Intellectual property is related to the control of data generated by an individual and is a creative work, while privacy is concerned with the control of non-creative data, which are generated by an individual. This article will consider the links between the two concepts from a privacy professional’s perspective.

Introduction to Intellectual Property

Certain economists and privacy advocates are encouraging giving individuals property rights in their personal data, in order to promote information security. From this perspective, proponents argue that this would allow individuals to negotiate with firms regarding the uses they would agree to for their personal data. This would also force businesses and organizations to internalize a higher proportion of societal costs of processing personal data.

Regulations

In October 1998, the US Digital Millennium Copyright Act (DMCA) was signed into law. This piece of legislation implemented two 1996 World Intellectual Property Organization (WIPO) treaties, addressing a number of significant copyright-related issues. The Act effectively encouraged copyright owners to make their databases more available through digital distribution methods, by including technological protections in the form of penalties for copyright infringement, or piracy.

In January 1998, the EU’s Database Directive came into effect. This Directive provided two levels of protection:

1. It offers copyright protection for original selection and arrangement of facts in a database
2. It offers sui generis protection for non-original databases, thus prohibiting the unfair extraction of a substantial part of any database reflecting significant investment.

Essentially, a database could receive both types of protection simultaneously. It could receive copyright protection for the selection and arrangement of data, as well as sui generis protection against the extraction of a substantial part of the data. Sui generis protection lasts for 15 years, while copyright protection lasts for the life of the author, plus 70 years.

Critics Say…

While the DMCA and EU Database Directive were substantial steps towards ensuring privacy, a study of over 750 e-commerce sites in the EU and the US showed that the websites were still selling products and services to consumers in a manner that fell short of international standards. For instance, most sites would collect personal information, but fail to tell consumers how their data would be used, how security is maintained and the rights that consumers would have over their won information.

In a March 2011 White House analysis of intellectual property legislation and enforcement, entitled Administration’s White Paper on Intellectual Property Enforcement Legislative Recommendations, some trends were identified that may indicate that US governmental policy toward enforcement may be sacrificing privacy for copyright enforcement. In this analysis, the Administration recommended three legislative changes, which essentially give enforcement agencies the tools required to respond to infringement:

1. Clarify that, in appropriate circumstances, infringement by streaming, or by means of other similar new technology, is a felony;
2. Authorize DHS, and its component US Customs and Border Protection (CPB), to share pre-seizure information about, and samples of, products and devices with rightholders to help DHS to determine whether the products are infringing or the devices are circumvention devices; and
3. Give law enforcement authority to seek a wiretap for criminal copyright and trademark offenses.

The document also pointed out a number of other legislative recommendations made by the office of IP Enforcement. However, networking technologies that are needed for the advancement of communication technologies and security are making it so that such legislation is increasingly difficult to enforce. This results in more lobbyists and government officials pushing for even more stringent privacy-violating legislation.

Summary

This article takes a look at the relationship between privacy and intellectual property issues. Intellectual property is related to the control of data generated by an individual and is a creative work, while privacy is concerned with the control of non-creative data, which are generated by an individual. The article takes a look at regulations currently in effect, namely the US Digital Millennium Copyright Act (DMCA), and the EU’s Database Directive.

CIPP Exam Preparation

In preparation for the Certified Foundation Examination (Foundations), a privacy professional should be comfortable with topics related to this post, including:

• Information types – intellectual property (IP) (I.A.c.ii.4.)

Binding Corporate Rules

Binding Corporate Rules (BCRs) is a loosely defined term and relates to a concept, rather than a distinct, clearly articulated vehicle. According to the European Commission, BCRs are,

“Internal rules (such as a Code of Conduct) adopted by multinational group of companies which define its global policy with regard to the international transfers of personal data within the same corporate group to entities located in countries which do not provide an adequate level of protection.”

In practice, BCRs must contain the following elements:

1. Privacy principles (e.g. transparency, data quality, security, etc.)
2. Tools of effectiveness (e.g. audit, training, complaint handling systems, etc.)
3. An element that proves a BCR is binding

Another way of describing BCRs are as follows:

“A code of conduct setting forth the privacy policy of the entire enterprise is drafted, to which each entity included in the enterprise subscribes, enabling data subjects and other entities to enforce that code against the entity/enterprise.”

Who are they for?

BCRs may offer a viable solution for various multinational companies involved in the export of personal data from the European Economic Area to other group entities located in third countries which do not ensure an adequate level of protection.

BCRs are to be used by multinational companies to develop adequate safeguards for the protection of the privacy and fundamental right and freedoms of individuals within the meaning of Article 26 of the Directive 95/46/CE for all transfers of personal data protected under a European law. BCRs ensure that transfers of personal data are made within a group benefit from an adequate level of protection.

Global corporations have begun to take an interest in BCRs for two major reasons. First, they would like to diminish the amount of paper and effort involved to the legitimizing of their transfers. They also intend to impose less stringent requirements on their transfer activities. A number of global enterprises believe that codes of conduct should be sufficient for the cross-border transfer of personal data.

