Home | Databases | WorldLII | Search | Feedback Privacy Law Resources

Greenleaf, Graham --- "Exporting and importing personal data" [2000] PrivLRes 2; [2000] CyberLRes 4 (15 May 2000)

	[Home] [Databases] [Search] [Feedback] [Help]

'Exporting and importing personal data' ([2000] CyberLRes 4) - [2000] PrivLRes 2

Greenleaf (2000)

(This paper was written before the availability of the Article 29 DataProtection Working Party' Opinion 4/2000 on the level of protection providedby the "Safe Harbor Principles" (16 May 2000) but that Optinion reinforcesits conclusions.)

Contents

• 1 Dimensions of importing and exporting personal data
• 1.1. Australian - Off-shore processing and Australianlaw
• 1.2. Australian - Restrictions on exports of personaldata from Australia
• 1.3. European - Restrictions on personal data importsto Australia
• 1.4. Regional - Other Asia-Pacific laws are includingdata export restrictions
• 2 Australian businesses overseas under the 2000 Bill
• 3 Data imports - What will the EU Directive mean after'Safe Harbor'?
• 3.1. The EU Commission promotes a compromise
• 3.2. The new 'Safe Harbor' compromise
• 3.3. Will it satisfy the national Data ProtectionCommissioners?
• 3.4. How strong are the 'Safe Harbor' protections?
• 3.5. The draft EU Decision
• 3.6. Implications for Australia and the Asia-Pacific
• 4 Data imports - Will the 2000 Bill be 'adequate'for the EU?
• 5 Data export restrictions under the 2000 Bill
• 5.1. Six conditions allowing overseas transfers
• 6 Exports and imports by Australian public sectorbodies
• 6.1. Commonwealth agencies - No protection in thePrivacy Act 1988
• 6.2. NSW agencies - s19 Privacy and Personal InformationProtection Act 1998
• 6.3. Agencies of other States and Territories

1 Dimensions of importing and exporting personaldata

1.1. Australian - Off-shore processing and Australianlaw

1.2. Australian - Restrictions on exports of personaldata from Australia

1.3. European - Restrictions on personal data importsto Australia

1.4. Regional - Other Asia-Pacific laws are includingdata export restrictions

Australian companies wishing to export personal information from theseregional countries will increasingly have to take into account their dataexport restrictions. And our own restrictions, and the adequacy of regionalcountries laws will have to be taken into account when exporting personaldata to them.

The Asia Pacific situation is similar now to that of Europe inthe early 1980s. Then, the presence of such restrictions in what was thena handful of European laws helped lead to the European privacy Convention[1]http://europa.eu.int/comm/dg15/en/media/dataprot/con10881.htm]in 1981 to ensure the free flow of personal information in Europe by providinga guaranteed base level of privacy protection.

2 Australian businesses overseas under the 2000Bill

(a) An organisational link with Australia - The organisationmust be an Australian citizen or resident, or a partnership, trust or companyformed here, or an unincorporated association managed and controlled here;or

(b) An operational link with Australia - The organisationcarries on business here, or the personal information was collected orheld here by that organisation either before or at the time of action complainedof.

The Privacy Commissioner's powers to investigate and make determinationsare extended to cover this extra-territorial operation.

If an act or practice is required by an applicable law of a foreigncountry it will not constitute a breach of the Australian Act (s13D). Thisavoids clashes between observance of Australian privacy law and the lawof the foreign country.

This exact extent of this extra-territorial operation concerningAustralians may be more extensive than it looks at first:

• What will constitute 'carrying on business' in Australia? Will websites that have a substantial number of Australian customers, or who sendemail to a list of customers including Australians be 'carrying on business'here? In areas of law such as passing off and trade marks a relativelysmall connection with Australia has been sufficient to constitute 'carryingon business'.
• When will information be 'collected ... in Australia' ? For example,if a person in Australia fills out a form on a web page of a US business(the server for which is in the US), when the form is being filled outit is on the user's computer in Australia, prior to the data being transferredto the US server. Where is the information 'collected'? This is less clearthat the EU Directive, which includes in its scope data collection which'makes use of equipment' in an EU country (A 4(1)(c)), but the possibilityof considerable extra-territorial scope remains.

