Intelligent Enterprise

Privacy Matters

Safe harbor agreement finds friends at HP and foes in Congress

As consumer privacy becomes a global issue, a battle has begun to see which nation's privacy standards will set legal precedence, and companies are quickly evaluating their approaches to the issue.

One solution to the problem has been the safe harbor agreement (www.export.
gov/safeharbor), which was negotiated between the European Union (EU)'s European Commission and the U.S. Department of Commerce. The agreement provides guidelines on how companies can collect and use personal information about EU citizens.

However, conforming to Europe's information privacy guidelines leaves many Americans uncomfortable. At spring 2001 congressional privacy hearings, many members of Congress questioned the agreement and argued to reevaluate it. Some found the agreement a threat to U.S. companies, saying it will cost companies too much money to implement and follow, while others suggested alternatives such as passing American privacy protection policies instead of adapting to European policy.

Despite the criticisms surrounding the agreement, Hewlett Packard became one of the first large companies to implement safe harbor guidelines. According to HP's customer privacy manager, Barbara Lawler, getting in line with the agreement guidelines may have been an easier task for HP than it would be for other companies. HP had been tracking the safe harbor agreement for a while and the principles were very similar to the privacy protection HP was already offering its customers in Europe and everywhere HP does business.

Although U.S. congressional representatives contend that conforming to the safe harbor framework may become expensive for American companies, Lawler said HP's ability to plan ahead was a key factor in keeping costs down and implementing the policies in a timely manner. HP was already evaluating global privacy issues and had no need to implement new technologies.

HP did slightly alter its privacy policy by expanding customer choice practices, adding "opt-out" capability, and making the policy cleaner and easier to understand for customers, including adding a link to the HP privacy policy on every page of HP's Web site.

"It didn't have so much to do with implementing technologies, but instead having really good business policies and practices which are constantly managed and updated," said Lawler. HP thought about global privacy far in advance, designating an individual more than four years ago to address the global privacy issue.

According to Morrison & Foerster LLP partner Barbara Wellbery, counselor to the U.S. Department of Commerce's undersecretary for e-commerce at the International Trade Administration during the safe harbor negotiations, there are issues in addition to costs that keep other large companies from quickly becoming safe harbor-compliant like HP.

"Some companies are waiting to see what happens with 'model contracts.' Also [safe harbor] is a hard thing for companies to understand and really get their arms around. I do believe, though, that this [safe harbor] will gain momentum. It's just extremely time consuming," said Wellbery.

Model contracts are an alternative to the safe harbor agreement and consist of contracts between American companies and either the European country's data protection authorities or the customers and workers whose information is being transferred to the United States. However, European officials and the U.S. Department of Commerce aren't expected to approve the contracts until June 2001. June is also when the safe harbor agreement comes up for review by European officials. Companies could face enforcement actions for not following the safe harbor guidelines.

Lawler believes that the June review is too soon to really evaluate the success of the agreement and that companies need at least a year to put everything in place. Lawler hopes that European officials will not make a final decision in June. Lawler also believes the safe harbor principles are needed by companies in order to "make privacy real" for their customers.

"If corporations are serious about following the self-regulation approach, rather than having to deal with privacy regulations, then this is what they should be looking at," said Lawler.