An American Perspective

From the perspective of a US-based multinational corporation (MNC), BCRs offer a number of advantages, as well as disadvantages. They are outlined as follows.

Advantages of BCRs:

• Possibility of developing a more flexible privacy regime than other methods of cross-border data transfer
• Ensure compliance with principles included in Article 25 and 26 of the European Directive 95/46 for all flows of data within the scope of the BCR
• Harmonize practices relating to the protection of personal data within a group
• Prevent the risks resulting from data transfers to third countries
• Avoid the need for a contract for each single transfer
• External communication on the company’s data protection policy
• Offer an internal guide for employees, with regard to personal data management practices
• Ensure that data protection is integral to the way the company does business

Disadvantages of BCRs:

• Uncertainty around the use of BCRs
• Reduced efficiency as a result of substituting possibly hundreds of other documents for a single document

EU Perspective

Since 2006, the EU has increased receptivity to BCRs. Its official publications indicate that it favors legitimizing this vehicle of data protection. However, in practice, it remains difficult to use BCRs for transfer from more than a single EU member state. BCRs are outlined in three documents, released by the Article 29 Working Party:

1. WP 74 – This document states that BCRs offer a viable alternative for cross-border transfer, but suggests a regime that many multinational corporations would view as so burdensome that their main incentive would not be met.
2. WP 107 – This document sets out a general procedure, under which a corporate enterprise interested in using BCRs for export from more than one EU Member State may seek to do so.
3. WP 108 – Likewise, this document clarifies what was set out in WP 74.

Summary

This article takes a look at Binding Corporate Rules (BCRs), as outlined by the EU Directive 95/46/CE for all transfers of personal data protected under a European law. The article takes a look at official as well as unofficial definitions of BCRs, the elements that consist of a BCR and US and EU perspectives on the implementation of BCRs.

CIPP Exam Preparation

In preparation for the Certified Foundation Examination (Foundations), a privacy professional should be comfortable with topics related to this post, including:

• EU Data Protection Directive – Binding Corporate Rules (BCRs) (I.D.c.i.4.b.)

European Data Protection Supervisor (EDPS)

The EDPS is an independent supervisory authority whose primary objective is to ensure European bodies and institutions respect the right to privacy and data protection when they process personal data and develop new policies. The EDPS is also responsible for advising EC institutions and bodies on all matters that have an impact on the protection of personal data. This may apply to proposals for new EU legislation, as well as other instruments, such as communications of the European Commission. Finally, the EDPS is also responsible for intervening in cases before the Court of Justice, as well as cooperating with national supervisory authorities and supervisory bodies in the “third pillar” of the EU. This is in order to improve consistency in the protection of personal data.

The main duties of the EDPS are:

I.                    Supervision

• Monitor the processing of personal data be EC institutions and bodies. This is typically done in cooperation with the Data Protection Officer (see below).
• Hearing and investigating complaints, conducting inquiries (either initiated by the EDPS, or on the basis of a complaint).
• Prior checking DPO’s notifications of processing operations, which could present risks to the data subjects.
• Provide consulting services to EC institutions and bodies on administrative measures having to do with the processing of personal data.

II.                  Consultation

• Advise all EC institutions and bodies on matters that relate to the processing of personal data.
• Intervene in cases related to data protection, before the Court of Justice.

III.                Cooperation

• Cooperate with national data protection authorities.
• Cooperate with the supervisory data protection bodies.
• Participate win regular international conferences on data protection (e.g. the European and the International Data Protection Conferences).

Data Protection Officer (DPO)

Under Regulation (EC) 45/2001, each Community institution and body must have a data protection officer (DPO). The DPO is responsible for ensuring the internal application of the Regulation, and that the rights and freedoms of the data subjects are not likely to be adversely affected by any processing operations. The DPO must also keep a register of processing operations notified by the controllers of the institution or body where he/she works.

Other DPO functions include:

• Ensuring controllers and data subjects are informed of their rights and obligations
• Carrying out inquiries, when necessary
• Notifying the EDPS of processing operations that may present specific risks
• Responding to any requests from the EDPS and cooperating with the EDPS

A full list of data protection officers is available here.

Data Controllers

The term “data controller” refers to an individual or legal person who controls and is responsible for the keeping and use of personal information on a computer, or in structured manual files. In essence, data controllers keep or process any information about living people. Any organizations that control or are responsible for personal data are also considered data controllers.

Examples of data controllers include:

• Companies
• Government departments
• Voluntary organizations
• Individuals (e.g. general practitioners, pharmacists, politicians and sole traders)

Data Processors

Data processors refer to anyone who holds or processes personal data, without exercising responsibility for/control over the personal data. In certain cases, it is possible for a single company/person to be both a data controller and data processor at the same time, in respect of distinct sets of personal data.

Examples of data processors include:

• Payroll companies
• Accountants
• Market research companies

Data Subject

The data subject refers to the person whose personal data are collected, held or processed by the data controller.

Summary

This article takes a look at the legal roles of various parties, according to the Regulation (EC) 45/2010, namely: data subjects, data processors, data controllers, data protection officers and the European Data Protection Supervisor (EDPS).