3 Data imports - What will the EU Directive meanafter 'Safe Harbor'?

However, the acceptance of the Commission's proposal is not a foregoneconclusion, as it may still face significant opposition from Europe's nationalData Protection Commissioners (who comprehensively rejected the previousdraft as inadequate)[2].The approval procedures are expected to take until late 2000. Until theprocess is complete, the international benchmark for what is necessaryin order to avoid data export restrictions (and the benchmark for informationprivacy standards) will remain uncertain[3].

3.1. The EU Commission promotes a compromise

Under the EU's data protection Directive, Member States mustensure personal data transferred to non-EU countries is 'adequately' protected.The same Directive provides that the Commission may make a positive findingwhen the protection offered by a particular country meets this adequacyrequirement. Following two years of discussion, the US is now ready toput in place an arrangement which the Commission considers to offer "adequate"protection. Before adopting a formal decision to this effect, the Commissionmust seek the support of a qualified majority of Member States. It mustalso consult their data protection commissioners and the European Parliament.Once adopted the decision will be binding on all Member States and so constitutea strong guarantee against the interruption of data flows from the EU to"safe harbour" participants in the US. Approval procedures will take sometime, but the arrangement should be finalised by the summer and operationalin the autumn.

The arrangement must now be approved by a qualified majorityof Member States meeting in the framework of a Committee established underArticle 31 of the Directive. Its members have been regularly consultedon the progress of the dialogue with the US. Prior to seeking the opinionof the Committee, the Commission will seek the opinions on the arrangementfrom Member States' data protection commissioners (meeting in the frameworkof the working party established by Article 29 of the Directive). Beforefinalising the decision, the Commission must also submit it to the scrutinyof the European Parliament, which will check that the Commission is usingits powers under the directive correctly.

3.2. The new 'Safe Harbor' compromise

The changes do address some of the criticisms made of the previousversion by the EU national Data Protection Commissioners[9]:

• It clarifies that the Safe Harbor principles cannot be relied on wherethe Directive itself applies (eg where US websites collect personal informationfrom EU consumers);
• It allows Safe Harbor participants to be identified more easily (by requiringself-certification to the Department of Commerce).
• It requires US businesses to apply the Safe Harbor principles to all personalinformation they receive from the EU (but not to any other personal informationthey hold)[10].
• There are numerous wording changes which do clarify and strengthen theproposals but cannot be summarised briefly.

3.3. Will it satisfy the national Data ProtectionCommissioners?

"The Working Party thus invites the Article 31 Committee andthe Commission to ensure that the final steps of this important processare taken only in the light of the final opinion of the Working Party,not least because the outcome will have important consequences for thenational authorities represented in the Working Party."[11]

• It still does not make clear that there must be a public body with powersto investigate complaints (where the Commerce Department cannot act)[12].
• It still does not state that private sector dispute resolution bodies mustrefer unresolved complaints to such a public body (one of the Commissioners''key improvements' required).
• It still does not make clear that employee data and data processed fornon-profit or research purposes cannot be within the Safe Harbor.
• The potential for exemptions from one or more of the Safe Harbor principlesby US statutes or case-law is tightened somewhat, but a vague general exemptionremains 'to the extent necessary to meet national security, public interestor law enforcement requirements', and it is unclear what the A29 Committeethinks of this.
• It is unknown how the deceptive practices provisions will apply where datais transferred to organisations that should not have been on the Safe Harborlist, or have ceased to be on it.
• It still does not require the availability of damages[13],which the A29 considered necessary for 'meaningful' enforcement.
• It does not include 'evidence of enforcement mechanisms', particularlyfor enforcement sources other than the Commerce Department. The draft Decisionproposes to list such statutory sources, but the Safe Harbor principlesdo not.
• The 'Choice' principle allows a personal data to be used for any secondarypurpose whatsoever, provided the individual is given the opportunity toopt out. One of the A29 Committee's 'key improvements' was that the Choiceprinciple should be strengthened, but the exact improvements they wantedwas unclear.

3.4. How strong are the 'Safe Harbor' protections?

... in stark contrast to the current protections offered bythe EU Data Protection Directive where individuals are granted a specificright to judicial remedy and data protection authorities are obligatedto follow up on those complaints, the FTC is not required to pursue theclaims of any individual consumers.

