Live From Strasbourg: Outcome of Privacy Talks Still Uncertain
The outcome of the current EU, U.S. talks on the EU’s data-protection directive, and of the so-called safe harbor measures put forward by the Americans, is still uncertain, Alastair Tempest, director general of Fedma public affairs and self-regulation, said during a press conference Monday at the Federation of European Direct Marketing’s annual conference in Strasbourg, France.
“The Americans put forward what seemed to be a compromise but there are still major problems and disagreements,” especially in the area of consumer access to their personal data, Tempest said. American companies are worried that they may leave themselves open to lawsuits, he added.
The directive forbids companies in EU countries to export personal data to outside countries that are deemed not to have adequate privacy protections. It is generally assumed that the United States falls under that category. The most important aspect of the safe harbor solution is that the directive could be complied with if an EU company and a U.S. company (or any company outside the EU) sign contracts assuring that the data are secure and treated properly.
Tempest said that there are, to his knowledge, three different model contract proposals, the most recent one from the International Chamber of Commerce, on which the European authorities released comments last week. He added that, in his opinion, there would end up being more than one model contract used.
Like all EU directives, the data-protection directive, often called the privacy directive, mandates the EU member nations to make laws complying with it. At this point, only six of the 15 member nations have passed privacy laws and some of those are not up to compliance with the directive. But four countries seeking to become EU members–Poland, Hungary, Slovenia and the Czech Republic–have passed such laws.
Tempest worried that the slow compliance by the European nations might lead U.S. companies to believe that they have no need for urgency. “We’ve been lucky that no one’s brought a court case,” he said, meaning that no European individual has sued an American company for violation of privacy rights, which would force the issue.