CIPP Exam Preparation

In preparation for the Certified Foundation Examination (Foundations), a privacy professional should be comfortable with topics related to this post, including:

• Processing of personal data – roles (I.A.e.)

The Adequacy Standard

The key purpose of the Directive was to harmonize EU Member States’ laws, so that each Member State could transfer data to other Member States, while still safeguarding the fundamental rights and freedoms of their citizens.  If data controllers in one State transferred data to a third country that failed to protect personal data, the State’s protection of personal data would be lost once the Member State transferred the data to the third country.

Article 25 of the Directive prohibits Member States from transferring data to a third country, unless the third country ensures an adequate level of protection. Article 26 of the Directive outlines exceptions to the requirement that a third country have adequate protection in third countries.

For example, if the laws of a third country (e.g. Canada) fails to provide adequate protection of personal data, then a data controller located in a Member State would be prohibited from transferring personal data to Canada, unless an exception happened to apply. Without this exception, a transfer of data could lead to a data or information embargo.

Data Embargos

A data or information embargo would result in serious consequences on both Member State and third country. The Member State government may be prohibited from sending information to the third country regarding individuals in that country.

For instance, a Member State might prevent a private bank in the Member State from transferring information about its customers to Canadian financial institutions. Or perhaps a Member State might prohibit a European employer from sending information about its employees to its Canadian subsidiaries.

Article 26 outlines a number of exceptions to any such data embargo. Specifically, even if a sector or activity is found to lack adequate private protection, the Directive would still permit the transfer of personal data out of the EU if:

• The party desiring to send the data has entered into a contract approved by the privacy office in the EU member country (thus committing the party to providing certain protections)
• The individual has unambiguously consented to the data transfer
• The transfer is necessary to complete a transaction
• The data are otherwise public

It’s worth mentioning that the American credit reporting industry’s privacy protections should certainly satisfy the EU Data Protection Directive. The US Federal Credit Reporting Act (FCRA) includes the types of protections that EU Member States have incorporated into their laws, namely notice to consumers and the opportunity for them to correct any incorrect or inaccurate information in their files.

Working Party

Article 29 of the Directive establishes that a Working Party will advise the Commission on data protection matters, as well as contribute to the uniform application of the national data protection measures. Essentially, the Working Party is an independent advisory group, composed of a representative from each Member State’s supervisory authority, a representative of the Community and a representative of the Commission.

The responsibilities of the Working Party include examination of Member States’ data protection laws, as well as consulting with the Commission on the level of protection available in Member States and third countries.

Adequacy and US Data Protection

The United States’ sectoral approach to data protection is derived from the American philosophy that laws should ensure citizens’ access to government, while still protecting them from government. While this enables the US to extensively regulate its public sector, it generally prevents the federal government from limiting interactions between private citizens. As a result, the US commitment to the free flow of information also favors a narrow regulatory approach to data protection.

Essentially, whether the Directive prohibits certain data transfers to the US largely depends upon what constitutes an adequate level of protection. The Directive requires a standard of adequacy that should be assessed in light of all the circumstances surrounding the transfer, yet fails to elaborate about this standard. Earlier data protection measures require a standard of equivalency, rather than adequacy.

For instance, the OECD Guidelines, as well as the COE Convention do not define or use an adequacy standard for data transfers to third countries. In the same vein, the traditional legislation of most European countries establishes a standard of equivalency, rather than adequacy.

However, since the October 2008 enactment of the European Commission’s Directive on Data protection, the Safe Harbor framework has been developed which bridges the gap between some US privacy laws and the EC’s adequacy requirements.

Summary

This article takes a look at the European Commission’s Directive on Data Protection (95/46/EC), and the establishment of the adequacy requirement, which prevents Member States from transferring data to a third country, unless the third country ensures an adequate level of protection. The Directive also explores certain related concepts, including the Working Party and data/information embargoes. Finally, the article takes a look at the US data protection approach and its ability to meet the EC’s adequacy standard.

CIPP Exam Preparation

In preparation for the Certified Foundation Examination (Foundations), a privacy professional should be comfortable with topics related to this post, including:

• EU Data Protection Directive – Adequacy (I.C.c.i.4.a.)

Safe Harbor in a nutshell
During October 1998, the European Commission’s Directive on Data Protection was enacted, prohibiting the transfer of personal data from European Union (EU) member states to non-EU nations that did not meet the privacy protection standard. In order to facilitate the transfer of information between EU-based organizations and US-based organizations, the Safe Harbor framework was developed.

US-based organizations may qualify for Safe Harbor statues in two different ways. They may join self-regulatory privacy programs following the requirements of Safe Harbor. Alternatively, they may choose to develop organization-specific self-regulatory privacy policies, in line with the requirements of Safe Harbor.

What is CARU?
In 1974, the Children’s Advertising Review Unit (CARU) was created in order to promote responsible advertising to children. CARU was developed as a component of a strategic alliance amongst the major US advertising trade associations, including the American Association of Advertising Agencies (AAAA), American Advertising Federation (AAF), Association of National Advertisers (ANA) and the Council of Better Business Bureaus (CBBB).

