Protection of personal data: adequacy of the US safe harbor privacy principles

PURPOSE: Adoption of a Commission Decision on the adequacy of the US Safe Harbor Principles. CONTENT: Art. 25 of Directive 95/46/EC (the Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data) lays down the principles underlying the transfer of personal data to third countries. It states that the Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection. Para. 6 of Art. 25 allows the Commission, assisted by a Committee - composed of the representatives of the Member States and chaired by the representative of the Commission - to find that a third country ensures an adequate level of protection. This finding allows personal data to be transferred from the Member States without additional guarantees being necessary. It is desirable, when that is justified, to make such positive findings in order to provide legal certainty and to simplify procedures for controllers intending to transfer data to third countries. For the same reason, these findings should, if possible, cover all the activities falling within the scope of the Directive. This includes telecommunications, for which the Directive is particularised and complemented by Directive 97/66/EC. Art. 25, para. 2, of Directive 95/46/EC deals with the determination of adequacy: it requires that the level of data protection be assessed in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations and that particular consideration be given to the nature of the data, the purpose and duration of the proposed processing operation(s), the country of origin and final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country. Given that the different approaches to data protection in third countries, the adequacy assessment has to be carried out and any decision based on Art. 25 para. 6 has to be enforce in a way that does not arbitrarily or unjustifiably discriminate against or between third countries where like conditions prevail nor constitute a disguised barrier to trade taking into account the Community's present international commitments. The US Government Dept. of Commerce has issued the so-called 'Safe Harbor Privacy Principles' for the protection of personal data transferred from a Member State to the US, and a set of Frequently Asked Questions (FAQs), annexed to the proposed Decision, providing guidance for the implementation of the Principles. Adherence to the Principles is entirely voluntary, but in order to obtain and retain recognition that they provide an adequate level of protection for the transfer of data from the EU to the US, as provided for by this Decision, organisations must comply with the Principles, publicly disclose their privacy policies and be subject to the jurisdiction of theFederal Trade Commission (FTC) under Section 5 of the FTC Act which prohibits unfair or deceptive acts or practices in or affecting commerce, or that of another statutory body that will effectively ensure compliance with the Principles. The FTC Act empowers the FTC to obtain injunctive relief against unfair or deceptive practices, as well as redress for citizens of the US and of other countries and, in carrying out its statutory enforcement responsibilities within the area of its jurisdiction, the FTC has indicated its readiness to investigate complaints, irrespective of the nationality or country of residence of the complainant. The jurisdiction of the FTC is subject to a number of statutory limitations, but in respeect of some of the excluded sectors, the Principles will be enforces by the government bodies in the US (listed in Annex 3 of the Decision), in the areas of their respective competence. Sectors and/or data procession not subject to the jurisdiction of the government bodies in the US listed in Annex 3 fall outside the scope of this Decision. To ensure the proper application of this Decision, it is necessary that organisations adhering to the Principles can be recognised by interested parties, such as data subjects, data exporters and data protection authorities and, to this end, the US Dept. of Commerce or its designee has undertaken to maintain and make available to the public a list of organisations self§certifying their adherence to the Principles and falling within the jurisdiction of at least one of the government bodies listed in Annex 3. This Decision concerns only the adequacy of protection provided in the US under the Principles with a view to meeting the requirements of the Directive's Art. 25, para. 1,. It does not affect conditions or restrictions implementing other provisions of the Directive that pertain to the processing of personal data within the Member States. In the interests of transparency and in order to safeguard the ability of the competent authorities in the Member States to ensure the protection of individuals as regards the processing of their personal data, the Decision specifies exceptional circumstances in which the suspension of specific data flows may be justified, notwithstanding the finding of adequate protection. The 'Safe Harbor' created by the Principles, underpinned by well-established government and private sector mechanisms in the US, represents an innovative approach which may need to be reviewed in the light of experience and of developments concerning the protection of privacy in circumstances in which technology is constantly making easier the transfer and processing of personal data. Where there has been a suspension of data flows, the suspension shall cease as soon as compliance with the Principles is assured and the competent authority concerned in the EU is notified thereof. Member States must notify the Commission without delay if a suspension takes place, and the Member States and the Commission shall also inform each other of cases where the action of bodies responsible for ensuring compliance in the US fails to secure such compliance. If there is evidence that any body responsible for ensuring compliance with the Principles in the US is not effectively fulfilling its role, the Commission shall inform the US Dept.of Commerce and, if necessary, present draft measures in accordance with the procedure established by Art. 31 of the Directive with a view to reversing or suspending the present Decision or limiting its scope.