Protecting Consumer Privacy and Achieving Global Interoperability in the Digital Age

Mark Shaheen by Mark Shaheen, Civitas Group
Wednesday, May 02, 2012

More than several degrees of separation distinguish European legislation for consumer data privacy and its enforcement mechanisms from those of the United States. In the European Union (EU), individuals’ data privacy—considered a “fundamental right”[1]—is protected by the 1995 EU Data Protection Directive, national privacy laws, and data protection authorities.[2] Within the electronic realm, the European concept of privacy extends beyond personally identifiable information (PII) or other confidential records to include the broader scope of an individual’s digital record such as IP addresses and posts on social networking sites.[3] The U.S. approach has been driven by addressing privacy legislation on a sector-by-sector basis, with separate laws governing education, health, financial, and even video rental records, as well as the storage, use, and dissemination of PII stored by the government. The disparate approaches are creating real world challenges, as global interoperability of many corporations increasingly will depend on the ability of companies to implement PII control regimes that satisfy both U.S. and EU guidelines.

For years, more sweeping legislation has laid stagnant in the U.S. Congress. However, realization of companies’ growing ability to aggregate, utilize, and disseminate individuals’ information as well as several high-profile enforcement cases may have begun to turn the tide of political action in both the executive and legislative branches. With the release of the Obama Administration’s and Federal Trade Commission’s (FTC) respective reports on consumer data privacy, the European and American legal conceptions of data privacy may be taking some initial steps towards convergence. The problem for companies and other organizations looking to encourage global interoperability and turn a profit in the digital age, however, is that the means of implementing the new privacy regimes show little sign of moving closer.

In late March, the FTC released “Protecting Consumer Privacy in an Era of Rapid Change,” a report encouraging companies that collect and use personal—referred to as “consumer”—data to implement a series of best practices protecting consumers’ private information.[4] Earlier this year, the Obama Administration’s released a similar report calling for legislation declaring a “Consumer Privacy Bill of Rights” and a voluntary stakeholder engagement process to create codes of conduct for their enforcement. Europe’s current patchwork of national privacy laws and data protection authorities—all created in response to the 1995 EU Directive on Data Protection—could be succeeded by EU legislation regulating the processing and movement of all personal data across the EU as early as 2014.[5]

An agreement on the definition of aspects of consumer privacy as a right or “core value” is a necessary first step if the EU and U.S. are to create interoperable privacy controls that will remove obstacles to the growth of key aspects of the digital economy. The Obama Administration’s consumer privacy framework and proposed EU Data Protection Regulation share basic commitments to a number of information practice principles, including transparency, access and accuracy, accountability, data security, and individual control. As extensions of previously validated Fair Information Practice Principles (FIPPs), these values have long been advocated as best practices by the FTC and adopted in legislation and policy by national governments and international institutions, including the EU.[6] It is this step towards defining consumer privacy principles as rights protected by U.S. legislation that more clearly unites American policy intentions with those of its European counterparts.

U.S. and European proposals begin to differ, however, when it comes to the implementation of these principles. Both recognize the importance of “privacy by design” or “privacy by default,” but differ in the ways in which they designate specific privacy controls. The “right to be forgotten,” a clause contained in the proposed EU Data Protection Regulation, defends the rights of individuals to demand that personal data collected by a particular organization online be permanently deleted so long as its holding is not protected by law. This provision is already the subject of controversy for the headaches it may cause for companies like Google and Facebook whose business models depend in large part on the aggregation of user data across the Internet. Both the Obama Administration’s proposal and the FTC report advocate the creation of simple choice mechanisms for individual approval of personal data collection and its withdrawal, but neither goes so far as to claim a right to total removal.

More fundamentally, the very mechanisms of change and applicability of legislation protecting consumer privacy, present or future, diverge at the definitional level. While the EU is proposing broad-based regulation, both U.S. proposals remain limited in their applicability and call for industry-led, voluntary self-regulation supplemented by limited legislation. Despite its broad definition of consumer privacy rights, the Obama Administration’s report proposes that codes of conduct and legislation apply to only those commercial entities not already covered by privacy legislation (e.g., the health sector, financial services, and education entities). For its part, the FTC limits its proposed privacy framework to businesses that collect data from more than 5,000 consumers. This disparity between the U.S. and EU approaches matters less for governments and international institutions that require only mutual recognition, but could prove more of a challenge for companies subject to implementing these controls.

Global interoperability will depend on the ability of companies to implement consumer privacy controls that meet both EU and U.S. standards. U.S. and European policymakers should continue their collaboration to ensure that they share a common definition for consumer data privacy and limit regulation where it relates to the specific technical realization of these principles. Continued innovation and global interoperability in the digital age depend on it.


[1] Article 8. “Charter of Fundamental Rights of the European Union.Official Journal of the European Communities. December 2000. http://www.europarl.europa.eu/charter/pdf/text_en.pdf.

[2] For example, the 1995 EU Directive facilitated the creation of France’s data protection authority, the Commission nationale de l’informatique et des libertés (CNIL).

[3] European Commission. “Why do we Need an EU Data Protection Reform?” http://ec.europa.eu/justice/data-protection/document/review2012/factsheets/1_en.pdf.

[4] U.S. Federal Trade Commission. “Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Business and Policymakers.” March 2012. http://www.ftc.gov/os/2012/03/120326privacyreport.pdf.

[5] European Commission. “General Data Protection Regulation.” January 2012. http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf.

[6] U.S. Federal Trade Commission. “Fair Information Practice Principles.” http://www.ftc.gov/reports/privacy3/fairinfo.shtm.

More information

Post a comment

Sign in to comment.

Not yet registered? Join the debate