Globalization and Social Protection: the Impact of EU and International Rules in the Ratcheting up of U.S
Total Page:16
File Type:pdf, Size:1020Kb
Articles Globalization and Social Protection: The Impact of EU and International Rules in the Ratcheting Up of U.S. Privacy Standards Gregory Shaffert INTRODUCTION ............................................................................................................................................ 2 I. EU DATA PRIVACY RULEs AND THEIR IMPACT ON BusiNESs .................................................. 10 A. Trading Up in the European Union: The Link Between DataPrivacy Protection and EU Trade Liberalization....................................................................................... 10 B. Rights and Obligations: The EUDirective's Regulatory Controlsover Data Processing.............................................................................................. ..... ... 13 C. Privacyat a Price: The Costs ofEURequirements on European Business Operations ........................................................................................................................17 D. ExportingPrivacy Protection: The EU's Threat To Ban Data Transfers to the United States....................................................................................................... 21 . I. U.S. DATA PRIVACY PROTECTION: DOES IT FAIL To MEET THE EU DIRECTIVE'S CRITERIA? .. 22 A. U.S. ProtectionsAgainst DataProcessing by Government ........................................ 23 B. U.S. ProtectionsAgainst Data Processingby the PrivateSector .............................. 24 C. Problems with the Public-PrivateDistinction .............................................................. 28 D. Alternative Institutions: The Interactionof US. Markets, Legislatures,and Courts in RegulatingPrivate Sector Use of PersonalData ..................................................... 30 1. Role of Markets ................................................................................................ 30 2. Role ofLegislation ........................................................................................... 33 3. Role of Courts .................................................................................................. 36 E. The Limits of Single JurisdictionalAnalysis: The Need To Account for TransnationalInstitutional Interdependence ............................................................... 37 III. THE TRANSATLANITIC CONTEXT: MANAGING THE CONFLICT OVER PRIVACY .......................... 39 A. PoolingSovereignty To Bolster Market Power: The Role of the EUMarket .............. 39 B. Public andPrivate: The Multiple Means To RestrictData Transfers to the United States................................................................................................................................. 42 C. Conflict Management: U.S.-EU Negotiations over Adequacy ..................................... 44 f Assistant Professor of Law, University of Wisconsin Law School. An earlier version of this Article was presented at the Structure and Organization of Government Conference held at the University of Wisconsin-Madison on April 24, 1999. Thanks to Colin Bennett, Peter Carstensen, Fred Cate, Howard Erlanger, Henry Farrill, John Kidwell, Neil Komesar, Joel Reidenberg, Marc Rotenberg, Gerald Thain, Frank Turkheimer, and Eric White for their comments on earlier drafts. Thanks also to Nicholas Long and Matthew Kim-Miller, who provided me with invaluable research assistance. Yet despite the help, all errors, of course, remain my own. THE YALE JOURNAL OF INTERNATIONAL LAW [Vol. 25: 1 IV. THE SUPRANATIONAL CONTEXT: THE CONSTRAINTS OF INTERNATIONAL TRADE RULES .............46 A. WTO Constraintson the European Union: Claims That the EUDirective Violates W TO R ules ........................................................................................................................46 B. Why the United States Should Not Prevail.................................................................. 49 C. A Focus on Process:The EUDirective Under the WTO's New Criteria..................... 52 D. Reinforcinga Trading Up: WTO Rules as an EU Shield ............................................54 V. THE EU DIRECTwE'S EXTRA-JURISDICTIONAL EFFECTS IN THE UNITED STATES: CHANGING THE STAKES OF DOMESTIC PLAYERS ......................................................................................55 A. Enhanced U.S. Regulatory Efforts ..............................................................................56 B. An Opportunityfor PublicAdvocacy Groups and PrivacyService Providers........ 63 1. The Role ofPrivacy Advocates .......................................................................64 2. The Role of PrivacyService Providers........................................................... 66 C. U.S. Business Under the Gun: Business Reactions to EUPressuresfor Privacy P rotection ..........................................................................................................................70 1. Business Organization,Protest, and Development of Codes .........................70 2. Caughtin a Bind: Businesses 'Support and Wariness of the Departmentof Commerce's Approach..................................................................................... 74 3. Privacy ProtectionImported: Spill-Over Effects of U.S.-EUNegotiations on U.S. Business Practice................................................................................ 78 VI. CONCLUSION: TRADING UP-THE FACTORS THAT FACILITATE RAISING U.S. DATA PRIVACY STANDARDS ....................................................................................................................80 INTRODUCTION Almost daily we are subject to phone calls, mail, or electronic communications from organizations trying to sell us services or solicit our money. How do they get our numbers? How do they learn our habits? Who is compiling, selling, and swapping information about us? It has been estimated that, on average, companies trade and transfer personal information about every U.S. resident every five seconds How may we review and control the use of this data when technological advances permit rapid, low-cost compilation, storage, and transfer of personal data? Much of the compilation and transfer of personal information that is a daily occurrence in the United States is illegal in Europe. On October 24, 1998, European Union (EU) Directive 95/46/EC on the Protection of Individuals with Regard to the Processing of Personal Data and the Free Movement of Such Data ("EU Directive")2 became effective. The EU 1. See JEFFREY ROTHFEDER, PRIVACY FOR SALE 17 (1992) (noting that "there are upwards of five billion records now in the United States that describe each resident's whereabouts and other personal minutiae"). Since the publication of Rothfeder's book in 1992, the frequency of transfer of personal information is likely much greater, given advances in technology. Technological advances permitting rapid, low-cost compilation, storage, and transfer of personal data are a central cause of threats to personal privacy. The impact of technological change on data privacy protection has been addressed in many works, a summary of which is provided in PRISCILLA REGAN, LEGISLATING PRIVACY: TECHNOLOGY, SOCIAL VALUES, AND PUBLIC POLICY 10-15 (1995). 2. Parliament and Council Directive 951461EC of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995 O.J. (L 281) 1 [hereinafter EU Directive]. Although the EU Directive was adopted and published in the Official Journal of the European Community on October 24, 1995, pursuant to article 32(1) of the EU Directive, it did not become effective until "a period of three years from the date of its adoption".-. that is, on October 24, 1998. Id. The term "European Union" (EU) is used in this Article, as opposed to the term "European Community" (EC). The name of the regional European entity has changed over time as Europe has 2000] Globalizationand Social Protection Directive mandates significant regulatory controls over business processing and use of personal data. The EU Directive also provides that the European Commission may ban data transfers to third countries that do not ensure "an adequate level of protection" of data privacy rights.3 The United States has taken an ad hoc, patchwork approach to data privacy protection, which does not appear "adequate" under the EU Directive's criteria.4 United States governmental representatives have reacted vehemently5 to the prospect of a European ban on data transfers to the United States. integrated. Originally, the term used was the European Economic Community (EEC), formed pursuant to the 1957 Treaty Establishing the European Economic Community, Mar. 25, 1957, 798 U.N.T.S. 11 ("EEC Treaty"). The Treaty of European Union (TEU) of 1992, Feb. 7 1992, O.. (C 224) 1, [1992] 1 C.M.L.R. 719, changed the name of the European Economic Community to the European Community, to designate that the European Community had integrated beyond purely economic matters. The TEU also created three separate pillars of activities for the regional bloc. The first pillar concerned all traditional EC matters, as expanded by the TEU to cover European economic and monetary union in particular. The second and third pillars (respectively named Common Foreign and Security Policy, and Justice and Home Affairs) concerned matters not previously within the competence of the EC institutions. The term that encompasses all three pillars is the European Union (EU). Technically, the EU Directive was