Ronald L. Plesser
Emilio W. Cividanes
Alisa M. Bergman
Piper & Marbury L.L.P.
1200 Nineteenth St., N.W.
Washington, D.C. 20036
(202) 861-3900
Date: May 14, 1999
The Individual References Services Group ("IRSG") welcomes the opportunity to submit comments to the Department of Commerce ("Department") on the revised safe harbor documents. The IRSG commends the Department on its continued efforts to harmonize the distinct approaches to privacy protection taken by the United States and the European Community. As we indicated in our previous comments, members of the IRSG are very supportive of the safe harbor concept, recognizing that this undertaking is a viable means by which to allow for minimal interruption of the transborder flow of personal data.
Nonetheless, we are concerned with some of the finer points of the safe harbor discussions as reflected in the current drafts. Specifically, we believe that the European Commission's proposal for limiting the public records exemption to only United States public records would in most cases render the exception a nullity. It also (1) runs afoul of Article 26.1(f) of the Directive and (2) potentially threatens to limit or foreclose the wide array of productive and socially beneficial uses of European Union public record information distributed through services such as the ones that the IRSG members offer.
I. The Services Offered IRSG Members
The IRSG is composed of leading companies in the business of providing information that assists users in identifying and locating individuals. Members of the individual reference services industry offer unique access to databases of information, largely comprised of public record information, that are used for a broad range of socially beneficial purposes including: child support enforcement efforts, consumer protection, locating organ and bone marrow donors, locating missing pension fund beneficiaries and heirs, and real estate transactions. These services also assist in important governmental functions such as military recruitment, revenue collection, tracing fraud, apprehending criminals and, locating witnesses.
Members of the individual reference services industry provide an invaluable source of information to numerous different people. From welfare mothers trying to enforce child support orders, to businesses performing due diligence and risk management, to government agencies conducting background checks on childcare or nursing home workers, individuals and businesses in both the private and public sectors alike benefit tremendously from the widespread dissemination of public record information made possible, in large part, through the services IRSG members offer.
Users of IRSG services are growing ever more reliant on the efficient, affordable flow of information. These users' abilities to effectively perform their respective tasks is heavily dependent upon unfettered access to this information. The IRSG members are important suppliers of data for these users and, as such, access to and use of this information that is unencumbered by onerous requirements is critical to enabling the beneficial uses that inure from the use of public record information.
II. The Public Records Exemption
The IRSG strongly supports an exemption for public record information and believes that such an exemption makes great strides toward ensuring that the widespread dissemination of public record information continues to flourish. The IRSG requests, however, that the Department (1) include onward transfer within the exemption; (2) clarify the scope of this exemption with respect to US public records; and (3) ensure that the exemption applies to information derived from EU public records.
A. The exemption should apply to the onward transfer of information
Draft Access FAQ No. 7 would exempt public records from the access, notice, and choice principles. The IRSG believes that the FAQ also should exempt public records from the onward transfer principle, which is primarily a corollary of the notice and choice principles. Indeed, the text of the onward transfer principle begins: "An organization may only disclose personal information to third parties consistent with the principles of notice and choice." For the same reasons that public records would be exempt from both notice and choice, they also should be exempt from onward transfer.
If the onward transfer principle were to apply to public records, the Commission's proposal to require explicit notice and choice whenever personal data is transferred to a third party that does not adhere to the safe harbor requirements would be devastating to the extent that it prevents an IRSG member that "directly" participates in the safe harbor program from subcontracting work to another company that does not "directly" participate. The Department's proposal would prevent such subcontracting even if the second company agrees contractually to comply with the safe harbor principles when processing European sourced personal information. Such an approach would severely limit the viability of the safe harbor program.
B. The Department should clarify the scope of the exception
The public records exception's requirement that public record information be kept separate form other information is unnecessarily broad. It should not be interpreted to sweep into the safe harbor those compilations of public record information that use small amounts of other information as organizing or indexing mechanisms.
