Industry urges government action on international transfers of personal data

ICC and Amcham EU made the appeal on the opening day of a conference on international transfers of personal data, jointly organized by the European Commission (EC) and the US Department of Commerce.

Global businesses are increasingly faced with the daunting challenge of how to efficiently manage the growing complexities of their employee and customer data. This is every bit as true for European businesses operating in the US, for US companies doing business in Europe and for companies operating in other parts of the world.

Globalization and a networked society have made national borders irrelevant to companies working with customers all over the world, with employees now part of a worldwide organizational matrix. The legal framework in the EC has not effectively eliminated national decision-making mechanisms whereby companies must comply with rules from 25 different regimes when processing data. Companies operating outside the EC, notably in the US, are especially hard-hit by this massive set of requirements.

AmCham EU and ICC have been involved in a global search for workable solutions. The two organizations recognize the vital role of the Safe Harbor agreement, struck in 2000 between the EC and the US which lays out seven principles on data privacy.

Both associations cooperated with other business organizations to draft alternative standard contractual clauses for data transfers between controllers, approved last year by the EC, which are now the de-facto industry standard.

ICC and AmCham EU member companies are also pioneering the use of Binding Corporate Rules, which the EC has presented as an alternative to other derogations allowing for international data transfers, but that until today have proven difficult to implement.

The Asia Pacific Economic Cooperation (APEC) economies have developed principles that facilitate responsible transborder data flows in the APEC region.

Closer cooperation between the EC, the US government, global business and other international institutions will lead to data protection mechanisms that will protect the rights of individuals and take business realities into account.

AmCham EU and ICC call upon governments to be open to the feedback and experiences from conference participants and to deliver substantial progress on the following:

• Simplify content requirements for Binding Corporate Rules while shortening and simplifying the approval process;
• Implement an EC derogation for global companies to freely share employee data internally and with service providers, based on a simple contract that reflects EC data privacy principles, but without the added complexity of specifying the exact employee data to be processed and the data transfers to take place, since these change continuously;
• Approve alternative standard contractual clauses recently put forward by AmCham EU and ICC for transfers from data controllers to data processors.