May 14, 1999
VIA HAND DELIVERY & E-MAIL (Ecommerce@ita.doc.gov)
The Honorable David L. Aaron
Under Secretary of International Trade
U.S. Department of Commerce
14th Street & Constitution Avenue, NW
Room 3850
Washington, DC 20230
Dear Ambassador Aaron:
LEXIS-NEXIS is pleased to submit these comments in response to your letters of April 19 and April 30, 1999 setting forth proposed Frequently Asked Questions (FAQs) to supplement Safe Harbor Principles as part of an agreement with the European Commission concerning application of the E.C. Data Protection Directive to data flows to the United States. LEXIS-NEXIS is a signatory of the principles of the Individual Reference Services Group (IRSG), which has filed comments in this proceeding. We write separately to emphasize the importance of excluding public record information from the scope of the safe harbor privacy principles, and to commend the Department of Commerce ("the Department") on its FAQ addressing the treatment of media archives under the U.S.-E.C. agreement.
I. LEXIS-NEXIS
LEXIS-NEXIS, a division of Reed Elsevier Inc., is headquartered in Dayton, Ohio, employs 7,800 individuals, and is the world's leading provider of enhanced information services and management tools in online, Internet, CD-ROM and hard copy formats for legal, news and business professionals. Serving customers in more than 60 countries, sales representatives are located in 50 U.S. cities and around the world, including London, Frankfurt, Hong Kong and Toronto.
LEXIS-NEXIS leads the information industry with the largest one-stop, dial-up information service, the LEXIS-NEXIS service for legal, business, and government professionals. The LEXIS-NEXIS service contains more than two trillion characters and approximately two billion documents in more than 8,700 databases. It adds 6.8 million documents each week.
Today, 1.6 million professionals worldwide--lawyers, accountants, financial analysts, journalists, law enforcement officials, and information specialists--subscribe to the LEXIS-NEXIS services. They perform more than 400,000 searches per day. The combined services contain more than 24,800 sources:18,800 news and business sources and 6,000 legal sources.
The NEXIS service is the largest news and business online information service, with not only news, but company, country, financial, and demographic information, as well as market research and industry reports. The NEXIS service is unmatched in depth and breadth of information, offering more than 18,800 sources of news and business information. In fact, 120,000 new articles are added each day from worldwide newspapers, magazines, news wires and trade journals.
LEXIS-NEXIS also is a founding member of the IRSG. Although LEXIS-NEXIS does not at this time use personal information from the European Union for its individual reference services, we do distribute a small number of public records from both European and non-European countries. As a consequence, we have an interest in the content of privacy principles that govern practices in the United States and the European Union and in emerging international approaches to privacy.
II. PUBLIC RECORDS AND PUBLICLY AVAILABLE INFORMATION EXCEPTIONS
Proposed FAQs 7 and 8 regarding access ("access FAQs 7 and 8") exempt public records and publicly available information from the access, notice and choice requirements of the safe harbor. LEXIS-NEXIS understands that these exemptions will be extended to the onward transfer requirements. It is essential that they be expanded to cover onward transfer and aspects of the integrity and enforcement principles.
As LEXIS-NEXIS explained in its November 1998 comments regarding the Department's proposal for a safe harbor, the public records exception reflects a cherished American tradition that should continue to govern privacy practices in the United States and serves numerous beneficial public purposes. In these comments, we focus specifically on the proposed language of FAQs 7 and 8 of the April 19th letter, and the April 30th FAQ on journalistic exceptions.
LEXIS-NEXIS supports the core concepts of the FAQs, but has concerns and recommendations regarding specific language.
A. Requirements that Public Record Information and Publicly Available Information be Kept Separately
LEXIS-NEXIS believes that this condition on eligibility for the public
record and publicly available information exceptions, contained in access
FAQs 7 and 8, is unnecessarily broad. We appreciate the concern, expressed
for example in footnote 8, that entities might
attempt to shield non-public information from safe harbor coverage
by combining it with public record information.
However, there is an even greater risk that a formalistic rule would have the opposite effective of bootstrapping in material that is not covered by the safe harbor requirements simply because it is stored with any other information. Such formalistic requirements regarding storage of public record or publicly available information have no bearing on the privacy interests sought to be advanced by the safe harbor agreement, and could be misused in the event of a trade dispute.