CARU is in charge of children’s advertising issues within the advertising industry’s self-regulation program. It assesses the truthfulness, accuracy and consistency of child-directed advertising and assists advertisers in dealing with child audiences responsibly. CARU does so by advancing compliance with its Self-Regulatory Guidelines for Children’s Advertising, the Children’s Online Privacy Protection Act of 2000 (COPPA) and other relevant laws.

The CARU Safe Harbor Program
As of January 2001, the CARU self-regulatory program was approved as Safe Harbor-compliant, under the Children’s Online Privacy Protection Act (COPPA). It was also the first such program to the FTC-approved. Organizations that comply with CARU Guidelines are also in compliance with the COPPA, thus insulated from FTC enforcement action.

Compliance with CARU’s Safe Harbor Program is dependent on the following elements:
• Adhering to the requirements in the CARU Safe Harbor Compliance Checklist
• Compliance with the CARU Self-Regulatory Guidelines for Children’s Advertising
• Review by CARU staff of the web site’s information practices; completion of Initial Website Review & Seeding form
• Continuous monitoring of web site by CARU staff to ensure compliance with the Safe Harbor framework
• Completion of CARU Self-Assessment Form and Attestation by Safe Harbor participant

CARU Safe Harbor Compliance Checklist
This checklist makes up a critical component of the Safe Harbor compliance, as discussed above. The checklist includes the Safe Harbor principles and is specific to web sites advertising to child audiences. The following elements are on the CARU Safe Harbor Compliance Checklist:
1. Provide notice
2. Obtain verifiable parental consent
3. Limit collection, use and disclosure of personal information collected from children
4. Provide access upon verification of parental identity
5. Maintain reasonable security

The elements of the checklist are explored in greater detail below:

1. Provide Notice
In accordance with the Safe Harbor principles, privacy notices should be clearly written and easily understandable. They should not contain irrelevant, confusing or contradictory statements. There are two different types of notices that are required of CARU Safe Harbor participants: a Notice of Information Practices and a Direct Notice to Parents.

The Notice of Information Practices is also referred to as the “Web Site Notice,” or “Children’s Privacy Policy.” Such a notice requires a prominent link on the site’s home page and in each area where personal information is collected from children. This notice must state all of the following information:
• Name, address, phone number and email of the operators responsible for the collection and maintenance of personal information collected from children through the site.
• Types of personal information that is collected from children.
• Identification of the means of collection of the information (i.e. directly or passively).
• How the personal information is being used, or will be used.
• If the personal information will be disclosed to third parties. If this is being done, then the notice must state the types of businesses in which third parties are engaged; the purpose of such personal information; and if the third parties are committed to maintaining the security and confidentiality of the information collected.
• An option for the parent to agree to the collection and use of the child’s information, that is not dependent on consent for disclosing information to third parties.
• The child cannot be required to disclose more information than reasonable necessary to participate in the web site activities.
• The parent has the right to review the child’s personal information, request that it be deleted, and prevent any further collection or use of the personal information.
• Procedures for the parent to review or delete their child’s personal information and prevent ongoing use or disclosure.

The Direct Notice to Parents must include the following information:
• The same information stated in the Notice of Information Practices (as listed above).
• The web site operator wishes to collect personal information from the child.
• Request for the parent’s consent to collect this personal information. This consent is required for the collection, use and disclosure of personal information.
• Methods for providing parental consent.

2. Obtain Verifiable Parental Consent
Web site operators are obliged to obtain verifiable parental consent before the collection, use or disclosure of children’s personal information. Such consent may be obtained in the following ways:
• When personal information is being collected for internal use only. In this case, email may be used to obtain parental consent. This also requires the additional steps of a follow-up email, letter or phone call to verify the consent. This method was used prior to April 21, 2002.
• When personal information is being made publicly available, such as in a chat room, message board, personal home page, profile, or email account. OR, when personal information is being disclosed to third parties.

In such cases, website operators are obliged to employ a more reliable means of securing parental consent. This may include: (a) A form with a parent’s signature through postal mail or fax; (b) A credit card number in connection with a transaction; (c) A toll-free phone number managed by trained personnel; (d) Email consent in conjunction with a digital signature from a parent; (e) Email consent in conjunction with a PIN or password; (f) Consent through a CARU-approved method. After April 21, 2002, only these methods were acceptable for securing parental consent.

3. Limit Collection, Use and Disclosure of Personal Information Collected from Children
Web site operators are prohibited from conditional a child’s participate on the basis of disclosing more personal information than is reasonably necessary to participate. The collection of personal information from a child ought to be limited to that which is reasonable for participation. For instance, a web site operator cannot offer a prize for greater disclosure of personal information. Parents should also be given the option to consent to the collection and use of their children’s personal information. They should also be permitted to prevent disclosure of such information to third party affiliates.

