Privacy & Information Security Law Blog : Privacy Lawyer & Attorney : Hunton & Williams Law Firm : Personal Data, Information Security

The comments went on to state that accountability can only be effective for the private sector if the government is held to similar requirements with respect to its own protection and use of data.
The Centre’s ten recommendations are:

1. The Department of Commerce should represent the United States in global privacy discussions;
2. The Department of Commerce should continue to support development of policy frameworks that will support the global flow of data;
3. The government should articulate a vision for innovation and privacy in the information economy;
4. Information policy must have a home within the government;
5. Both industry and government must be accountable for its use of information;
6. Federal privacy law must pre-empt state law;
7. U.S. privacy policy should focus on successful privacy results rather than on procedures that do little to enhance privacy;
8. Preventing harm must remain a significant feature of the U.S. approach to privacy;
9. The Department of Commerce should undertake an initiative to develop privacy norms that apply to data analytics; and,
10. Privacy oversight and enforcement are best carried out by regulatory agencies with authority over specified industry sectors.

View the Centre’s full response to the Department of Commerce’s notice of inquiry and supporting documents, filed June 14, 2010.

In the 1990’s, during the Clinton Administration, the Department of Commerce led U.S. efforts to develop policy related to privacy on the Internet and encouraged the development of online privacy policies and privacy seal programs.  Within the Department, the National Telecommunications and Information Administration (“NTIA”) authored numerous privacy position papers, and the International Trade Commission (“ITA”) negotiated the U.S.-European Union Safe Harbor Framework.  During the Bush Administration and the first year of Obama’s tenure, however, the Department was largely silent on privacy issues. 

Beginning last fall, the Department began holding sessions to investigate the effectiveness of privacy protections in the United States and the impact of privacy regulation on businesses.  The sessions were led by Marc Berejka, Senior Policy Advisor in the Secretary’s Office at the Department of Commerce, and Danny Weitzner, Associate Administrator for the NTIA’s Office of Policy Analysis and Development.  Over the past few months, the Department, in conjunction with NTIA and ITA, formed the Internet Policy Task Force and issued a notice of inquiry to discuss the “nexus between privacy policy and innovation in the Internet economy.” 

Last Friday’s day-long symposium included an introductory discussion on the global Internet economy and privacy that was followed by four panel discussions.  Professor Fred Cate, Senior Policy Advisor with the Centre for Information Policy Leadership and Distinguished Professor of Law at Indiana University Law School, set the stage for the first panel on “Privacy, Innovation and Global Trade.”  The participation of other Obama administration officials indicated that the Department is not alone in these efforts.  White House Deputy Chief Technology Officer Andrew McLaughlin led a panel on “Privacy Frameworks and Innovative Uses of Personal Information,” and Deputy Assistant Secretary of State and U.S. Coordinator for International Communications and Information Policy Phil Verveer spoke on the “Privacy on the Ground” panel.
 
The Department of Commerce will be receiving comments until June 7, 2010, on the notice of inquiry it issued on April 20, 2010.  A draft paper is expected in early October, ahead of the Organization of Economic and Cooperation and Development’s conference on privacy and technology, and the 32nd International Data Protection and Privacy Commissioners Conference, both of which will take place in Jerusalem during the last week of October.

The European Union Data Protection Directive requires EU Member States to implement legislation that prohibits the transfer of personal data outside the EU unless the EU has made a determination that the laws of the recipient jurisdiction are substantially equivalent to those of the EU, and thus provide “adequate” protection for personal data.  Because the EU has determined that laws of the United States do not meet its adequacy standard, the U.S. Department of Commerce and the EU developed the Safe Harbor Framework, which went into effect in November 2000.  The Safe Harbor Program allows participating U.S. companies under the jurisdiction of the FTC or the U.S. Department of Transportation to transfer personal data lawfully from the EU.  To join the Safe Harbor, a company must self-certify to the U.S. Department of Commerce that it complies with seven principles that have been deemed to meet the EU’s adequacy standard.  To maintain its certification to the Safe Harbor program, a company must re-certify on an annual basis that it continues to comply with the seven principles. The Department of Commerce maintains a list of all currently-certified companies.

The proposed FTC settlement agreements highlight that companies certified to the Safe Harbor program should verify that their certifications remain current.  If companies wish to cease Safe Harbor membership, their representations, including those in website notices and marketing materials, should be promptly updated to avoid deceptive representations to consumers.  In all cases, the defendant companies had let their memberships lapse; exhibits to the FTC's complaints included pages from their websites, in which the companies continued to purport Safe Harbor membership.

The European Union Data Protection Directive requires EU Member States to implement legislation that prohibits the transfer of personal data outside the EU unless the EU has made a determination that the laws of the recipient jurisdiction are substantially equivalent to those of the EU, and thus provide “adequate” protection for personal data.  Because the EU has determined that laws of the United States do not meet its adequacy standard, the U.S. Department of Commerce and the EU developed the Safe Harbor Framework, which went into effect in November 2000. The Safe Harbor Program allows participating U.S. companies under the jurisdiction of the FTC or the U.S. Department of Transportation to transfer personal data lawfully from the EU.  To join the Safe Harbor, a company must self-certify to the U.S. Department of Commerce that it complies with seven principles that have been deemed to meet the EU’s adequacy standard.  A company under the FTC’s jurisdiction that self-certifies to the Safe Harbor principles but fails to implement them may be subject to an enforcement action under Section 5 of the FTC Act, which prohibits deceptive trade practices. 

In this case, the FTC successfully argued that, regardless of the company’s data protection practices, falsely claiming to be Safe Harbor certified could constitute a violation of the FTC Act in and of itself.  The defendants have been ordered to appear on September 25, 2009 to show cause why the court should not enter a preliminary injunction prohibiting further violations.