In the case of public record information, use of information from other sources (for example, telephone directory information) to index or otherwise organize public record information, or use of a small amount of other information to make the public record compilation more accurate (for example, appending postal standard addresses to drivers' license records), should not make the entire compilation subject to all the requirements of the safe harbor. Furthermore, in the event that the organization offers access to the parts of the compilation that are obtained from other sources, it should not be required to provide access to the compilation.
A better approach may be to address the concern about circumventing the safe harbor through compilations directly. Both FAQs could instead specify that combinations of information covered by the safe harbor with exempted public records or publicly available information conducted in whole or in part to avoid the fair information practices requirements of the safe harbor disqualify the compilation from safe harbor treatment.
Recommendations:
· The final clause of FAQ 7 ("as long as it is kept separately from other information") and the last sentence of FAQ 8 should be removed and replaced with an exclusion for combinations of other information with public record or publicly available information designed in whole or in part to evade the requirements of the safe harbor.
· Alternatively, the FAQ 7 final clause and the FAQ 8 final sentence should be amended to specify that combinations of public record information or publicly available information with other information subject to the safe harbor fall within the applicable safe harbor exception where: (1) that other information serves as an organizing or indexing mechanism, (2) is used in a relatively small amount, to make the compilation more accurate, or (3) the organization offers access through a separate channel to the exempt information included in a compilation.
B. Application to U.S. Public Records
Furthermore, the "as long as it is kept separately from other information" condition at the end of FAQ7 should be deleted entirely unless FAQ 7 covers only European public records. U.S. public records are of course compiled in the United States and are governed by a long tradition of U.S. law. Even if versions of these records are forwarded to Europe, then returned to the United States, they do not relate to interests of the European Community and its member states. In fact, Article 26(1)(f) of the Data Protection Directive specifically exempts transfers from public record registers from the Article 25 third-country transfer restrictions. Subjecting transfers of U.S. public records back to the United States to the safe harbor would needlessly inject a barrier to trade between the U.S. and E.C. that would work against the United States' comparative advantage in information services.
C. Scope of the Exceptions in Access FAQs 7 and 8
In its safe harbor comments submitted last November, LEXIS-NEXIS urged that the public records exception apply to the entire safe harbor, instead of only to its access requirement. In its current form, the public record exception of FAQ 7 applies to access, notice and choice. While this represents progress, LEXIS-NEXIS urges the Department to work hard to extend the exception further. As a compromise, we propose that the exception cover the closely related onward transfer requirement, as well as aspects of data integrity and enforcement.
We understand that negotiations have contemplated extending the exemption so that it covers the onward transfer requirement. This is clearly the correct result--particularly in the case of public records and publicly available information, which are freely available to the public--because the onward transfer requirement is a corollary to, and simply addresses in a different context, the notice and choice requirements. By the very terms of the onward transfer requirement, if the notice requirement is totally inapplicable to the information in question (instead of not being required for the particular transferring organization's use of the data) then the onward transfer requirement should be inapplicable as well. An alternative result could place needless restrictions on joint venture arrangements involving information that is readily available to the public and in no way private.
In addition, LEXIS-NEXIS urges that access FAQ 7 clarify that the accuracy and currency elements of the data integrity principle must apply somewhat differently in the unique contexts of public record and publicly available information. Indeed, the IRSG principles, which LEXIS-NEXIS is proud to have helped develop, contain a similar data integrity requirement. Commercial public record services, for example, aim to provide accurate reproductions of the original public record source. This is the purpose for which they have gathered the information, and the services can do no more than accurately reproduce the source material.
Similarly, commercial public record and publicly available information services aim to provide reasonably "current" information--dependent, of course, upon receiving current updates from the source of the records. However, one of their other important functions is also to provide historical information. For example, land records list previous owners and property value over time. A requirement that data be current simply makes no sense in the context of such an archive. Accordingly, if the FAQ does not exclude the integrity requirement altogether, it should reference that the integrity requirement should be applied consistent with the nature of and multiple uses of public record and publicly available information, which may be somewhat different from the purpose for which the information was collected by the records source.
