Mr. Chairman and Members of the Committee,
 

I would like to thank you for the invitation to testify and to commend you for convening this hearing on the European Union’s Data Privacy Directive.My name is Joel Reidenberg.I am a Professor of Law and the Director of the Graduate Program at Fordham University School of Law.As an academic, I have written and lectured extensively on data privacy issues and have co-authored two books related to today’s hearing.[1]I am a former chair of the Association of American Law School’s Section on Defamation and Privacy and have also served as an expert advisor on data privacy issues for the European Commission, the U.S. Federal Trade Commission and, during the 103rd and 104th U.S. Congresses, the Office of Technology Assessment. I appear today as a scholar on data privacy law and policy and do not represent the views of any organization with which I have had affiliations.
 

My testimony will focus on four points: (1) the philosophy and content of the EU Data Protection Directive, (2) the implications of the European Directive for US privacy policy, (3) the false hope of the US-EU safe harbor agreement, and (4) recommendations for Congressional action.[2]

a)  Background and Underlying Philosophy of European Data Protection
 

While there is a consensus among democratic states that information privacy is a critical element of civil society, the United States has, in recent years, left the protection of privacy to markets rather than law.In contrast, Europe treats privacy as a political imperative anchored in fundamental human rights.European democracies approach information privacy from the perspective of social protection.In European democracies,public liberty derives from the community of individuals and law is the fundamental basis to pursue norms of social and citizen protection.This vision of governance generally regards the state as the necessary player to frame the social community in which individuals develop and information practices must serve individual identity.Citizen autonomy, in this view, effectively depends on a backdrop of legal rights.Law, thus, enshrines prophylactic protection through comprehensive rights and responsibilities.Indeed, citizens trust government more than the private sector with personal information.
 

In this context, European democracies approach data protection as an element of public law.Since the 1970s, European countries have enacted comprehensive data privacy statutes.Under the European approach, cross-sectoral legislation guarantees a broad set of rights to assure the fair treatment of personal information and the protection of citizens.In general, European data protection laws define each citizen’s basic legal right to “information self-determination.”This European premise of self-determination puts the citizen in control of the collection and use of personal information.The approach imposes responsibilities on data processors in connection with the acquisition, storage, use and disclosure of personal information and, at the same time, accords citizens the right to consent to the processing of their personal information and the right to access stored personal data and have errors corrected.Rather than accord pre-eminence to business interests, the European approach seeks to strike a balance and provide for a high level of protection for citizens.
 

b) Adoption of the Directive
 

As data protection laws proliferated across Europe during the 1980s, there were significant divergences among those laws and harmonization became an important goal for Europe.[3]In 1995, following the Maastricht Treaty of European Union, the European Union adopted Directive 95/46/EC of the European Parliament and of the Council of 24 Oct. 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data[4][the “European Directive”] to harmonize the existing national laws within the European Union.The European Directive soughtto assure that all Member States provided satisfactory privacy protection and to assure the free flow of personal information across Europe through the respect of basic, standardized protections.
 

Under European Union law, a “directive” creates an obligation on each Member State to enact national legislation implementing standards that conform to those defined in the directive.The European Directive requires that national law protect all information about an identified or identifiable individual whether or not the data is publicly available.The European Directive requires that an individual’s consent be obtained prior to processing personal information for purposes other than those contemplated by the original data collection.The European Directive allows Member States to further restrict the processing of defined “sensitive” data such as health information.[5]The European Directive restricts the collection and use of personal information not relevant for the stated purpose of processing.The processing of personal information must be transparent with notice provided to individuals for the treatment of their personal information.Organizations processing personal information must provide the data subjects with access to their personal information and must correct errors.The European Directive further requires that organizations maintain appropriate security for the processing of personal information.
 

For global information networks and electronic commerce, the comprehensive approach inevitably invokes some tension. Without the statutory authority to restrict

In terms of enforcement, each Member State must maintain an independent, national supervisory authority for oversight and enforcement ofthese privacy protections.[7]Significantly, the European Directive also mandates that Member State law require any person processing personal information to notify the national supervisory authority and the supervisory authority must keep a public register of data processors.[8]
 

c) Implementation Issues
 

The European Directive provided a transition period through October 1998 for Member States to transpose the standards into national law.However, as is not uncommon in the European system, nine Member States failed to comply strictly with the deadline.By January 2000, the European Commission began proceedings before the European Court of Justice against France, Germany, Ireland, Luxembourg, and the Netherlands for their delays in transposition.Although each of these countries had strong, existing data protection statutes, the European Commission argued that not all of the standards contained in the European Directive were satisfactorily addressed in the national laws.At present, proceedings before the European Court of Justice continue against France, Germany, and Luxembourg.
 

