Microsoft exec says Safe Harbor framework is 'alive and well'
Privacy critic: 'It's dead. We just forgot to bury it'
Ensure Ease of Recovery with Asigra’s Agentless Software
CPDP Privacy advocates have expressed concern about Brussels' Commissioner Viviane Reding's decision to leave in place the Safe Harbour framework used by some companies to transfer data from Europe to the US.
The EC's vice president tabled her draft bill for the overhaul of the EU's 1995 data protection law on Wednesday.
However, critics have questioned how the Safe Harbour scheme can remain workable within the wider context of the commissioner's DP legislation proposals.
EU data protection laws currently state that organisations must tell people when they are asked to disclose their personal information. Some companies that meet the requirements of Europe's DP directive are allowed to transfer EU data to the US.
Microsoft is one of them.
Reding's proposals state:
Article 41 sets out the criteria, conditions and procedures for the adoption of an adequacy decision by the Commission, based on Article 25 of Directive 95/46/EC. The criteria which shall be taken into account for the Commission’s assessment of an adequate or not adequate level of protection include expressly the rule of law, judicial redress and independent supervision. The article now confirms explicitly the possibility for the Commission to assess the level of protection afforded by a territory or a processing sector within a third country.
Article 42 requires for transfers to third countries, where no adequacy decision has been adopted by the Commission, to adduce appropriate safeguards, in particular standard data protection clauses, binding corporate rules and contractual clauses. The possibility of making use of Commission standard data protection clauses is based on Article 26(4) of Directive 95/46/EC. As a new component, such standard data protection clauses may now also be adopted by a supervisory authority and be declared generally valid by the Commission. Binding corporate rules are now specifically mentioned in the legal text. The option of contractual clauses gives certain flexibility to the controller or processor, but is subject to prior authorisation by supervisory authorities.
Article 43 describes in further detail the conditions for transfers by way of binding corporate rules, based on the current practices and requirements of supervisory authorities.
Article 44 spells out and clarifies the derogations for a data transfer, based on the existing provisions of Article 26 of Directive 95/46/EC. This applies in particular to data transfers required and necessary for the protection of important grounds of public interest, for example EN11 EN in cases of international data transfers between competition authorities, tax or customs administrations, or between services competent for social security matters or for fisheries management. In addition, a data transfer may, under limited circumstances, be justified on a legitimate interest of the controller or processor, but only after having assessed and documented the circumstances of that transfer operation.
Article 45 explicitly provides for international co-operation mechanisms for the protection of personal data between the Commission and the supervisory authorities of third countries, in particular those considered offering an adequate level of protection, taking into account the Recommendation by the Organisation for Economic Co-operation and Development (OECD) on cross-border co-operation in the enforcement of laws protecting privacy of 12 June 2007.
Ron Zink, who is Microsoft's EU affairs COO, told a panel at the Computer, Privacy & Data Protection conference in Brussels today that he hoped that the "Safe Harbor framework is alive and well and would continue." He added, "I hope it continues to be an adequate mechanism for the transfer of data between the US and EU."
But Walter Van Holst of the European Digital Rights group, who was also present on the panel, retorted that the scheme was "a compromise that just doesn't work".
He added that "Safe Harbor is dead. We just forgot to bury it."
Zink insisted that "Safe Harbor was alive and well," however.
A representative for the European Commission told the audience that it would report on the Safe Harbor framework in the coming months.
Van Holst said that the "export of personal data" remained "poorly enforced" and added that it was "detrimental to European companies".
He added: "Talks about data being offshored in places outside the current scope of the Directive hurts European companies," he claimed.
'Aspirational rules'
More generally, Zink reaffirmed comments he made earlier this week about the need for "harmonisation" of data-handling on both sides of the Atlantic.
He has expressed some concerns about the proposed reform of DP law in the EU. Specifically, on how the so-called "Right to be forgotten" online can be adequately addressed and the need not to be too overly prescriptive with the reform.
"It's easy to criticise a monumental task like this. It's complex: everyone's looking." He added: "With cloud computing we're moving data around the world".
"The fact that this is a regulation that harmonises is very good."
Zink also said that "improvements" had been made to how data is transferred around the world and added that contractual clauses detailed in Article 42 of the draft bill "could be helpful". He added that consent from an individual about usage of their data needed to be "explicit".
The MS exec said that Reding's proposed rules on data protection were "aspirational". ®
COMMENTS
Amerikia, Amerika, über alles
While Zink (rhymes with Fink) is in favor with the idea of "harmonisation" of data-handling on both sides of the Atlantic, he does not say which who will harmonise with who (or is that whom?)
I suspect that the sort of harmonisation that Zink is in favor of is of that the rest of the world will harmonise with 'merkin-land i.e. we want all your data, we want it now, and its none of your business what we do with it, you're a terrorist suspect after all.
It's really is time for the EU to grow a pair...
I used to wonder why so many people disliked/hated 'merkin-land, my only surprise is why it has taken me so long to realise why.
Safe Harbor is a Joke
"With respect to personal data received from the EU, please state that you comply with these principles: ...."
"Thank you. You are now enrolled in the Safe Harbor scheme."
And that's pretty much it. No audit -- no oversight at all. Nothing for customers to inspect. And even though it's that easy there are operations claiming to be on the Safe Harbor list when they are not (not hard to check, though).
I can't see a way for Safe Harbor to be a wise basis for firms to export PID from the EU, regardless of what the EC says. I think a SOC2 type II with a clear and explicit listing of GAPP controls might actually do better. In an outsourcing context where the data has already been properly consented, and there are explicit contract provisions preventing disclosure, GAPP may be good enough.
So the self regulating, self auditing Safe Harbor scheme in the US is under question again.
Not the first time that the Patriot Act is being mentioned - just one of many laws that means that off shore companies are forced to hand over data that if was in the EEA , EU or UK would be protected by the European or British laws.
Having read the draft proposal of what is to come, there really needs to be a properly controlled scheme that is independently assured to provide the ability to verify off-shore resources. With virtualisation/cloud/Catchphrase of the moment - there is even more transfer of data outside of the EEA and without updated laws and controls, we will become a small island once again.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Enabling efficient data center monitoring
Agentless Backup is Not a Myth
Customer Success Testimonial: Recovery is Everything
