Description

On July 1, 2001, the European Commission was scheduled to
complete a one-year review of how well non-European companies were
complying with the European Union's Directive on Data Protection.
More important, that date was also supposed to mark the end of an
informal standstill on enforcement of the directive's restrictions
on cross-border data flows. Both the report and the end of the
enforcement moratorium have been postponed, but for how long is
uncertain.
The EU directive is designed to regulate the transfer and use of
personal data about European citizens. One facet of that regulation
is a prohibition on the transmission of personal data to countries
outside Europe that lack "adequate" data protection laws. If
strictly enforced, that prohibition could harm businesses and
consumers on both sides of the Atlantic.
The EU-U.S. Safe Harbor agreement seeks to bridge the gap
between the top-down European data protection regime and the more
decentralized U.S. approach. Although Safe Harbor is still in its
infancy, its survival is already in doubt. Few companies have
signed up. Meanwhile, the EU continues to develop model privacy
contracts that may further undermine the usefulness of the Safe
Harbor framework.
At best, Safe Harbor faces an uncertain future. The United
States should recognize that Europe has the right to set its own
privacy policies but not be pressured into copying the EU's unwise
data protection model. Relying on technology and market incentives,
rather than regulation, to protect privacy empowers individual
consumers to make their own choices, encourages new business and
innovation, and protects free speech. The United States should
stick to that course regardless of what Europe does. At the same
time, however, if European law is enforced in such a way as to put
U.S. companies at an unfair disadvantage--which is entirely
possible--the United States should not hesitate to defend its
interests through the dispute resolution mechanism of the World
Trade Organization.