Notwithstanding the transposition delays, the harmonization achieved by the European Directive is significant, but does not remove all divergences and ambiguities in the European national laws..[9]By and large, the European Directive creates a strong baseline of protection across Europe.But, small divergences andambiguity will inevitably exist where the principles must be interpreted by different supervisory agencies in each of the Member States.These remaining divergences in standards can pose significant obstacles for the complex information processing arrangements typical in electronic commerce.For example, the European Directive requires that privacy rights attach to information about any “identifiable person”.[10]Yet, the scope of this definition is not the sameacross the Member States; what some Member States consider "identifiable" others do not.[11]Similarly, the disclosures that must be made to individuals prior to data collection may still vary within Europe.[12]These differences can distort the ability and desirability of performing processing operations in various Member States since potentially conflicting requirements might apply to cross-border processing of personal information.
 

The effect of this challenge to comprehensive standards is, however,mitigated by consensus building options and extra-legal policy instruments that are available in the European system.The European Directive creates a “working party” of the Member States’ national supervisory authorities.[13]The Working Party offers a formal channel for data protection officials to consult each other and to reach consensus on critical interpretive questions.

Compliance with the national laws has also been an issue in Europe.The notice and registration requirements, in particular, appear to have a spotty reception.One study conducted for the European Commission questioned whether data processors were adequately notifying their treatment of personal information to the national supervisory authorities[14] and a recent study by Consumers International found that European web sites were not routinely informing web users of their use of personal information.[15]Nonetheless, the existence of the national laws and the penalties do allow for enforcement actions to be taken in these cases of non-compliance.
 

The European Directive exerts significant pressure on U.S. information rights, practices and policies.The Directive facilitates a single information market place within Europe through a harmonized set of rules,but also forces scrutiny of US data privacy.In this context, the lack of legal protection for privacy in the United States threatens the flow ofpersonal information from Europe to the United States.At the same time, the EU Directive is having an important influence on privacy protection around the world and leaves Americans with legal protections as second class citizens in the global marketplace.
 

a) The Harmonized European Market Place
 

Despite implementation divergences, the overall harmonization effect of the European Directive creates a common set of rules for the information market place in Europe.Companies operating within the European Union have the benefit of common standards across the Member States rather than 15 diverse sets of conflicting national rules.This creates a large, level playing field for the treatment of personal information in Europe.With a high level of legal protection available on a cross-sectoral basis, Europeans do not face the same privacy obstacles for ecommerce that currentlythreaten the American experience.The culture of legal protection in Europe provides European companies with a competitive privacy advantage doing business in Europe over the many American companies that are unaccustomed to applying fair information practices to personal information.
 

b) Scrutiny of US Data Privacy and European Export Prohibitions
 

The European Directive requires the national supervisory authorities in each of the Member States and the European Commission to make comparisons between European data protection principles and foreign standards of fair information practice.[16]The European Directive further requires that foreign standards of fair information practice be "adequate" in order to permit transfers of personal information to the foreign destination.[17]
 

For the United States, this means that both national supervisory authorities and the European Commission must assess the level of protection offered in the United States to data of European origin.Because the United States lacks directly comparable, comprehensive data protection legislation, the assessment of "adequacy" is necessarily complex.The European Commission and national supervisory authorities recognize that the context of information processing must be considered to make any determination of “adequacy.”
 

Under the European Directive, the national data protection supervisory authorities and the European Commission must report to each other the non-European countries that do not provide adequate protection.This bifurcated assessment of foreign standards means that intra-European politics can play a significant role in the evaluation of US data practices.While a European level decision is supposed to apply in each Member State, the national supervisory authorities are independent agencies and will still have a degree of interpretive power over any individual case.
 

The end result for the United States and for American companies is that US corporate information practices are under scrutiny in Europe and under threat of disruption when fair information processing standards are not applied to protect European data.Some commentators have predicted that any European export prohibition might spark a trade war that Europe could lose before the new World Trade Organization.[18]While, in theory, such a situation is possible, an adverse WTO ruling is unlikely.[19]
 

c) International Influence of the EU Directive
 

Even with the difficulties of the European approach, countries elsewhere are looking at the European Directive as the basic model for information privacy, and

d) Second Class Privacy for US Citizens
 

With the imposition by the European Directive both of harmonized European legal requirements for the fair treatment of personal information and of limitations on transborder data flows outside of Europe, U.S. companies recognize that they will have to respect European legal mandates.Unless American companies doing business in Europe chose to flout European law, US multinational businesses must provide stringent privacy protections to data of European origin when processing that data in Europe or in the United States.
 

