Feeds

Microsoft exec says Safe Harbor framework is 'alive and well'

Privacy critic: 'It's dead. We just forgot to bury it'

Reducing the cost and complexity of web vulnerability management

CPDP Privacy advocates have expressed concern about Brussels' Commissioner Viviane Reding's decision to leave in place the Safe Harbour framework used by some companies to transfer data from Europe to the US.

The EC's vice president tabled her draft bill for the overhaul of the EU's 1995 data protection law on Wednesday.

However, critics have questioned how the Safe Harbour scheme can remain workable within the wider context of the commissioner's DP legislation proposals.

EU data protection laws currently state that organisations must tell people when they are asked to disclose their personal information. Some companies that meet the requirements of Europe's DP directive are allowed to transfer EU data to the US.

Microsoft is one of them.

Reding's proposals state:

Article 41 sets out the criteria, conditions and procedures for the adoption of an adequacy decision by the Commission, based on Article 25 of Directive 95/46/EC. The criteria which shall be taken into account for the Commission’s assessment of an adequate or not adequate level of protection include expressly the rule of law, judicial redress and independent supervision. The article now confirms explicitly the possibility for the Commission to assess the level of protection afforded by a territory or a processing sector within a third country.

Article 42 requires for transfers to third countries, where no adequacy decision has been adopted by the Commission, to adduce appropriate safeguards, in particular standard data protection clauses, binding corporate rules and contractual clauses. The possibility of making use of Commission standard data protection clauses is based on Article 26(4) of Directive 95/46/EC. As a new component, such standard data protection clauses may now also be adopted by a supervisory authority and be declared generally valid by the Commission. Binding corporate rules are now specifically mentioned in the legal text. The option of contractual clauses gives certain flexibility to the controller or processor, but is subject to prior authorisation by supervisory authorities.

Article 43 describes in further detail the conditions for transfers by way of binding corporate rules, based on the current practices and requirements of supervisory authorities.

Article 44 spells out and clarifies the derogations for a data transfer, based on the existing provisions of Article 26 of Directive 95/46/EC. This applies in particular to data transfers required and necessary for the protection of important grounds of public interest, for example EN11 EN in cases of international data transfers between competition authorities, tax or customs administrations, or between services competent for social security matters or for fisheries management. In addition, a data transfer may, under limited circumstances, be justified on a legitimate interest of the controller or processor, but only after having assessed and documented the circumstances of that transfer operation.

Article 45 explicitly provides for international co-operation mechanisms for the protection of personal data between the Commission and the supervisory authorities of third countries, in particular those considered offering an adequate level of protection, taking into account the Recommendation by the Organisation for Economic Co-operation and Development (OECD) on cross-border co-operation in the enforcement of laws protecting privacy of 12 June 2007.

Ron Zink, who is Microsoft's EU affairs COO, told a panel at the Computer, Privacy & Data Protection conference in Brussels today that he hoped that the "Safe Harbor framework is alive and well and would continue." He added, "I hope it continues to be an adequate mechanism for the transfer of data between the US and EU."

But Walter Van Holst of the European Digital Rights group, who was also present on the panel, retorted that the scheme was "a compromise that just doesn't work".

He added that "Safe Harbor is dead. We just forgot to bury it."

Zink insisted that "Safe Harbor was alive and well," however.

A representative for the European Commission told the audience that it would report on the Safe Harbor framework in the coming months.

Van Holst said that the "export of personal data" remained "poorly enforced" and added that it was "detrimental to European companies".

He added: "Talks about data being offshored in places outside the current scope of the Directive hurts European companies," he claimed.

'Aspirational rules'

More generally, Zink reaffirmed comments he made earlier this week about the need for "harmonisation" of data-handling on both sides of the Atlantic.

He has expressed some concerns about the proposed reform of DP law in the EU. Specifically, on how the so-called "Right to be forgotten" online can be adequately addressed and the need not to be too overly prescriptive with the reform.

"It's easy to criticise a monumental task like this. It's complex: everyone's looking." He added: "With cloud computing we're moving data around the world".

"The fact that this is a regulation that harmonises is very good."

Zink also said that "improvements" had been made to how data is transferred around the world and added that contractual clauses detailed in Article 42 of the draft bill "could be helpful". He added that consent from an individual about usage of their data needed to be "explicit".

The MS exec said that Reding's proposed rules on data protection were "aspirational". ®

Security and trust: The backbone of doing business over the internet

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
JINGS! Microsoft Bing called Scots indyref RIGHT!
Redmond sporran metrics get one in the ten ring
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Murdoch to Europe: Inflict MORE PAIN on Google, please
'Platform for piracy' must be punished, or it'll kill us in FIVE YEARS
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
Sony says year's losses will be FOUR TIMES DEEPER than thought
Losses of more than $2 BILLION loom over troubled Japanese corp
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.