Arthur B. Sackler, Vice President
Law and Public Policy
Time Warner Inc.
800 Connecticut Ave., N.W.
Suite 800
Washington, D.C. 20006
(202) 457-9226

Of Counsel:
Ronald L. Plesser
Emilio W. Cividanes
Piper Marbury Rudnick & Wolfe L.L.P.
1200 Nineteenth St., N.W.
Washington, D.C. 20036
(202) 861-3900
 
 

Date: December 3, 1999

Time Warner Inc. ("Time Warner") is pleased to submit these comments in response to Ambassador David L. Aaron's November 15, 1999 letter eliciting reactions to the current drafts of the Department of Commerce's safe harbor proposal.

We have previously indicated our support for an appropriate safe harbor approach to bridging the differences in privacy protection approaches taken by the United States and the European Union. We believe that the current safe harbor documents demonstrate that significant progress has been made in responding to the concerns of Time Warner and other members of industry. With some additional modifications, the proposed safe harbor proposal can serve as an alternative method of compliance with the E.U. Directive on Data Protection regarding the flow of personal data to third countries.

Specific Comments

As we have noted before, the frequently asked questions and answers ("FAQs") have helped to clarify the safe harbor principles and should serve as the primary source for interpretation of the principles. Consequently, we are pleased to see that the Department of Commerce and the European Commission have agreed to accord the FAQs equal weight with the text of the seven principles.

Contracts

We support the clarifications in FAQ 10 that underscore the benefits of participation in the safe harbor when contracting to transfer data to the U.S. only for processing purposes. More specifically, Time Warner supports language clarifying that contracts between data controllers in the E.U. transferring data to the U.S. and safe harbor participants only for processing purposes will not require prior authorization or approval by the Member State or the European Commission. We also support the clarification that the safe harbor participant processing the data need only apply the safe harbor security principle because the data controller in the E.U. remains responsible for complying with European law regarding all other safe harbor principles.

In supporting this language in FAQ 10, we assume that the documents are not using the term "processing" in the very broad way it is defined in article 2 of the Directive. Rather, FAQ 10 is referring to the function or role of the safe harbor participant as a "processor" of information on behalf of the European "controller" who furnished the data to it and still determines the purpose of the processing.

Choice

The Department of Commerce has proposed to substitute the term "specify" for "reveal" in the definition of "sensitive information" in the choice principle. Time Warner supports this change.

We agree with the Department that the use of the term "specify" in the choice principle is more consistent with current First Amendment case law. We also agree with the proposed change because we believe that it better addresses the concerns underlying the need for special treatment of sensitive information. Finally, use of the term "specify" rather than "reveal" in the choice principle is consistent with the access FAQ's treatment of "marketing inferences" as confidential commercial information.

Onward Transfer

Although its text has improved substantially during the past year, we believe--as we have stated from the very beginning--that listing an onward transfer principle is redundant of the notice and choice principles.

Access

We have consistently identified the access obligations as an important issue for companies such as Time Warner, which are active in the marketing sector of our industry. Most recently, in our May 1999 comments, we supported changes made to the FAQ on access, which help to conform the safe harbor notion of access to personal information with that of the Directive by addressing, for example, the reasonableness factors of frequency of access requests and response time.

Although the notion of "proportionality" has now been given greater weight than before in the access principle, Time Warner commends the Department for its continued retention of the "reasonableness" standard--including factors such as frequency of access requests and response time--in the current documents.

We also support the changes to the FAQ on access which clarify that "modeling programs" and "marketing inferences or classifications generated by the organization" are confidential business information to which a company may deny access.

Enforcement

We note that the current draft documents indicate that the duration of an interim period for implementation of the safe harbor has not yet been agreed.

As a leading media and entertainment company with a large direct marketing operation in Europe, and based on our ongoing experience in implementing changes to comply with current self-regulatory privacy protection measures, Time Warner believes that allowing for a sufficient interim period may well determine the safe harbor's success. The Department needs to provide companies with sufficient time to evaluate fully the potential impact of the safe harbor on their businesses and to evaluate the other options that are available to comply with the Directive. We strongly urge the Department to consider adopting at least a one-year transition period for the implementation of the safe harbor. Furthermore, to ensure that U.S. businesses do not labor under more stringent privacy regulation than their European counterparts, the Department should ensure that the interim period last no less than the time that Member States have to come into full compliance with the Directive.

Conclusion

Time Warner believes that the revised Safe Harbor proposal is likely to provide a viable alternative method of compliance with the E.U. Directive, which will help ensure that the flow of data between the European Union and the United States will not be disrupted, with all its attendant consequences on businesses, livelihoods and consumer choices. With some additional modifications, the proposed safe harbor can help facilitate the transfer of personal information while protecting individual privacy. We applaud the continued efforts by the Department of Commerce to ensure that data flow between the European Union and the United States continues uninterrupted, and we appreciate the opportunity to provide input to assist in these efforts.