4. Provide Access upon Verification of Parental Identity
Upon parental request, web site operators are obliged to disclose both the type of information collected from children and the specific information that has been collected. Parents are permitted, at any time, to refuse further use or future collection of personal information from their child. They can also ensure the deletion of their child’s personal information. However, before this happens, operators must verify the identity of the parent in the same methods used for securing parental consent (i.e. those listed in “2. Obtain Verifiable Parental Consent”).

5. Maintain Reasonable Security
Web site operators are obliged to create and implement reasonable mechanisms for protecting the confidentiality, security and integrity of children’s personal information. Examples of such mechanisms include:
• Appropriately destroying unnecessary personal information.
• Limiting employee access to personal information.
• Ensuring physical security of servers.
• Encrypting data during transmission.
• Using firewalls.

Summary
This article looks at the EU-US Safe Harbor framework in light of the CARU Safe Harbor Program, which aims to protect children’s online privacy and meet the requirements of the COPPA (Children’s Online Privacy Protection Act). The CARU program is partially based on the Safe Harbor Compliance Checklist. This checklist is made of the following five elements: (1) Provide Notice; (2) Obtain Verifiable Parental Consent; (3) Limit Collection, Use and Disclosure of Personal Information Collected from Children; (4) Provide Access upon Verification of Parental Identity; and (5) Maintain Reasonable Security.

CIPP Exam Preparation
In preparation for the Certified Information Privacy Professional (CIPP) exam; the Certified Information Privacy Professional/Canada (CIPP/C) exam; the Certification Foundation (Foundations) exam; and the Certified Information Privacy Professional/Government (CIPP/G) exam, a privacy professional should be comfortable with topics related to this post, including:
• E.U. Data Protection Directive (95/46/EC) (Foundations: I.D.a.ii.2.)
• E.U. Data Protection Directive – Safe Harbor Status (CIPP/C; II.A.b.iii.)
• International Data Transfers (CIPP; II.C.e.)
• Multinational Compliance – E.U. Data Protection (CIPP; II.C.f.)
• Regulatory Authorities – U.S. Department of Commerce (CIPP; I.A.c.iii.)
• Children’s Online Privacy Protection Act of 2000; COPPA (CIPP/G; I.B.a.ii.)

Data Protection in Europe

The European Union has the most extensive and comprehensive data protection laws in the world. In 1995, the European Commission instituted their most significant body of law known as the Data Protection Directive (95/45/EC). The directive applies to all entities that process personal data in all member states of the European Union.

E.U. Data Protection Directive Privacy Principles

The Data Protection Directive outlines privacy principles for the processing of data which include:

1)  Notice– (Article 10) The data subject must be provided with the identity of the data controller, the purposes for which data is collected and third party recipients

2)  Choice– (Article 14) The data subject may object to the processing of their personal data for the purpose of direct marketing and the disclosure of data for third parties or uses.

3)  Access and Correction– (Article 12) The data subject may request to view data an entity has on record about them and rectify, erase of block the processing of data if incorrect or incomplete.

4)  Data Quality–(Article 6) Data should be processed lawfully. It should be collected and processed for specific and legitimate purposes. Data should be timely, accurate and complete. Data that is no longer necessary should be kept in a format that is not personally identifiable.

5)  Data Security– (Article 17) Appropriate steps must be taken to protect against accidental loss, and unauthorized access, use or destruction.

Enforcement

The E.U. data directive requires the creation of a National Data Protection Authority for all member states. This supervisory authority must regulate and implement data protection laws within its country as well as investigate privacy violations. Every data controller must register with a supervisory authority before processing personal data.

Onward Transfer

In order to protect personal data when transferred to countries outside the European Union, the Data Protection Directive prohibits onward transfer to entities in non-member states unless they meet an equivalent level of protection. Agreements like Safe Harbor between the United States and the E.U. allow businesses to participate in a program that allows unrestricted international data flow as long as a businesses institutes similar privacy principles to those of the E.U.

The Data Protection Directive also has special regulations for the transfer of sensitive data such as racial or ethnic origins, political or religious beliefs, sexual orientation, trade union membership and other similar characteristics. The E.U. requires explicit, affirmative consent from a data subject in order to disclose sensitive information to third parties, not matter whether the third party is within or outside the European Union.

Privacy and Electronic Communications Directive

In 2003, the Directive on Privacy and Electronic Communications Directive (2002/58)was developed to complement the Data Protection Directive. It deals specifically with data protection and with regard to marketing messages and the growing use of digital technology and electronic communications. The Privacy and Electronic Communications Directive requires explicit consent from a data subject to send marketing messages unless all of the following criteria are met:

1)  The provider already has information on the data subject on file from a previous service or transaction

2)  The marketing message is in relation to similar services or products

3)  The data subject is given the opportunity to opt-out of further marketing messages.

The E-Privacy Directive also places restrictions on the use of marketing messages through telemarketing, automated telephone calls and faxes. The directive also requires a mechanism to opt-out of the use and receipt of cookies.

Data Protection in Canada

Canada is one of the countries closest to the European Union in terms of comprehensive  information privacy law. It uses a coregulatory framework between the government and the privacy sector to enforce data protection.

