I. INTRODUCTION
FEDMA represents the direct marketing sector at the European level. Its national members are the direct marketing associations representing users, service providers and carriers of direct marketing. FEDMA also has over 500 direct company members. The direct marketing sector represents an expenditure of over 27 billion ECU and employs over 500,000 people directly, and many more indirectly, within the EU.
FEDMA is closely following developments on transfers of personal data to 3rd countries from the European Union and it actively participates in the International Chamber of Commerce (ICC) work on model contract clauses. FEDMA has therefore deemed it necessary to comment on the last version international safe-harbor principles.
II. GENERAL COMMENTS
1. Safe-harbor principles and use of contractual clauses
FEDMA believes that it is necessary to clarify what will be the interaction between the safe-harbor principles and the use of inter-company contracts for transfers of data, especially in relation to US organisations which may be bound by a contract with an EU organisation and at the same time be or not be part of the safe-harbor principles.
2. Benefits from being in the safe-harbor
FEDMA believes that the safe-harbor principles will be an useful instrument when the EU organisation passes on control over the data, responsibility for which will then lie on the US organisation. The US organisation being then obliged to respect the safe-harbor principles.
FEDMA thinks that when data are transferred purely for technical processing or where the authority on the uses of data will remain under the control of the EU organisation, the safe-harbor principles would not need to be applied, since the adequate safeguards required by the EU Directive could be guaranteed by a contract between the EU organisation and the US organisation.
3. EU Member States approval for transfer
FEDMA believes that if an agreement is reached on the safe-harbor principles, there should not be prior approval from the Member States, even if automatically granted. Such prior approval, even if it will merely be a notification, would in any case delay operations.
III. COMMENTS ON PRINCIPLES AND FREQUENTLY ASKED QUESTIONS
1. Notice
The principle of notice should explicitly recognise that information about types of third parties should be given only if it is necessary taking into consideration the circumstances of the collection and to guarantee fair processing. This is line with Articles 10 & 11 of the Data Protection Directive.
The present wording would oblige organisations to inform individuals about the fact that the data maybe processed by a computer bureau which is, for example, only preparing the mailings under the instructions of the organisation. This, combined with the right to opt-out from disclosure to third parties, may lead to a situation where the individual will be able to reject that a computer bureau receives the data and therefore dictate the organisation's internal data processing policy. In order to avoid such absurd situation it is necessary to qualify that such information should not be given unless it is necessary to guarantee fair processing.
2.Choice
Opt-in should not be required for sensitive data if such data have been manifestly made public. This is in line with Article 8 of the Directive.
Federation of European Direct Marketing
439 Avenue de Tervuren
1150 Brussels, Belgium
tel:+32 2 778 99 20
Fax: +32 2 778 99 24
E-mail: info@fedma.org
Web site: http://www.fedma.org