Civil penalties or sanctions for one-time or persistent violationsof Safe Harbor principles may only be assessed by the Federal Trade Commission(FTC) after being referred via industry-funded self-regulatory groups suchas TRUSTe or BBBOnline, ADR bodies, or data protection authorities in EUmember countries. Despite past cases where individual privacy has beencompromised, no self-regulatory group has ever referred a member companyfor investigation and the FTC has never provided remedies for any of thecompanies with which they have reached settlements.

3.5. The draft EU Decision

If adopted by the A31 Committee, the draft Decision accepts thatthe Safe Harbor proposals do constitute 'adequate' protection in relationto those US companies that have 'unambiguously and publicly disclosed'(in writing to the Commerce Department) a commitment to comply, and comewithin the statutory powers of a US government body with powers to investigateand obtain relief against unfair or deceptive practices, irrespective ofthe residence or nationality of the complainant[16].

It remains to be seen what percentage of US organisations that wishto obtain personal data from EU counties will be able to satisfy thesecriteria.

There are provisions for a European national Commissioner to takeunilateral action to suspend transfers where there is evidence of violationsby US companies which create an 'imminent risk of grave harm' to Europeansand a reasonable basis for believing US remedies are inadequate[17].There is also provision for a review of the Decision after three years.

3.6. Implications for Australia and the Asia-Pacific

• Some countries with no data protection laws, such as Singapore, are likelyto await the EU outcome, and then decide whether to introduce a law (andat what strength), or some form of self-regulation.
• Jurisdictions in the process of introducing a private sector data protectionlaw, such as Australia and Japan, still have no final guide as to whatthe EU regards as the minimum level of data protection (either in termsof principles or enforcement) necessary for a finding of 'adequacy'.
• Businesses in jurisdictions such as New Zealand and Hong Kong with strongdata protection laws will have the advantage of simplicity over countrieswith self-regulatory schemes, given the likely qualified and somewhat complexnature of an Article 31 Committee decision.
• Hong Kong is likely to continue to await the outcome of the EU processbefore proclaiming its own data export prohibition (s31), as it is unlikelyto want to impose a higher standard on the US than the EU does.

4 Data imports - Will the 2000 Bill be 'adequate'for the EU?

If the current version of Safe Harbor, or something like it, isaccepted as adequate, then most aspects of the 2000 Bill would appear tomeet that standard.

However, even with as weak a benchmark as the current Safe Harbor proposal,there are a number of aspects of the 2000 Bill which are likely to limitthe scope of any EU finding of adequacy for Australia, and will thereforeconstitute problems for some sectors of Australian businesses:

• Lack of extra-territorial protection for EU citizens - Section 5Bonly extends the protection of the Act concerning extra-territorial practicesof Australian businesses to benefit Australians, and therefore cannot beused to protect citizens of EU countries. NPP 9 dealing with transborderdata flows does not operate to prevent the transfer of the informationby an Australian business to its own branch operating overseas, becausethis is only a transfer to itself (and s5B would normally apply to extendthe protection of the Australian Act). There is therefore a loophole inthe Bill whereby an Australian company could import personal informationon EU citizens, but could then export it outside Australia to a countrywith no privacy law but without the Australian Act applying.
• Lack of correction rights for EU citizens - The existing approachin s41(4) which prevents anyone other than Australian citizens and permanentresidents from exercising correction rights (IPP 7) is extended to theprivate sector (NPP 6 and equivalent provisions in Codes). As with theprevious example, this provision prevents against EU citizens obtainingthe same benefits as Australians from our privacy law, and is contraryto the EU objective in the notion of 'adequacy' that their citizens shouldbe protected by (adequate) local laws wherever their information is used,in the same way that the privacy of local citizens is protected.


New Zealand's Privacy Commissioner recently proposed that the NZPrivacy Act 1993 be amended to ensure that non-citizens have all rightsunder the Act, in order to ensure adequacy under EU law and that of otherjurisdictions such as Hong Kong. The Australian Bill is failing to do this.

