IP: Rough seas in safe harbors

[Dave Farber <farber () cis upenn edu>]

The following text is copyright 1998 by Network World, permission is hearby
given for reproduction, as long as attribution is given and this notice is
included.

Rough seas in safe harbors


Regular readers of this column know my general level of distrust of the
U.S. government's willingness to protect individual
privacy in the face of the desire for some U.S. businesses to know
everything about you and to sell that information to
anyone with enough cash. 

I've commented on the fundamental differences in approach between the
European and American approaches to privacy
protection. The Europeans feel that the only way to actually protect
privacy is to make it a crime to violate regulations
designed to protect privacy. The U.S. government claims that such laws
offer false comfort and so there should not be any
laws to compel protection. Instead we should trust that the companies in
the data business will voluntarily agree to protect
your private information with no penalty other than bad publicity if they
are lying.

We have now reached another turning point in the privacy saga. On October
25th the European Union's Directive on Data
Protection became effective. This directive requires that the member states
of the European Union must pass specific
legislation to protect the privacy of information about individuals and to
prohibit the transfer of data that can identify an
individual to third countries that do not provide an "adequate" level of
protection for the data. If the laws that are being
adopted to comply with the directive were to be strictly enforced no U.S.
based business or individual would be able to
import data, including for example, personnel files or credit card
transaction logs, into the U.S. from Europe.

The U.S. government is currently trying to deal with this issue. Since they
are unwilling to pass laws to actually protect
personal information they are trying to get the Europeans to agree to a
"safe harbor" for U.S. companies who what to
import European data. The U.S. proposal is to publish a list of companies
who agree to abide to certain privacy protection
principals. (See http://www.ita.doc.gov/ecom/menu.htm for the proposal.)

There are many things wrong with this idea, not the least of which is the
fact that no creditable penalty is proposed for
companies which agree to the principals then proceed to ignore them. The
principals are good ones but they are expressed in
generalities and it is very easy to see many ways that a company which
wanted to could evade their restrictions. 

This proposal, which treats non-US citizens far better than citizens
reminds me of a internal Boston Globe headline that got
accidentally printed during the Carter administration. This proposal is
"more mush from the wimp." The U.S. government is
being a wimp in the whole area of privacy. They are using excuse after
excuse to avoid having to actually confront the far
too many in the U.S. business community to whom genetic information about
you is just another commodity to sell to all, not
just the highest, bidders.

If there was serious concern about the privacy of individuals a proposal of
this type would have included proposals for clear
unambiguous laws which would make the unauthorized disclosure of private
data a felony. Without such laws, this is just
mush.

disclaimer: A boathouse on the Charles river is the Harvard's closest
approximation to a harbor so the above is my mush.