|
The international Safe Harbor Privacy Principles or Safe Harbour Privacy Principles are principles which enable some US companies to comply with privacy laws protecting European Union and Swiss citizens. US companies storing customer data may self-certify that they adhere to 7 principles, to comply with the EU Data Protection Directive and with Swiss requirements. The US Department of Commerce developed privacy frameworks in conjunction with both the European Union and the Federal Data Protection and Information Commissioner of Switzerland.〔(Welcome to the U.S.-Swiss Safe Harbor ) accessed 1 November 2015〕 Within the context of a series of decisions on the adequacy of the protection of personal data transferred to other countries,〔(decisions on the adequacy of the protection of personal data in third countries ) accessed 1 November 2015〕 the European Commission made a decision in 2000 that the United States' principles complied with the EU Directive - the so called "Safe Harbour Decision".〔[http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm 2000/520/EC: Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (notified under document number C(2000) 2441) accessed 1 November 2015〕 However, after a customer complained that his Facebook data were insufficiently protected, the European Court of Justice declared in October 2015 that the Safe Harbour Decision was invalid, leading to further talks being held by the Commission with the US authorities towards "a renewed and sound framework for transatlantic data flows".〔Vera Jourova, "Commissioner Jourová's remarks on Safe Harbour EU Court of Justice judgement before the Committee on Civil Liberties, Justice and Home Affairs (LIBE)", 26 October 2015〕 ==Background history== In 1980, the OECD issued recommendations for protection of personal data in the form of 7 principles. These were non-binding and in 1995, the European Union (EU) enacted a law to protect personal data privacy in form of the Data Protection Directive〔(Directive 95/46/EC of the European Parliament ) and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data〕 According to the Data Protection Directive, companies operating in the European Union are not permitted to send personal data to "third countries" outside the European Economic Area, unless they guarantee adequate levels of protection, "the data subject himself agrees to the transfer" or "if Binding corporate rules or Standard Contractual Clauses have been authorised."〔European Comission (15 June 2001)(Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries under Directive 95/46/EC15 June 2001 ), Official Journal L 181 of 04.07.2001.〕 The latter means that privacy protection can be at an organizational level, where a multinational organization produces and documents its internal controls on personal data or they can be at the level of a country if its laws are considered to offer protection equal to the EU. The Safe Harbour Privacy Principles were developed between 1998-2000. They were designed to prevent private organizations within the European Union or United States which store customer data from accidentally disclosing or losing personal information. US companies could opt into a program and be certified if they adhered to seven principles and 15 frequently asked questions and answers per the Directive. In July 2000, the European Commission (EC) decided that US companies complying with the principles and registering their certification that they met the EU requirements, the so called "safe harbour scheme", were allowed to transfer data from the EU to the US. This is referred to as the Safe Harbour Decision.〔European Court of Justice (2000/520/EC: Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council ) on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (notified under document number C(2000) 2441) (Text with EEA relevance.) 25 August 2000, retrieved 30 October 2015〕 On 6 October 2015, the European Court of Justice invalidated the EC's Safe Harbour Decision, because "legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life" (boldened in original text). 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「International Safe Harbor Privacy Principles」の詳細全文を読む スポンサード リンク
|