• Generally available publications - The broad exemption in the Actfor information in a "generally available publication"[18],irrespective of whether the information came to be included in the publicationin breach of the Act, may cause problems, as the A29 Committee noted asimilar deficiency in the Safe Harbor principles.
• 'Small' businesses - There is no equivalent in the EU Directivefor an exemption for 'small' businesses (or in the Safe Harbor proposals).At best, this is likely to result in an A31 Declaration that expresslyexcludes exempt Australian 'small' businesses from its coverage. However,the resulting difficulties involved in an EU business knowing whether anyAustralian business was covered by the Act could lead to the type of proceduralcomplexities that legislation was supposed to avoid. There is no provisionfor 'small' businesses that wish to be bound by privacy law so as to beable to import personal information from Europe to opt in to being coveredby the Act. They would have to resort to some artificial device such asbuying or selling personal information so as to lose their exempt statusunder the Act. But how would the EU exporter be satisfied of this?
• Employment information - There is no equivalent general exemptionin the EU Directive, and this is likely to lead to any A31 Declarationexcluding any transfer of employment-related information. The A29 Committeewanted such an exclusion of employment information made explicit in theSafe Harbor proposal because the US Commerce Department did not have jurisdictionover such information. If there is such an exclusion, a European companywould not be able to export employee data to a branch of its own companyin Australia because the Australian company cannot 'opt in' to be coveredby the Act in relation to its employment information.
• Weak control over onward transfers - As discussed later, two ofthe conditions under which personal information can be exported from Australiaunder NPP 9 are much weaker than anything found in the Directive. The A29Committee has consistently identified controls over onward transfers asone of the key elements of 'adequacy', so this may also cause difficulties.

5 Data export restrictions under the 2000 Bill

If one of the conditions is satisfied, then the Australian organisationwhich transferred the data does not have any liability under the Act forany privacy breaches which may occur subsequently. It is therefore important,from the individual's point of view, to ensure that the conditions do notallow transfers which create unjustified privacy risks.

All of the publications by the A29 Committee of the EU have interpretedthe 'adequacy' requirement of the Directive as requiring some such 'onwardtransfer' restriction, so this will be an aspect of the Bill that the EUlooks at carefully.

It is important to remember that any transfer to a third partyoverseas also involves a 'disclosure' of personal information, and NPP2 limiting disclosures for secondary uses must also be complied with.

Where a transfer is to the same organisation overseas, NPP 9 doesnot apply but the extra-territorial operation of the Act comes into play.However, where it is to the same organisation, there is no need to considerwhether any of the six enabling conditions apply, and it is Australianlaw that will apply, not (only) the law of the foreign country.

5.1. Six conditions allowing overseas transfers

Condition (a) plays the role of A25 of the Directive (which allows transfersto foreign countries with 'adequate' laws), but is weaker.

(a) the organisation reasonably believes that the recipientof the information is subject to a law, binding scheme or contract whicheffectively upholds principles for fair handling of the information thatare substantially similar to the National Privacy Principles.

Conditions (b) - (e) are similar to those in A26(1) of the Directiveand largely uncontentious:

(b) the individual consents to the transfer; or (c) the transferis necessary for the performance of a contract between the individual andthe organisation, or for the implementation of pre-contractual measurestaken in response to the individual's request; or (d) the transfer is necessaryfor the conclusion or performance of a contract concluded in the interestof the individual between the organisation and a third party; or (e) allof the following apply: (i) the transfer is for the benefit of the individual;(ii) it is impracticable to obtain the consent of the individual to thattransfer; (iii) if it were practicable to obtain such consent, the individualwould be likely to give it

(f) the organisation has taken reasonable steps to ensure thatthe information which it has transferred will not be held, used or disclosedby the recipient of the information inconsistently with the National PrivacyPrinciples.

The subjective and imprecise nature of condition (a), and theweak and imprecise nature of exception (f), means that there is real dangerthat personal information will be exported from Australia under conditionswhich give little protection to privacy.

The EU may well regard these two aspects of NPP 9 as inadequateprotection for EU citizens.

6 Exports and imports by Australian public sectorbodies

In relation to imports from the EU, the following is not the completepicture, as some forms of governmental use of personal information arenot covered by the Directive.