Concurrently, American law and practice allows those same companies to provide far less protection, if any, to data about American citizens.This is a particularly troubling aspect of US opposition to the European Directive’s standards.American companies will either provide Europeans with better protection than they provide to Americans or they will treat Americans in accordance with the higher foreign standards and disadvantages those citizens doing business with local US companies.
 

In effect, the proliferation of European style data protection measures around the world means increasingly that American citizens will be left with second class privacy in the United States and afforded greater privacy protection against American companies outside US borders.
 

In response to the risk that Europe would block data flows to the United States, the Department of Commerce entered into negotiations with the European Commission tocreate a ‘safe harbor’ agreement that would assure Europe of the adequacy of protection for data processed by US businesses.In the absence of statutory protection in the United States, the concept was that the European Commission would endorse a voluntary code of conduct that would meet the “adequacy” standard.American businesses could then publicly commit to adhere to this code for the treatment of European origin data and be assured of uninterrupted data flows from Europe.
 

The lengthy and troubled negotiations on the code began in 1998 between the Department of Commerce and the European Commission.Toward the end of the negotiations, several of the particularly difficult issues were the existence of a public commitment for companies adhering to the code, the access rights and enforcement in the United States.A final set of documents including an exchange of letters, the Safe Harbor Privacy Principles, Frequently Asked Questions setting out interpretative understandings of the principles, and various annexes and representations made to the European Commission by the Department of Commerce and the Federal Trade Commission (collectively the“Safe Harbor”) was released in July 2000[22] and approved by the European Commission.[23]

a) The Political Dimension
 

For the European side, the United States posed a major problem.American law did not provide comparable protections to European standards and fair information practices in the United States were rather spotty.Yet, European regulators did not want to cause a disruption in international data flows.The prospect of change in US law seemed remote and the European Commission would have serious political difficulty insisting on an enforcement action against data processing in the United States prior to the full implementation of the European Directive within the European Union.Similarly, an aggressive enforcement strategy by a national supervisory authority while transposition remained incomplete could have hampered the national legislative debates on transposition.The Safe Harbor offered a mechanism to delay facing tough decisions about international privacy and, in the meantime, hopefully advance US privacy protections for European data.
 

On the US side, the Department of Commerce faced strong pressure fromthe American business community to block the European Directive.The United States was not prepared to respond to the Directive with new privacy rights and the United States wanted to prevent interruptions in transborder data flows.The Safe Harbor became a mechanism to avoid a showdown judgment on the status of American law and defer action against any American companies.
 

As such, the acceptance in July 2000 of the Safe Harbor by the European Union was a transitory political success.
 

b) The Dubious Legality of Safe Harbor
 

In the United States, however, the Safe Harbor faces a serious jurisdictional obstacle to its enforcement—one of the key European criteria for acceptance.The Department of Commerce issued the Safe Harbor documents “to foster, promote, and develop international commerce.”[24]The agreement is predicated on the enforcement powers of the Federal Trade Commission under Section 5 of the Federal Trade Commission Act.[25]Indeed, as part of the negotiations, the Federal Trade Commission represented to the European Commission thatit “will give priority to referrals of non-compliance with safe harbor principles from EU member states.”[26]Yet, the underlying legal authority of the FTC to enforce the Safe Harbor is questionable.
 

As originally enacted by the Federal Trade Commission Act in 1914, Section 5 applied only to unfair methods of competition.[27]Jurisdiction over any “unfair or deceptive act or practice” was extended to the FTC by the Wheeler-Lea Act of 1938.[28]The stated Congressional purpose was to enable the FTC to “restrain unfair and deceptive acts and practices which deceive and defraud the public generally.”[29]Indeed, contrary to the purpose of the Safe Harbor that protects US business interests in international trade, the Wheeler-Lea Act amendments sought to protect the general public from unscrupulous business practices.In fact, at the time of the enactment, the FTC’s jurisdiction expressly excluded foreign commerce not to mention the protection of foreign consumers as envisioned by Safe Harbor.
 