As currently drafted, the exception for public records would enable, for example, IRSG members to provide database services containing electronic facsimiles, abstracts, and abridgements of public records and to provide products that consist of compilations of public record information. We note that some companies may use other information--for example, address data from a telephone directory, or the year of birth of an individual from the identifying portion of a consumer credit report--as an indexing tool. They then use this information to help match public record information to that individual rather than to other individuals with the same or a similar name.
The draft safe harbor proposal's exception for public records is not absolute. Rather, it would be limited to only public information that "is kept separately from other information." We understand that the principal purpose of this limitation is to ensure that the inclusion of public record information compilations of non-public information does not render the compilations exempt from the safe harbor principles.
The limitation to the exception for public records should, however, be construed functionally to serve its goal of defining the exception's scope; it should not be construed to serve as an obstacle to indexing mechanisms for improved accuracy in the compilation of public record information about individuals. Just as a company should not be able to shield a database of personal information from the safe harbor principles by the inclusion of some public record information, a company's compilations of public record information should not become subject to the principles merely because the company seeks to increase the accuracy of its information products by using a de minimis amount of non-public record information as an indexing tool. It would be ironic for the Department's principles to discourage the very accuracy that the Federal Trade Commission and others are seeking from IRSG members in their compilation products.
Accordingly, the access FAQ should either (1) substitute an exclusion for combinations of non-public information with a small amount of public record information designed to evade the requirements of the safe harbor; or (2) specify that use of non-public information as organizing or indexing mechanisms or, in small amounts, to make the compilation more accurate, falls within the scope of the public records. It should also clarify that where an organization offers access through a separate channel to the non-public record information included in a compilation--as the IRSG's principles require of its members--the compilation itself remains within the public records exemption.
C. The exemption should not be limited to Unites States public records
Endnote no. 7 to the access FAQ indicates that the EC proposes to limit this exception to United States public records. Given that the majority of public record information transferred to the United States will be from European sources, the Commission's proposal in most cases would render the public records exception a nullity. The Department should insist that the public records exception apply equally to both European and United States public records.
From both a policy and practical standpoint, applying access and the other principles to European public records would effectively foreclose the wide array of productive and socially beneficial uses of European Union public record information distributed through services such as the ones that the IRSG members offer.
From a legal perspective, Article 26.1(f) of the Directive would seem to contradict the EU's proposal. Article 26.1(f) states in relevant part:
Member States shall provide that a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection . . . may take place on condition that . . . the transfer is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case.
In light of the plain language of the EC Directive, the Department should insist on coverage of all public records under the exemption and not only of US records.
Moreover, it is by no means clear whether European organizations comply with access requirements in connection with European public record information. Consequently, the Department's proposal could hold US companies to higher standards than those required of Europeans, putting them at a competitive disadvantage.
III. Data Integrity
The essence of the data integrity principle is found in the text of the second sentence, which sets out a sliding scale of data accuracy, completeness, and currency as a function of the purpose for which the information is used. It is similar to the IRSG's accuracy principle. However, it is important to note that, in the context of public record information, the goal of an individual reference service is to furnish customers with reasonably accurate reproductions of information in governmental repositories of public record information. If public record information contains an inaccuracy, the individual reference service is not free to alter the substantive content of the information. Rather, the data subject must get the governmental entity to make the correction and include it in its next distribution of the public record information to the various vendors of information products and services.
IV. Conclusion
As currently drafted, the public records exemption aids in bridging the information practices of the US with those of the EC. Nonetheless, this exemption should be strengthened, not weakened. With some modifications, including applying the exemption to the onward transfer principle, clarifying the scope of the exemption, and ensuring that the exemption is not limited to only US public records, the beneficial uses of public record information will continue to thrive. The IRSG looks forward to continuing to work with the Department as it proceeds with these discussions and refines the safe harbor principles.