is to sort it out with the company that is the root of the problem in the first place." In addition to enforcement, recent reports suggest that the EU and US currently disagree about the amount of access customers should have to the data companies have collected about them.
The US is currently seeking a self-harbor approach in which individual companies can protect themselves from prosecution by taking certain steps to protect consumer data. If the two governments are unable to reach a compromise, however, the EU could threaten the US with sanctions that could destablize trade relations which currently exceed $300 billion per year.
