Home | Databases | WorldLII | Search | Feedback Privacy Laws and Business International Report

Safe Harbour now in force: TRUSTe aids compliance [2000] PLBIRp 49; (2000) 56 Privacy Laws and Business International Report 9

Safe Harbour now in force: TRUSTe aids compliance

IN ORDER TO QUALIFY for the Safe Harbour, US organisations will, in most cases, need to join a selfregulatory privacy programme that adheres to the Safe Harbour Principles. TRUSTe has developed a new privacy seal programme to meet most of the new requirements.

The Safe Harbour (SH) agreement, developed to facilitate data flows between the EU and the US (PL&B Oct 2000, p. 12, and July 2000, p.9- 10), entered into force on 1st November. US organisations that wish to join this voluntary agreement must fulfil certain requirements

First, they must develop SH compliant privacy policies and comply with them. Secondly, they must agree to be subject to a statutory or regulatory body of law. They must also join one of the Internet privacy seal programmes that follow the SH privacy principles based on the EU Data Protection Directive. Such a programme is now provided by TRUSTe. Alternatively, organisations can satisfy the dispute resolution requirements by committing to co-operate with European Data Protection Authorities.

FEW SHIPS IN SAFE HARBOUR

There has been a slow start for Safe Harbour in the US. By mid- December twelve organisations had joined the list. These include TRUSTe and Dun & Bradstreet Corporation. The list gives information on the type of personal data covered by each organisation. Examples include online, offline, human resources and manually processed data. Further information is available on each organisation's "detailed safe harbor participation" and, where appropriate, any information on their non-compliance.

However, the US Department of Commerce (DOC), which SH participants need to notify, emphasises that, as participation is voluntary, an organisation's absence from the participant list does not mean that it fails to provide effective protection for personal data.

The DOC will hold a list of organisations (searchable by name, industry sector and state) that have self-certified. A notification will be valid for a year, although organisations can withdraw at any time.

PROGRAMME OPEN TO JOIN NOW

The TRUSTe Safe Harbour Programme is intended for companies that receive personal data from EU countries. It provides guidelines about what a company must do to be compliant with the SH, and assistance in creating a SH compliant privacy policy. The programme comprises two components; website privacy certification, and online and offline dispute resolution. The certification is similar to the existing TRUSTe privacy seal programme. TRUSTe provides information on how to create a privacy policy, and it enforces policies through quarterly monitoring. The dispute resolution system applies to both online and offline privacyrelated disputes.

ADVICE FOR CURRENT LICENSEES

The fees to join the TRUSTe programme vary from a few hundred dollars to $7,000 depending on the company's revenue. Once an organisation's application has been accepted, it can post the TRUSTe trustmark on its website.

Current trustmark holders can update their licenses. Organisations that have joined under the latest version of the TRUSTe license agreement (version 6.0) may simply sign a Safe Harbour addendum.

Bob Lewin, President and CEO of TRUSTe said at the launch of the programme: "Building on the successful accord between the EU and the US, our EU SH Privacy Programme will help streamline adherence to existing laws and provide companies and their customers an instrument for global privacy protection and dispute resolution. This programme builds on more than three and a half years of our knowledge and experience in providing privacy dispute resolution."

More information on how to join the TRUSTe Safe Harbour Programme can be found on TRUSTe website at http://www.truste.org, or by contacting Dave Steer at TRUSTe, Tel: + 1 415 260 9669 e-mail: dsteer@truste.org. The US Department of Commerce has published on the Internet a list of organisations that have joined Safe Harbour. The list, which will be regularly updated, can be found at http://web.ita.doc.gov/safeharbor/ shlist.nsf/webPages/safe+harbor+list