The Privacy Act of 1983

The Privacy Act of 1983 regulates the use of personal information by the Canadian Federal Government. The Privacy Act requires:

• Notice– the data subject must be notified of the information collected and its uses
• Access– a data subject has the right to view what personal information is held by a government institution and rectify erroneous information
• Consent–  data subject must provide explicit consent before information is disclosed to parties outside the control of a government institution (with a few exceptions)
• Limited Use– collected information must directly relate to the activities of a government program and may only be used for the purposes it was originally collected (with a few exceptions)
• Enforcement– the Privacy Commissioner of Canada must investigate and complaints it receives regarding privacy violations to data subjects.

The Personal Information Protection and Electronic Documents Act

PIPEDA deals with information privacy in the private sector of Canada which includes financial and health institutions. It protects all information that may identify an individual used in the course of rendering commercial services including those of nonprofit organizations.

PIPEDA incorporates the ten privacy principles outlined by the Canadian Standards Association which include: Accountability, Identifying Purposes, Consent, Limiting collection, Limiting use, disclosure and retention, Accuracy, Safeguards, Openness, Individual Access, Challenging compliance. PIPEDA requires explicit consent from individuals in order to use, process or disclose their personal information (with a few exceptions)

PIPEDA is enforced through the Office of the Privacy Commissioner of Canada or similar territorial privacy commissioners. The Commissioner is required, by PIPEDA, to investigate any privacy complaints lodged against a commercial institution and create a report of their findings.The report is sent to the organization against whom the complaint was filed with recommendations. The report is also returned to the complainant who can then pursue the matter further in the Federal Courts.

Data Protection in Asia

Data Protection across Asia is varied depending on the development and political beliefs of each country, however even counties that grant the least amount of protection have shown a concern for Data Protection and the way it affects the free flow of information.

Japan and the Law Concerning the Protection of Personal Information

Data Protection in Japan is covered under the Law Concerning the Protection of Personal Information. It was put into effect in 2005. Enforcement is regulated by ministries of each industry sector (i.e.: Ministry of Health enforces the Law in the Health industry) Each industry may place additional restrictions on the use of personal information.

Like many data protection laws, Japan’s Law requires specific and limited use of information, adequate data security and integrity, data subject notice of purpose of use, as well as access to and correction of information held by an institution. One major different in Japan’s Law is in their policies regarding disclosure. Explicit consent is required for all disclosure of information to third parties, even if the third party is affiliated with the data controlling entity.

The Asia-Pacific Economic Cooperation

APEC is a non-binding cooperative agreement between countries along the coast of the Pacific to facilitate regional trade. In 2004, APEC developed a Privacy Framework, recognizing the need for strong data protection laws to allow multinational and international business and trade to continue. Members of APEC include: Australia, Canada, Chile, China, Japan, Peru, Russia, the United States, as well as others.

APEC’s Privacy Framework outlines 9 privacy principles:

1)  Preventing Harm– Above all privacy regulations should prevent harm to data subjects from the unauthorized or misuse collection, use or disclosure of personal information.

2)  Notice– An individual should be notified regarding the personal information including what, why, how and to whom their information is collected, used or disclosed. They must also be given the choice and means to limit the use and disclosure of their information

3)  Collection Limitation– Collected information should be used for specific and limited purposes.

4)  Uses of Personal Information–Person Information should be collected with consent of the data subject and when necessary to render a service or transaction

5)  Choice– Individuals must be provided with unambiguous mechanisms to control the collection, use and disclosure of their personal information.

6)  Integrity of Personal Information– Personal Information should be complete, timely and accurate

7)  Security Safeguards–Safeguards should be created to protect against data loss as well as unauthorized, access, use, disclosure, destruction and other misuses.

8)  Access and Correction– Individuals must be able to obtain the personal information a data controller may hold about them in a timely and reasonable manner and be allowed to challenge the accuracy of the information.

9)  Accountability– Entities controlling personal information must be accountable for complying with privacy principles.

APEC is non-binding which means that there is no single supervisory authority for enforcing compliance in member states. Each member state is responsible for creating and enforcing their own information privacy regulations that adhere to the APEC Privacy Framework.

Data Protection in Latin America

Like, Asia, data protection in Latin America is inconsistent. However, many Latin American countries along the Pacific are members of APEC and comply with the APEC Privacy Framework. Furthermore, many countries have included some forms of data protection in their constitutions under the writ of Habeas Data

Habeas Data

Habeas Data literally translates to “[we command] you have the data.” It protects the right of an individual file complaints to a constitutional court regarding violations to their image, honor, privacy, and freedom of information. Legally this has translated to information privacy regulations for the government. Often similar regulations have been extended to the private sector. Habeas Data requires that an individual be able to view information on record about their person and correct any false information. Furthermore it holds a data controlling entity accountable for the integrity of data. The 1988 Brazilian Constitution was the first to include the writ of Habeas Data.

