Deconstructing Information Walls: The Impact of the European Data Directive on U.S. Businesses

One way to attack a nation such as the United States which depends heavily on information and communication is to restrain the flow of information. building information walls around a nation.(1) --George McGovern, Chairman of the Subcommittee on International Operations of the Senate Committee on Foreign Relations, June 9, 1977. I. INTRODUCTION Advances in communications and information technology have transformed today's market for information. While speed and efficiency of data processing and transmission have skyrocketed, costs have dramatically diminished.(2) Meanwhile, the value of data, both raw and processed, has soared with the growth of electronic commerce and direct marketing.(3) In the current technological environment, it is as easy to transfer data across borders as it is to send it next door. This political and economic culture of integration and interdependence has made the United States dependent on transborder data flows. More than twenty years later, McGovern's statement continues to ring true. The United States' position in the world economy requires an ability to communicate and transfer information to and from its foreign trading partners. Two concerns face the United States in light of these recent technological developments: the susceptibility of the international information market to sudden obstacles and the vulnerability of the individual data subjects to the misuse or abuse of their personal data. In the 1980s the United States and Europe renewed their commitment to protect the integrity of the rapidly expanding global network of information systems as well as the privacy of individuals. This commitment was evidenced in 1980 by the development of the Organization for Economic Cooperation and Development's Recommendations Governing the Protection of Privacy and Transborder Flows of Personal Data (OECD Guidelines),(4) a set of information principles adopted by the United States and Europe, among others.(5) United States industry is now facing an unexpected threat from the European Union because of Europe's recent increased efforts to protect personal data. Part II of this Note examines the United States' approach to data protection and the current status of its privacy laws.(6) This section reviews the relatively comprehensive Privacy Act of 1974,(7) which governs the public sector, and then examines examples of more limited private sector data protection statutes. Part III provides a similar overview of the European approach to privacy law. It begins with a discussion of the OECD Guidelines and the Council of Europe's Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data (European Convention).(8) Although the United States is also a signatory to the former, these guidelines are not binding, and therefore have had significantly less impact on U.S. data protection law. Therefore, the discussion of the OECD Guidelines will serve primarily as background for current European privacy law. This section will conclude by performing an in depth review of the European Union Directive on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (EU Directive).(9) This evaluation will focus on U.S. and European attempts to balance the need for the free flow of information with individual privacy. Conflict between these two trading partners arises primarily for two reasons. First, the United States and Europe calibrate the balance between the rights of access to data and privacy protection differently. The United States tends to emphasize the free flow of information and minimal government regulation,(10) while Europe focuses first and foremost on individual privacy protection as a basic human right.(11) Second, the United States' data protection laws differ from Europe's in form. Consistent with its free market emphasis, the United States takes a very sectoral approach to data protection. …