While the McGuire Resale Price Maintenance Act of 1952[30] expanded FTC jurisdiction into foreign commerce with respect to monopolistic pricing,the U.S. Supreme Court had specifically held that only Congressional amendments could expand the scope of the FTC’s authority under Section 5.[31]In Bunte Bros. v. FTC, the Commission unsuccessfully sought an expansion of its interstate commerce authority in the context of anti-trust enforcement.[32]Congress eventually responded with the Magnuson-Moss Warranty -- Federal Trade Commission ImprovementAct of 1975[33] that was, according to the Senate Conference Report, designed “to improve [the FTC’s] consumer protection activities.”[34]The 1975 amendments extended the jurisdiction to acts and practices “in or affecting commerce,” but at no time contemplated protecting American business interests or foreign consumers. 
 

Hence, the assertion by the Department of Commerce and the FTC that the Safe Harbor comes within the Section 5 jurisdiction is a radical departure from the stated legislative purposes of the statute and in direct opposition to the Supreme Court’s restrictive interpretation of Section 5 authority.
 

Within Europe, the legality ofSafe Harbor is also open to question.Under the European Directive, “adequacy” must be assesed in light of the prevailing “rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.”[35]However, the Safe Harbor was not yet in existence at the time of the approval by the European Commission.The European Parliament specifically noted this problem shortly before the approval by the European Commission.[36]Similarly, according to the European Directive, the European Commission only has authority to enter into negotiations to remedy the absence of “adequate” protection after a formal finding that the non-European country fails to provide “adequate” protection.[37]Yet, in the context of the Safe Harbor negotiations, the European Commission never made a formal finding.[38]These would appear to be significant administrative law defects.Although the European Commission maintains that the European Parliament did not say that the Commission acted outside its powers and the Member States voted unanimously in the political committee to accept the Safe Harbor,[39] this administrative process problem remains an open question that only the European Court of Justice can resolve and gives the independent national supervisory authorities grounds to vitiate Safe Harbor through strict interpretations of the European Commission’s ruling.
 

In addition, the European Parliament pointed out:
 

“the risk that the exchange of letters between the Commission and the US Department of Commerce on the implementation of the 'safe harbour' principles could be interpreted by the European and/or United States judicial authorities as having the substance of an international agreement adopted in breach of Article 300 of the Treaty establishing the European Community and the requirement to seek Parliament's assent (Judgment of the Court of Justice of 9 August 1994: French Republic v. the Commission -- Agreement between the Commission and the United States regarding the application of their competition laws (Case C-327/91))”[40]
 

b) The Limited Applicability
 

Notwithstanding the validity in either legal system, the scope of the Safe Harbor is very narrow.First, Safe Harbor by its terms can only apply to activities and U.S. organizations that fall within the regulatory jurisdiction of the FTC and the Department of Transportation.As a result, many companies and sectors will be ineligible for Safe Harbor including particularly the banking, telecommunications and employment sectors that are expressly excluded from the FTC’s jurisdiction.[41]Second, the Safe Harbor will not apply to most organizations collecting data directly in Europe.Article 4 of the European Directive provides that if a data controller is located outside of the European Union, but uses equipment within the European Union, the law of the place where the equipment is located will be applicable. This provision establishes a choice of law rule that greatly reduces the availability of the Safe Harbor to international business.This provision of the Directive is especially significant in the context of web based businesses where interactive computing means that a European user will always make use of computing resources at the user’s location.The courts of Member States, such as France, have shown in other areas a clear willingness to apply the substantive law of the place where an Internet user is located.[42]Hence, in many cases, particularly in the context of ecommerce, the substantive law of a Member State will apply rather than the Safe Harbor.
 

c) Increased Risk to Non-Safe Harbor Transfers
 

By implication, the Safe Harbor raises the risks for data transfers by companies that do not subscribe to the code.The approval by the European Commission of Safe Harbor as an “adequate” basis to transfer personal information to the United States implicitly acknowledges that transfers outside the scope of the Safe Harbor will not be adequately protected.Consequently, non-Safe Harbor transfers must be covered by one of the other exceptions to the transborder data flow rules, such as a transfer pursuant to a contractual arrangement.[43]
 

Ironically, Safe Harbor simplifies the task for national supervisory authorities to block data flows to the United States.The national agencies will readily be able to identify those US companies that do not subscribe to Safe Harbor and have not presented a data protection contract for approval under the European Directive’s Article 26 exceptions.In such cases, the presumption must be that the protection is “inadequate” and the data flow must, under European law, be prohibited.
 

