Safe Harbors.

You can still mail into Europe

Two-year-old privacy legislation in Europe is now storming the beaches of the United States and has direct marketers here looking for safe harbors for getting their message across the Atlantic.

The European Union (EU) wants organizations in the United States to take this privacy issue seriously and "let in the light" by telling individuals specifically what and why information is being gathered, said Charles A. Prescott, vice president, international business and government affairs, The Direct Marketing Association.

Secondly, the organization gives the individual another ability: "the right to refuse the data collection, unless the data is required by law or to fulfill a purpose to which the individual agrees, such as a hotel registration," Prescott added.

U.S. organizations must obtain consent, implicit consent in some cases, and more formally and explicitly in others, he added, with distinction being made on the personal or sensitive nature of the information.

An "adequate level of protection" is not directly defined in the EU Data Protection Directive, which went into effect Oct. 25, 1998. It placed numerous controls on the collection, use, and transfer of personal information in Europe. But, it does provide it through contractual clauses, a combination of self-regulation, sectoral professional codes and other devices, Prescott said.

Simply, whether or not some agreement can be made, that can meet the "adequate protection" requirement, is left to the judgment of EU officials, he said.

Playing it safe

"When a company becomes safe harbor compliant it files a letter with the U.S. Department of Commerce that states, 'we're subject to Safe Harbor DMA guidelines,'" said Prescott. "The Federal Trade Commission can bring action against a company for having made a misrepresentation to the consumer/public about their (privacy policy)."

Prescott continued, "Our safe harbor agreement creates a way for individual companies to qualify to be in safe harbor. The policy requires that the organization provide people, at the time of collecting the information, notification of exactly what the organization is going to do with their name/information."

The next step is for each company that implements internal privacy policies to tell the public that they are in compliance with the EU Directive.

According to Prescott, direct marketers have three choices from which to choose when bringing names and information in from Europe:

* Establish themselves in Europe with an agent representing the organization that secures approval from the local data protection authority;

* If renting a mailing list from Europe, enter into a contract with the owner of the list on how exactly the name and information will be used;

* Join safe harbor by certifying under EU that your organization will follow the regulations of the directive.

Governments in Europe are now getting serious that U.S. organizations follow the same privacy standards. "They (EU) don't think we have adequate protection for individuals and their information," said Prescott.

The directive is based upon principles derived from the 1984 guidelines on privacy from the Organization of Economic Co-operation and Development. The directive is based on a handful of basic principles, which also form the foundation of the Safe Harbor Principles.

The concept of safe harbor is not well known in the United States, said Prescott. "I recommend that every company has to look at where it is and how exposed they are to this," he said. "If (the organization) only deals with one list source they (might) solve it with one strong contract."

Prescott suggests organizations that deal with multi-list providers in Europe use safe harbor.

Becky Richards, director of compliance and policy for San Jose, Calif.-based TRUSTe, a 501(c)(6) organization that works with for-profit and nonprofits on Web site privacy certification, said by giving their seal of approval nonprofits can comply with the privacy guidelines.

Richards said, TRUSTe has created a program that is part of the safe harbor where organizations receive self-certification.

There are five steps to become EU safe harbor compliant, according to TRUSTe:

1. Craft a privacy policy that includes all of the safe harbor privacy practice principles;

2. Provide both online and offline customer dispute resolution with third party enforcement of the policy. "TRUSTe provides that for nonprofits seeking safe harbor compliance (with its seal of approval)," said Richards. "We provide dispute resolution."

3. Provide verification of Web site privacy practices;

4. Provide verification of offline privacy practices;

5. Self-certify compliance to the U.S. Department of Commerce.

Prescott said that The DMA also provides third-party resolution through its DMA Safe Harbor Enforcement Program, which will be available free of charge to DMA member as of mid-January.

"Under The DMA's Safe Harbor Enforcement Program we will refer matters to the Federal Trade Commission and state attorney general's office," he said.