Honorable David L. Aaron
International Trade Administration
U.S. Department of Commerce
14th and Constitution Avenue, N.W.
Washington, DC 20230

Attention: Mr. Eric Fredell, Task Force on Electronic Commerce

Re: Revised Safe Harbor Principles and FAQs

Dear Ambassador Aaron:

On behalf of Time Warner Inc. ("Time Warner"), I am pleased to submit these comments in response to your April 19 and April 30 letters to industry representatives outlining the current drafts of the Department of Commerce's Safe Harbor Proposal. We have previously indicated our support for an appropriate safe harbor approach to bridging the differences in privacy protection approaches taken by the United States and the European Union.

The revised Safe Harbor principles and the frequently asked questions and answers ("FAQs") respond to some but not all of the concerns and comments that Time Warner and other members of industry have raised during the past six months In addition, we remain concerned that the proposed safe harbor principles are drafted for an offline world but will have unintended consequences for businesses in an increasingly online world. Nevertheless, with some additional modifications, and with resistance to other modifications proposed by the European Commission, the proposed safe harbor proposal can serve as an alternative method of compliance with the E.U. Directive on Data Protection regarding the flow of personal data to third countries.

Time Warner

Time Warner is the leading media and entertainment company, with four fundamental businesses: entertainment, cable networks, publishing, and cable, including interests in filmed entertainment, television production, broadcasting, recorded music, music publishing, cable television programming, sports franchises, magazines, book publishing and cable television systems.

Time Warner is one of the world's largest providers of content in some of the most popular sites online, with about 13.2 million unique visitors in March of 1999.⁽¹⁾ We are also an online service provider, including Internet access, through our Road Runner cable modem service, with subscribers in communities around the country. In addition, Time Warner is also one of the largest direct marketers in the United States through mail and telephone solicitations and television advertising.

Time Warner's global business activities include substantial operations in Europe. Both as a provider of media and entertainment products and services, and as an employer, Time Warner transfers personal information to the United States from locations in the European Union. Time Warner has a large direct marketing operation in Europe and, as in the United States, uses a variety of media to reach its customer base.

Onward Transfer Principle

We continue to believe that listing an Onward Transfer principle is redundant. Given its continued presence among the Safe Harbor principles, we are greatly troubled with the Commission's proposal, contained in footnote 5 to the Onward Transfer principle, to require explicit notice and choice whenever personal data is transferred to a third party that does not adhere to the safe harbor requirements. In our view, this is a step backwards because it appears to severely limit the option of entering into a written agreement with such third party requiring that the third party provide at least the same level of privacy protection as is required by the relevant safe harbor principles. Specifically, it appears to close the door on subcontracting work to another company that does not "directly" participate in the Safe Harbor program.

The Safe Harbor program should encompass subcontracting companies that agree contractually to comply with the Safe Harbor principles when processing European-sourced personal information. Failure to do so will limit the program's viability.

Access Principle

In our November 1998 comments we identified the Access principle as one area where the Safe Harbor proposal imposes more onerous obligations than the Directive. The FAQs on Access help to conform the Safe Harbor notion of access to personal information with that of the Directive by addressing, for example, the reasonableness factors of frequency of access requests and response time.

We are concerned, however, that the Commission's proposed edits to the text of the Access principle will set back this progress. In addition, footnote 2 to the FAQs implies a far greater link between marketing data and sensitive personal information. In our experience, the marketing sector of our industry generally does not handle sensitive information, and neither the principle nor the FAQs should be changed to imply the contrary.

Weight to be Given to the FAQs

As indicated above, the FAQs have helped to clarify the Safe Harbor principles. Although they cannot and should not supplant the text of the principles, the FAQs should be given great weight in construing them. When finalized, the FAQs should serve as the primary source for interpretation of the principles.

Transition Period

At an open meeting held at the Department of Commerce, it was indicated that, after self-certifying, U.S. companies would have about a six-month transition period to implement safe harbor policies. As a leading media and entertainment company with a large direct marketing operation in Europe, and based on our ongoing experience in implementing changes to comply with current self-regulatory privacy protection measures, we believe that a six-month transition period will be too short a time to effectively implement safe harbor policies. We strongly suggest that the Department consider adopting at least a one-year transition period.

Other Means of Complying with the EU Directive

Prior to the development of the Safe Harbor proposal, there were other means available for a U.S. company receiving personal data from the E.U. to comply with the Directive even if the United States were deemed not to have an adequate level of protection. The final version of the Safe Harbor proposal should make it clear that entering the safe harbor remains only one way for a U.S. company receiving personal data from the E.U. to comply with the Directive. Contracts, consent, and other compliance mechanisms contained in the Directive should be maintained as equally available alternatives.

* * *
Time Warner believes that the revised Safe Harbor proposal continues to provide a solid basis as an alternative method of compliance with the E.U. Directive, which will help ensure that the flow of data between the European Union and the United States will not be disrupted, with all its attendant consequences on businesses, livelihoods and consumer choices. With some additional modifications, and resistance to other modifications proposed by the Commission, the proposed safe harbor can help facilitate the transfer of personal information while protecting individual privacy. We applaud the continued efforts by the Department of Commerce to ensure that data flow between the European Union and the United States continues uninterrupted, and we appreciate the opportunity to provide input to assist in these efforts.

Sincerely,
 

Arthur B. Sackler
Vice President Law and Public Policy
 
 
 

¹ Media Metrix, March 1999 Rankings of Digital Media/Web Properties (listing Time Warner sites as the most visited sites on the Web).