DATA DOGFIGHT: U.K. processors warn DMers: You can’t ship names to the U.S.

A potentially nasty dispute has broken out between the British and American DM industries over the exact terms of the European Union’s new data protection directive. The question is: Can data on U.K. consumers be shipped to the United States at all?

The answer is no, according to British data processors and suppliers.

“Customers of U.S. data processors in the United Kingdom are being approached by U.K. data processors and told that they can’t send their data to the United States for processing anymore,” says Charles Prescott, vice president of international business development and government affairs for the U.S. Direct Marketing Association. “That’s simply false. The legal situation is being misrepresented.” But British sources maintain that their interpretation is correct, as Prescott found out when called the British DMA to complain about this “false advertising.” found out when he called the British DMA to complain about this “false advertising.”

Prescott says, “They told me it was true. I said it wasn’t. I reminded them that they have substantial U.S. members. They said, `Maybe we’ll take a look at it.'”

Both sides may be right. Prescott is correct that this provision has not yet taken effect in the United Kingdom, and that in any event the issue probably will be resolved through negotiations now under way between the United States and the European Commission.

On the other hand, the EU’s data directive seems fairly clear on the surface. The United Kingdom, which has had its own laws since 1985, will introduce the updated EU regulations next March.

“To transfer data outside the European Union, adequate safeguards have to be in place,” says Nicola McGilligan, international officer at the U.K. data protection registrar’s office. “They have to reach a certain level, and in the United States there is no federal data protection law.”

The effect of the directive could be to prohibit the sending of mailing lists for processing or management in the states. Even worse, it may forbid the sending of transactional and business data, including credit card transactions and airline bookings.

British sources acknowledge that some U.K. list firms have advised clients not to use American-held or processed files. “Even people who are trying to adhere to the legislation may be falling short,” says one source.

This source adds that data users face double jeopardy on the issue. Not only may the transfer itself be illegal, “the data may not have been processed in a way that would meet other requirements,” he says.

For example? “If the merge/purge is not good because an American bureau can’t match data on seven-line addresses very well, then the match against the Mail Preference Service will not be good,” the source explains. Suppressing names on the MPS file is now a statutory requirement in Britain, whereas in the United States it’s a condition of DMA membership.

But Prescott counters that the U.S. and U.K. DMAs have each other’s MPS files, and that there “a number of data processors that, as a matter of course, will match the files. They have the technical capability to do it accurately and correctly.”

In an effort to avoid a trade conflict over the issue of data shipment, the European Commission is in discussions with the U.S. Federal Trade Commission. One way out might be to grant the United States safe-harbor status. “That may fall short of the standard of the European directive, but it does offer an adequate level of protection,” says McGilligan.

Because of holiday schedules, safe-harbor negotiations were put on the back burner during the summer, but Prescott and others expect a quick resolution. In the interim, something of a gray area exists, since technically data transfers are in breach of the new law.

Even some U.S. sources agree that the data can’t be sent – at least without safe-harbor standing. “You can’t transfer personal identifiable data outside the European Union without the approval of the EU,” says Marty Abrams, vice president for information policy and privacy at Experian. (Experian is not directly affected by the issue because it does not transfer personally identifiable data from Europe to the United States).

One way around the data-transfer issue is to draw up a special contract.

McGilligan says this must commit the American supplier to the same provisions that exist under European law. But within the list industry there is concern that anybody can sign a contract which might subsequently prove to be invalid. Abrams agrees. “The contracts guarantee that the protection of the U.K. law would attach itself to the data – the guarantor is the party doing the transferring,” he says.

Sample contracts are now in the process of being created, according to Prescott.

He adds that there are “critical exceptions to the absolute prohibition on transfer – for example, if the mailer needs to process data to fulfill an order for a customer.”

Meanwhile, British direct marketers have their own worries. Some are troubled by the powers given to the data protection registrar in the U.K. to act against offenders.

Data protection registrar Elizabeth France has the authority to issue an enforcement notice, or to invalidate the registration of the offending company, which would then be unable to use personal data of any sort. Or, she could hand down a transfer prohibition notice. This would prevent the data user from transferring personal data overseas if that transfer is likely to lead to the law being broken. Failure to comply would be a criminal offense.

There are no signs that she is moving against international list and data users. But until it is resolved at the highest level, what comes back through the mail might not be customer orders but a summons to appear in court.