Argentina

Argentina is the only Latin American country considered adequate under the E.U. Data Protection Directive. The Argentine Constitution contains the writ of Habeas Data. In 2000, a comprehensive data protection law called the Personal Data Protection Act was implemented to protect personal data in both the public and private sector.

Under the Act, data must be collected for “certain, appropriate, pertinent and not excessive” purposes and must be collected lawfully. Data must be accurate, complete, secure and destroyed once it is no longer necessary for the purposes it was originally collected. Furthermore any activities surrounding personal data must receive explicit consent from the individual with a few specific exceptions (section 5).

The Act also prohibits the creation of files linking sensitive data with identifiable individuals and requires that no person may be compelled to share sensitive data. Much like the E.U. Data protection directive, the Act requires other countries to have adequate levels of protection before transferring data.

Chile

In 1999, Chile was the first Latin American country to implement a data protection law.  Chile uses a comprehensive law called The Law for the Protection of Private Life to govern the public and private sectors. While the Law guarantees the rights of a data subject’s to access, correction, notice, and judicial control, there is no supervisory authority and compliance is largely self enforced. Furthermore, the Law provides no protection for international transfers.

Paraguay

Paraguay includes Habeas Data in Article 135 of its constitutions which states:

“Everyone may have access to information and data available on himself or assets in official or private registries of a public nature. He is also entitled to know how the information is being used and for what purpose. He may request a competent judge to order the updating, rectification, or destruction of these entries if they are wrong or if they are illegitimately affecting his rights.” Paraguay also has its own privacy law to govern information privacy during the course of commercial business. Additionally it protects sensitive data and economic status information by requiring explicit, written consent of the data subject unless it is required by law.

In Conclusion

As technology progresses and the unrestricted flow of information across borders becomes increasingly important, countries will no longer have the luxury of avoiding data protection. In order to protect the data of their citizens, governments like the E.U. and Argentina require similar levels of protection when they transfer their information to other countries. To allow such trade to continue, countries around the globe must implement privacy policies of their own and consider how they will protect the information of their citizens as well as the personal information they receive through onward transfer. With the growth of electronic technology, information privacy has become an international issue that cannot be ignored.

CIPP Candidate Preparation

In preparation for the Certified Information Privacy Professional exam, a privacy professional should be comfortable with topics related to this post including:

• Privacy and Data Protection Regulation (Foundations: I.F.b.ii-v.) including Europe, Canada, Asia and South America

What is Safe Harbor?

In 1995, the E.U. implemented a comprehensive law, the Data Protection Directive, which created strong standards and principles governing the use and protection of data. Any data transferred within the E.U. or the European Economic Area would be protected under the law. However, personal data transferred to other countries would not be guaranteed the same protection. The Data Protection Directive restricts the transfer of data with other countries unless they meet a comparable level of data protection.

Data protection in the United States, which is more commonly known as information privacy, is governed by a number of sectoral laws that protect data within specific industries, ie: HIPAA protects personal health information, FACTA protects personal information in the financial sector. The U.S. has no central or comprehensive data protection regime and therefore, the E.U. finds data protection in the U.S. to be inadequate.

To facilitate unrestricted, data transfer between the United States and the European Union, the Safe Harbor agreement was created to allow U.S. companies the opportunity to raise their level of data protection and achieve “adequate” status, thus meeting the restriction rules for onward transfer to third parties under the E.U. Data Directive.

The Benefits of Safe Harbor Compliance

In 2000, when the Safe Harbor agreement was developed between the E.U. and the U.S., data transfers accounted for over $ 300 Billion dollars in trade. Safe Harbor allows such exportation and importation of data to continue while still protecting the personal data of European citizens. Though the Safe Harbor agreement requires stricter privacy standards for U.S. companies, than is required by U.S. law it is really to the benefit of both sides that such an agreement exists.

Participating U.S. companies enjoy the privilege of the Safe Harbor Agreement which demands that all E.U. member states allow unrestricted data transfers with any and all Safe Harbor certified participants. This means that certified companies may not be denied transfers by individual data controllers or Data Protection Authorities according to their own agendas.

Furthermore, complaints brought against a U.S. entity by European citizens regarding the protection of their personal data are heard in U.S. courts and the Safe Harbor program is under U.S. enforcement.

Safe Harbor also eliminates the need, or grants automatic approval for, data transfers creating a more cost and time efficient system. Companies may choose not to join the Safe Harbor agreement and make individual agreements or model contracts with a Data Protection Authority, but this may increase the time and energy needed to allow for the unrestricted transfer of data.

How Does a Company Become Safe Harbor Compliant?

The Safe Harbor program is voluntary. In order to participate, an entity must complete a self certification process annually with the Department of Commerce. To do this a company may join a self regulatory privacy program such as the BBB online, which audits companies to review their privacy policies and business operations to provide certificates of compliance with Safe Harbor. Or an entity may choose to create their own self-regulatory privacy policy which adheres to all Safe Harbor principles. Furthermore, the entity must publicly state in their privacy notice that they are Safe Harbor compliant.

The Safe Harbor Principles

The following principles must be included in a Safe Harbor compliant privacy policy.

