Business proposes privacy safeguards for data flows to and from EU
 |
| Looks great - but how is the data to be safeguarded ? |
Brussels, 24 September 2001 - International business has asked the European Commission to approve contractual safeguards for data flows between the EU and the rest of the world that would avoid imposing what they regard as excessive obligations on companies.
Seven associations representing a broad cross-section of business interests submitted alternative model contract clauses to EC Internal Market Commissioner Frits Bolkestein that would remedy perceived defects in the Commission's own standard clauses, which provide a legal basis for transferring personal data outside the EU.
Speaking for the International Chamber of Commerce (ICC), one of the signatories of a joint letter delivered to Mr Bolkestein, data protection lawyer Christopher Kuner said: "We appreciate all the work the Commission has done, but their clauses impose responsibilities on data importers and exporters which exceed the 'adequate level of data protection' required in the EU Data Protection Directive for international data transfers". Mr Kuner participated in the drafting of the alternative clauses.
Business associations backing the joint appeal are: ICC, the Federation of European Direct Marketing (FEDMA), the EU Committee of the American Chamber of Commerce in Belgium (Amcham), the Japan Business Council in Europe (JBCE), the Confederation of British Industry (CBI), International Communications Round Table (ICRT), and the European Information and Communications Technology Industry Association (EICTA).
The EC Commission has said that adoption of its standard clauses does not affect the authorization of other standard contractual clauses. This cleared the way for business lawyers to draft alternative clauses that they are convinced provide the "adequate level of protection" that the European authorities seek.
Amcham's Pascale Gelly said: "Development of e-business in a global economy requires that businesses should be free to exchange data, including personal data, about their employees, customers, and prospects outside their own country's borders.
"At the same time, privacy must be adequately respected. To achieve that, we have proposed a set of contractual requirements bearing on exporters and importers that conform fully to the EC directive on data protection. We are satisfied that they secure the interests of the data subjects without impairing business efficiency."
The alternative clauses are intended to provide just as high a level of data protection as the Commission's clauses, but using more flexible mechanisms that reflect business realities. For example, the clauses provide an alternative to the "joint and several liability" regime - or shared liability between exporters and importers - contained in the Commission's clauses, and include a "due diligence" responsibility on
exporters in dealing with importers. A further safeguard allows exporters to carry out audits to check that data supplied is not being misused.
Mr Kuner said the fact that so many business associations from around the world had joined forces in submitting the alternative clauses to Commissioner Bolkestein was a measure of the importance of a workable EU privacy regime for the world economy.
"Business today is global, and companies all over the world need a workable legal regime for data transfers. If the only alternative open to companies is too expensive and burdensome, then they will hesitate to use them, which would both stifle business activity at a time of economic crisis, and deprive consumers of the privacy protection they need."
Proposed standard contractual clauses for the transfer of personal data from the EU to Third Countries
Letter to Commissioner Frits Bolkestein
ICC Commission on Telecommunications and IT