U.S. plans series of 'safe harbor' briefings

From...

by Margret Johnston

(IDG) -- The U.S. Department of Commerce has signed up only 12 companies and organizations so far for its hard-fought "safe harbor" protections on data privacy, but government officials Thursday said they believe a series of planned seminars will increase the number and bolster the protections' legitimacy.

Experts from the U.S. government and the private sector will lead the seminars, which are designed to inform companies about safe harbor protections and advise them on how to develop privacy policies necessary to become eligible to enter the safe harbor.

Safe harbor went into effect Nov. 1 and is designed to provide some legal protection to U.S. companies and organizations that, as part of their European operations, gather personally identifiable data about people living there, including employees and customers. Safe harbor is designed to adequately meet the European Union's 1998 data privacy directive, which is more stringent than current U.S. privacy law.

	MESSAGE BOARD
Security on the Net

No major Internet or high-tech companies are among the 12 organizations that have been certified. The most noteworthy names on the list are Dun & Bradstreet, whose business involves collecting, selling, and maintaining business-centric data from numerous clients worldwide, including many in Europe, and TRUSTe, a nonprofit privacy watchdog organization.

"We need more than 10 or 12 and we hope to increase that number," Michelle O'Neill, deputy assistant secretary for information technology at the Commerce Department, said at a Thursday briefing. "This is a tough agreement to swallow, but we want to get the message out, especially to small business."

IDG.net INFOCENTER IDG.net's main page Free daily newsletters Instant help from the Dummies Network Computerworld Communities Related IDG.net Stories FTC seeks input on new data privacy guidelines 'Safe harbor' takes effect, but adoption may be slow European official: 'Safe harbor' deal doesn't fully bridge data privacy divide Features Cool gifts for cool nerds! Your complete guide to broadband DSL bloodbath continues Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com SunWorld IDG.net search

O'Neill stopped short of saying how many companies the department hopes to sign up.

One reason companies are not being certified is that they want to make sure they have considered all possible scenarios, especially those concerning liability, before they sign on the dotted line, said Lauren Hall, executive vice president of the Software and Information Industry Association (SIIA). There are a number of SIIA members that are very close to becoming certified under the safe harbor program, Hall added.

"We are confident that we can raise the profile of the safe harbor over the next several months and encourage companies to look at it carefully and give them the information that they need to make a good decision," Hall said. "For some of them, there are better solutions."

Another reason companies are not entering safe harbor is because they are not ready to endorse it, and because the EU data privacy directive has no authority beyond Europe, said Timothy Deal, senior vice president of the U.S. Council for International Business, in Washington.

The SIIA, the U.S. Council for International Business and the Washington, D.C., law firm Morrison & Foerster will participate in the seminars, the first of which is scheduled to take place Jan. 25 in Palo Alto, Calif. The other two will be held Feb. 7 in New York City and Feb. 14 in Dallas. The Commerce Department has set up a Web site that provides extensive information about safe harbor and includes a form that companies can use to certify themselves.

Under safe harbor, EU countries accept the notion that organizations that are certified are bound to adhere to seven principles, the most important of which are: notice, so the individual knows that data is being collected; access, so that the individual can view the data; and refusal, the ability to refuse to allow the data to be collected. Some European officials have been skeptical that safe harbor will be effective because of complicated provisions dealing with redress.

The Commerce Department and the European Union needed more than two years to negotiate the protections, culminating last July when the European Commission said it recognized safe harbor as adequate protection for EU citizens' privacy under the EU's data directive. The safe harbor agreement does not apply to financial services, however financial service companies can still voluntarily agree to sign up.

Expanded privacy rules perpetuate debate
January 2, 2001
FTC seeks input on new privacy guidelines
December 21, 2000
Toysrus.com faces online privacy inquiry
December 14, 2000
Mobile commerce vendors tackle privacy concerns
December 12, 2000
German officials warn of Net 'Big Brother'
December 8, 2000

FTC seeks input on new data privacy guidelines
(Computerworld)
'Safe harbor' takes effect, but adoption may be slow
(Computerworld)
European official: 'Safe harbor' deal doesn't fully bridge data privacy divide
(Computerworld)
EU gives final OK to U.S. safe harbor privacy plan
(IDG.net)
Net-privacy law is only a matter of time
(Network World Fusion)
Talking about wireless privacy
(The Industry Standard)
Senator takes aim at e-commerce data-sharing effort
(Computerworld)
Canadian privacy law raises ante
(Computerworld)

Commerce Department

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.