For the United States, the Safe Harbor approach might, thus, compromise many US businesses in a way that a legislative solution would not.
 

d)   Weakening of European Standards and Illusory Enforcement Mechanisms
 

For the national supervisory authorities in Europe, the Safe Harbor poses a weakening of European standards.[44]In particular, the permissible derogations from Safe Harbor without a loss of coverage are significant.The Safe Harbor exempts public record information despite its ordinary protection under European law.Similarly, the Safe Harbor exempts any processing pursuant to any“conflicting obligation” or “explicit authorization” in US law whether or not such processing would be permissible under European standards.The access standard set out in the Safe Harbor and FAQs also includes derogations that do not exist in European law.
 

Most importantly, however, the Safe Harbor weakens European standards for redress of data privacy violations.Under the European Directive, victims must be able to seek legal recourse and have a damage remedy.[45]The Department of Commerce assured the European Commission that Safe Harbor and the US legal system provided remedies for individual European victims of Safe Harbor violations.The European Commission expressly relied on representations made by the Department of Commerce concerning available damages in American law.[46]The memorandum presented by the Department of Commerce to the European Commission, however, made misleading statements of US law.[47]For example, the memorandum provides a lengthy discussion ofthe privacy torts and indicates that the torts would be available.The memorandum failed to note that the applicability of these tort actions to data processing and information privacy hasnever been established by US courts and is, at present, purely theoretical.Indeed, the memorandum cites the tort for misappropriation of a name or likeness as a viable damage remedy, yet all three of the state courts that have addressed this tort in the context of data privacy have rejected it.[48]The Safe Harbor is also predicated on dispute resolution through seal organizations such as Truste.Yet, only one seal organization, the Entertainment Software Rating Board, proposes any direct remedy to the victim of a breach of a privacy policy and other organizations’ membership lists look like a ‘Who’s Who’ of privacy scandal plagued companies.
 

Lastly, the enforcement provisions of the Safe Harbor rely on the FTC.Even if the FTC has jurisdiction to enforce the Safe Harbor, the assertion that the FTC will give priority to European enforcement actions is hard to believe.First, although the FTC has become active in privacy issues recently, the agency’s record enforcing the Fair Credit Reporting Act, one of the country’s most important fair information practices statutes, is less than aggressive.Second, were the FTC to devote its limited resources to the protection of Europeans’ privacy, Americans should and will be offended that a US government agency charged with protecting American consumers has chosen to commit its energies and US taxpayer money to the protection of European privacy in the United States against US businesses at a higher level than the FTC asserts for the protection of Americans’ privacy.
 

Sadly, though, for many American companies, even these weakened European standards impose substantially greater obligations than US law.In particular, the notice, choice, access and correction requirements are only sporadically found in US law.As a result, pitifully few American companies have subscribed to Safe Harbor;indeed, as of March 7, 2000 fewer than 30 companies have signed up.[49]
 

The upshot of these sui generis standards, unenthusiastic reception and enforcement weaknesses is a likelihood that the national supervisory agencies will be dissatisfied with the Safe Harbor and that the Member States will face great political pressure to suspend the Safe Harbor once transposition is completed.
 

The United States is rapidly on the path to becoming the world’s leading privacy rogue nation.Just a cursory examination of the data scandals over the last year and consumer privacy concerns for ecommerce suggest that our national policy of self-regulation will not work to assure public confidence and trust in the treatment of personal information, cannot work to guarantee citizens their political right to freedom of association and privacy, and will leave American businesses at a competitive disadvantage in the global information market place.At a time when Internet growth rates are greater outside the United States and non-US web content is becoming an absolute majority of available Internet content, United States interests are ill-served by avoiding the creation of clear legal privacy rights.

Congress needs to act to establish a basic set of legal protections for privacy in the United States.Any such regulation must recognize that technologies will be essential to assure privacy protections in the global environment across divergent sets of rules.In fact, technical decisions are not policy neutral.Technical decisions make privacy rules and, more often than not, these rules in the United States are privacy invasive.For technology to provide effective privacy protection, three conditions must be met: (a) technology respecting fair information practices must exist; (b) these technologies must be deployed; and (c) the implementation of these technologies must have a privacy protecting default configuration.Legal rights in the United States should provide an incentive structure that encourages these developments.

In conjunction with the establishment of a legal baseline in the United States, Congress should promote the negotiation of a “General Agreement on Information Privacy” within the World Trade Organization framework.[50]Whether desired or not by various interest groups and countries, the WTO will be unable to avoid confronting international privacy issues as a result of the biennial ministerial conferences and the inevitable trade-in-services agenda.Many of the core differences among nations on the implementation of privacy principles touch upon fundamental governance and sovereignty questions.These types of problems will only be resolved at an international treaty level like the WTO.