Notice

• The data subject must be notified about the purposes for which personal information is collected and used.
• The data subject must be notified about contact methods to file inquiries and complaints.
• The data subject must be notified about the types of third parties to whom personal information may be disclosed.
• The data subject must be provided with their choices and means of limiting disclosure of their personal data.
• Notice should be provided at the time when information is first collected or shortly thereafter and must be provided before data is processed or disclosed.

Choice

• The data subject must be able to opt-out of third party disclosures.
• The data subject must be able to opt-out of secondary usage of information.
• The data subject must give affirmative consent (opt-in) for the disclosure or use of sensitive information.

Onward Transfer

• All third parties to whom data may be transferred must follow the Safe Harbor principles or Data Directive compliant. The same level of protection must be guaranteed no matter how many times data is transferred.

Security

• Entities that process data in any stage of its life cycle (collection, use, analysis, storage) must take reasonable measures to protect against data loss, destruction, misuse and unauthorized access.

Data Integrity

• Data may only be processed or used as it is related and proportional to the purposes for which it was originally collected.
• An entity should take reasonable steps to ensure data is accurate, timely and complete.

Access

• Data subjects must be able to view the information an organization holds about them.
• Data subjects must be able to correct, add to, or delete inaccurate information.

Enforcement

• A recourse mechanism must be in place for data subjects to file complaints, have disputes investigated, and resolved.
• An entity must have a mechanism to verify that the stated privacy policy and business operations are compliant with the Safe Harbor agreement. Audits should be completed annually.
• It is the obligation and responsibility of the entity to remedy any problems with compliance in a timely fashion.

Enforcing Safe Harbor

U.S. compliance with Safe Harbor is largely self regulated. Entities may choose to complete self verification of compliance and investigate complaints internally. Companies also have the option of using private, third party dispute resolution mechanisms, that have gained a reputation of trustworthiness to verify their compliance and investigate disputes.

Some well known, third party dispute resolution service providers include:

• The Better Business Bureau Online
• The Direct Marketing Association
• The Entertainment Software Rating Board

Third party dispute resolution providers are self regulated and not certified by the Department of Commerce or the FTC. Therefore, it is the legal responsibility of the entity to choose a program that is Safe Harbor compliant.

Though, Safe Harbor has not been strictly enforced in the past, there are regulations within the privacy and trade law to punish violators. Misuse of the Safe Harbor agreement can qualify as “unfair or deceptive trade practices” under Section 5 of the Federal Trade Commission Act. The FTC may take action against offenders including conducting formal hearings, and issuing cease and desist or temporary restraining orders. Failing to comply with an FTC order may carry a penalty of up to $11,000 for every day of continued violation and any entity that knowingly violates an FTC rule may be subject to the same penalty.

Safe Harbor in the News

Historically, the FTC has done very little to enforce Safe Harbor compliance. However, that has begun to change. In August 2009, the FTC publicly announced a suit against a California based company, Balls of Kryptonite, which purposely misled UK consumers to believe it was an E.U. company by using a .co.uk domain address. Furthermore, the company stated in its privacy policy that it was Safe Harbor compliant though no certification had ever been filed.

Then, in October 2009, the FTC filed settlement complaints against six multinational companies that had lapsed in their compliance but failed to alter their privacy policies to notify data subjects of the change. The recent enforcement has sent the message to business owners that the FTC may no longer rely on private, self-regulation to provide adequate enforcement. Since Safe Harbor compliance requires a public statement in privacy notices stating participation in the program, the FTC needs only to compare their current list of Safe Harbor participants with the privacy notice of an entity to gain evidence of unfair or deceptive trade practices. There is also speculation that the audits may be conducted in the future for companies with current certifications, to verify full compliance with all Safe Harbor regulations.

Data protection, especially with regard to onward transfer, continues to remain a significant issue in International politics. In the first week of November 2009, the United States and European Union, recognizing the weaknesses in current regulation, joined together to create a common set of principles to govern the transfer of personal data. That same week, privacy representatives from around the world met in Madrid for the International Data Protection and Privacy to create a universal standard of privacy and data protection, in the hopes of eventually creating a universal data protection law.

In Conclusion:

Companies wishing to conduct legal and successful business on a multinational level must be concerned with the protection of data both when it is transferred to and from the United States. Agreements, like Safe Harbor, allow the United States and the European Union to continue a mutually beneficial trade relationship, however, the agreement alone does not guarantee data protection. Participating U.S. companies need to ensure Safe Harbor compliance to build trust in their organization, as well as in the program to allow such agreements to continue in the future, despite the differing approaches the U.S. and the E.U. take regarding data protection.

CIPP Candidate Preparation

In preparation for the Certified Information Privacy Professional exam, a privacy professional should be comfortable with topics related to this post including:

• The Collective View of Privacy Principles (Foundations I.E) including Notice, Consent, Access, Security, and Quality
• Privacy and Data Protection Regulation (Foundations: I.F) including Onward Transfer, Safe Harbor, and the E.U. Data Protection Directive