6.1. Commonwealth agencies - No protection in thePrivacy Act 1988

6.2. NSW agencies - s19 Privacy and Personal InformationProtection Act 1998

(2) A public sector agency that holds personal informationmust not disclose the information to any person or body who is in a jurisdictionoutside New South Wales unless: (a) a relevant privacy law that appliesto the personal information concerned is in force in that jurisdiction,or (b) the disclosure is permitted under a privacy code of practice. (3)For the purposes of subsection (2), a relevant privacy law means a lawthat is determined by the Privacy Commissioner, by notice published inthe Gazette, to be a privacy law for the jurisdiction concerned. (4) ThePrivacy Commissioner is, within the year following the commencement ofthis section, to prepare a code relating to the disclosure of personalinformation by public sector agencies to persons or bodies outside NewSouth Wales. (5) Subsection (2) does not apply: (a) until after the firstanniversary of the commencement of this section, or (b) until a code referredto in subsection (4) is made, whichever is the later.

A benefit of this provision (once it is in force) is that it could provideprotection to NSW agencies against any data import restrictions being imposedagainst them. For example, a European government could otherwise refuseto disclose personal information to a NSW agency on the grounds that ,no matter how strong the privacy protection in NSW might be, there wasnothing to stop the NSW agency from passing on the data to an unprotectedjurisdiction.

An important factor to note is the broad scope of the prohibition.It extends to other State and Territory governments in Australia. It alsoapplies (in theory) to Commonwealth agencies located outside NSW (althoughthe CommonwealthPrivacy Act would presumably be a 'relevant privacylaw'). It also applies to any private sector organisations outside NSW(in the absence of the proposed federal legislation).

However, the export restrictions are not yet in force, and itis uncertain when or if they will ever be in force. First, the PrivacyCommissioner must prepare a code (s19(4)), but then only the Minister can'make' the code (s31(4)). If no code is ever made s19(2) will never comeinto operation because of s19(5).

6.3. Agencies of other States and Territories

[2] SeeG Greenleaf 'Death of the EU Privacy Directive?: Choppy waters in the SafeHarbour' 6 PLPR 81 for details of the Commissioners' criticisms.

[3] Seethe above article for the significance of the Safe Harbour proposal forinternational standards.

[4] EuropeanCommission Internal Market DG - Press Release 'Data protection: Commissionendorses "safe harbor" arrangement with US' (29 March 2000) <http://europa.eu.int/comm/internal_market/en/media/dataprot/news/harbor4.htm>

[5] EuropeanCommission Internal Market DG - Press Release 'Data protection: draft packageagreed for protection of data transferred from EU to US' (15 March 2000)<http://europa.eu.int/comm/internal_market/en/media/dataprot/news/harbor3.htm>

[6] USCommerce Department's Safe Harbour web site - <http://www.ita.doc.gov/td/ecom/menu1.html>

[7] 'Redlined'version of Safe Harbour proposal - <http://www.ita.doc.gov/td/ecom/RedlinedPrinciples31600.htm>

[8] Commentsare at <http://www.ita.doc.gov/td/ecom/Comments400/publiccomments0400.html>

[9] Fordetails of these criticisms see a summary in Greenleaf 6 PLPR 81

[10] SeeFAQ 6 - Self-Certification <http://www.ita.doc.gov/td/ecom/RedlinedFAQ6selfcert300.htm>

[11]The Working Party on the Protection of Individuals With Regard to the Processingof Personal Data Opinion 3/2000 on the EU/US dialogue concerning the"Safe harbor" arrangement (adopted 16th March 2000) - <http://europa.eu.int/comm/internal_market/en/media/dataprot/wpdocs/wp31en.htm>

[12]The draft Decision requires this, but not the Safe Harbour proposal.

[13]It only refers to 'damages awarded where the applicable law or privatesector initiative so provides'.

[14]Submission of the Trans Atlantic Consumer Dialogue (TACD) (30 March 2000)<http://www.ita.doc.gov/td/ecom/Comments400/TACDComments1.htm>

[15]European Commission Internal Market DG - Draft Commission Decision onthe adequacy of the US Safe Harbor Principles (29 March 2000) - <http://www.ita.doc.gov/td/ecom/Art256Decision.htm>(on US Commerce Department site)

[16]Article 1 of the draft Decision

[17]Article 2 of the draft Decision

[18]"generally available publication" 'means a magazine, book, newspaper orother publication that is or will be generally available to members ofthe public (however published)' - s6, as amended by the Bill, Schedule1, Item 14).