The following is not an opinion of the Working Party established by Article 29 of Directive 95/46/EC on the Safe Harbor arrangement but simply a message addressed to the Committee created by Article 31 of the Directive which will be meeting on 14th July, expressing some of the Working Party’s concerns resulting from its 7th July meeting.

Recalling its previous remarks in opinions 1/99, 2/99 and 4/99 (annexed for ease of reference as annex 1, 2 and 3 respectively):

1. The Working Party, is indeed aware of the importance of the EU-US debate on data protection and of the repercussions that the position finally adopted will have on the majority of other third countries. It is also aware of the time constraints inherent to these discussions and of the difficulties resulting from the differences in the political, economic and cultural approaches.

2. The Working Party has so far diligently examined the successive versions of the Safe Harbor Principles and of the Frequently Asked Questions (FAQs), which have emerged later and which have not yet all been issued, including some of the most important ones. Since having been informed by the Commission that the FAQs are to be an integral part of the Safe Harbor arrangement and to have the same binding force as the Principles, the Working Party considers that henceforth its approach has to be comprehensive with regard to both texts and it should therefore issue an opinion covering both the Principles and the FAQs. It follows that until the Working Party has all the FAQs announced by the American side as well as the related legal texts it will not be able to deliver a complete and definitive opinion on the "Safe Harbor arrangement".

3. Following the discussions on 7th July, the Working Party wishes to draw the attention of the Committee to the following points:

Legal basis: in the mutual interest of both parties it is advisable to ensure that Article 25 of the Directive is a solid legal basis.

The scope of the Safe Harbor arrangement : The following should be specified:

• If certain sectors are excluded from the scope of the Safe Harbor mechanism on account of specific provisions (e.g. public sector) or due to the absence of a public monitoring body with responsibility to deal with the subject matter, as required by Article 1 b of the Draft Commission decision (e.g.: employee data, or non-profit-making related activities) and;
• If the organisation in the notification of its adherence to the Safe Harbor, will be able to exclude certain sectors of its own activity (e.g.: online services) and how this will be made public and available to the national supervisory authorities;
• Moreover, the Working Party notes that at present, the level of protection given to the employee data is not satisfactory. Two solutions seem possible: To reinforce overall the level of protection awarded by the Principles or to exclude this data from the scope of the Arrangement to give it reinforced protection, in view also of the absence of an independent public body as required by Article 1(b) of the draft decision able to deal with this type of data, and ;
• Reiterates its concern that the US authorities may derogate from Principles through regulation without giving proper weight to the interests of privacy protection.

The conditions of implementation and enforcement:

• What will be the impact on the role of the national supervisory authorities of the choice of an American company to have complaints dealt with by a specific body?
• At the European level, when dealing with complaints, what will the respective powers of the national supervisory authorities and of the European Union be?
• In the event of simultaneous or successive American and European procedures leading to contradictory positions on a complaint, how will these differences be solved?
• The Working Party also notes that the role that the American authorities would wish to be played by national supervisory authorities with regard to those companies that choose to co-operate with them, may pose constitutional, financial, or personnel problems for some national authorities.
• Moreover the Working Party considers it advisable to ensure that the verification procedure mentioned in Principle 7 (b) should be independent, that is carried out by a third party, failing which, it considers it advisable to ensure that a report on the verification should be made available to the national supervisory authorities, if necessary.

On the contents of the Principles

While acknowledging certain improvements to the 19 April 1999 text, the Working Party notes that the Principles in their 1st June version do not yet fulfil the requirements of adequate protection. In addition to the questions mentioned in its previous opinions, and in anticipation of its new and comprehensive opinion, the Working Party considers it essential to draw in particular the Committee’s attention to the following questions:

Principles 1 and 2 "Notice"and "Choice "

• The scope of the purpose principle is different in the Notice Principle and in the Choice Principle.
• Comparing with the 4th November 1998 version, the combination of both Principles results now in the possibility for the American companies to use data for another purpose for which it was collected without having to offer choice. Although the directive allows for data to be further processed, provided that the use is not incompatible with the purpose of collection, considering that the "Safe Harbor "Principles do not contain legitimacy of processing criteria, the Wokring Party considers that it is advisable to strengthen the Choice Principle .

Principle 6 "Access "

• The exemptions contained in the FAQS are too broad.
• Public data needs to be covered.
• Data processed in violation of the Principles should be corrected or deleted.

Done at Brussels, 7 July 1999

For the Working Party

Prof. Stefano RODOTA