Data Protection: EU/US negotiations continue

The Safe Harbor principles issued by the US represent a set of standards which US industry can adhere.

The Safe Harbor principles come under the following headings:

1. Notice

An organisation must :

 

1. inform individuals about the purposes for which it collects information about them,
2. permit the subject to contact the organisation with any enquiries or complaints,
3. give information on the types of third parties to which it discloses the information,
4. must inform as to the choices and means the organisation offers individuals for limiting its use and disclosure.

 

2. Choice

An organisation must offer individuals the opportunity to choose whether and how personal information they provide is used or disclosed to third parties.Where such use is incompatible for the purpose for which it was originally collected or with any purpose disclosed to the individual in a notice.

 

3. Onward Transfer

An organisation may only disclose personal information to third parties consistent with the principles of notice and choice.

 

4. Security Organisations creating, maintaining, or using or disseminating personal information must take reasonable measures to assure its reliability for its intended use and reasonable precautions to protect it from loss, mis-use and unauthorised accesses, disclosure, alteration and destruction.

 

5. Data Protection

The organisation may only pass this personal information relevant to the purposes for which it is gathered. The organisation should take reasonable steps to ensure that data is accurate, complete, and current.

 

6. Access

Individuals must have reasonable access to personal information about them. The individual must also have the possibility of correcting or amending information which is inaccurate.

 

7. Enforcement

Any mechanism employed by a business enterprise must include mechanisms for assuring compliance with the Safe Harbor principles. At a minimum, such mechanisms must include ready available and affordable independent recourse mechanisms for dispute resolution, follow up procedure, and obligations to remedy problems arising out of failure to comply. Sanctions must be sufficiently rigorous to ensure compliance by organisations.

The European Commission is currently considering the US text.

Primary indications are that they consider the provisions as a significant improvement on previous versions.

For further information, please contact A & L Goodbody.

This article was intended to provide general guidelines. Specialist advice should be sought about specific facts.