Finally, to the extent that the enforcement principle applies in this context, it should be amended by inserting the word "applicable" before the phrase "safe harbor principles" in the beginning of the first sentence of the principle. This clarification is important because under the terms of many of the FAQs, only some of the principles will be applicable to the data in question. Leaving overbroad language in the text explaining the enforcement principle without a specific limitation in each FAQ could create needless confusion.
Recommendations:
· Amend access FAQs 7 and 8 to exempt public record and publicly available information from all of the principles, or
· Clarify that the public record and publicly available information exceptions cover onward transfer, and
· Clarify that the integrity principle should be applied to public record and publicly available information, if at all, in a manner consistent with the nature of and multiple uses of this information, and
· Amend the first sentence of the enforcement principle to clarify that its requirements relate only to "applicable" safe harbor principles.
III. JOURNALISTIC MATERIALS
LEXIS-NEXIS is proud to offer the premier news archive in the United States. Its files include newspapers, periodicals and transcripts of media stories from leading news sources throughout the United States and the world that serve a wide range of important journalistic, research and commercial functions.
We thank the Department for its defense of both First Amendment values and the sensible operation of media archives through the Journalistic Exception FAQ issued on April 30th, as well as access FAQ 8, which specifically mentions newspaper archives. LEXIS-NEXIS agrees with the Department that including both FAQs provides helpful protection and clarity, although FAQ 8 standing alone would be inadequate to protect First Amendment freedoms and the operation of media archives.
A. Journalistic Exception FAQ
With regard to the Journalistic Exception FAQ, we urge the Department to reject the ambiguous suggestion of the E.C. that "'some' Safe Harbor principles could apply" in this context. For example, in the context of archived journalistic reports, a requirement that data be "accurate, complete and current," as provided in the integrity principle, could well be misinterpreted as creating a right of correction as well as a right to object to excerpting of archived news reports residing in the United States. This result would be antithetical to First
Amendment freedoms, and the purpose of the FAQ. For example, it would defeat the essential purpose of a news archive by eliminating the assurance that it contained the same information as the original news story, and by creating the anomaly that the same report could vary across news archives attempting to carry the same material. Furthermore, the archives by their very nature have both current and older materials, and suggesting that individuals may have the right to excise older stories would be a form of post-public censorship antithetical to the purpose of an archive.
The security principle is a form of additional regulation that is unnecessary in light of the strong intellectual property interests in preventing unauthorized, access, use or disclosure of the information. Furthermore, in the context of material protected by the First Amendment, subjective standards such as "misuse" in the security principle raise serious vagueness and overbreadth concerns.
Similarly, applying the enforcement principle to journalistic archives located in the United States would raise serious First Amendment difficulties. See, e.g., Cox Broadcasting v. Cohn, 420 U.S. 469 (1975) (striking down on First Amendment grounds a privacy prohibition punishing revealing truthful information obtained from publicly available sources).(1)
B. Access FAQ 8 Regarding Publicly Available Information
In addition to modifying or eliminating its last sentence regarding combining data discussed in Section II above, LEXIS-NEXIS recommends that the question that begins the FAQ be modified to read "journalistic archives," rather than "newspaper archives." Periodicals and transcripts of broadcast reports are a critical source of news archives, and the FAQ would be both more descriptive and more helpful if it used the broader term.
IV. CONCLUSION
For the foregoing reasons, LEXIS-NEXIS urges the Department to expand the public record and publicly available information exemptions by: (1) eliminating formalistic restrictions on the manner in which such information is stored, (2) clarifying that U.S. public records are exempt from the safe harbor requirements, and (3) either (a) exempting public record and publicly available information from the safe harbor entirely, or (b) exempting them from the onward transfer requirement, narrowing the application of the accuracy and currency elements of the integrity requirement, and clarifying that the enforcement requirement relates only to applicable safe harbor principles.
LEXIS-NEXIS further commends the Department for its work on the Journalistic Exception FAQ, and urges that it reject E.C. suggestions that the integrity and security principles apply to information stored and disseminated through media archives.
We very much appreciate the Department's work on these important issues, and look forward to working with you further as you continue your dialog with the E.C. on refinements to the safe harbor principles and FAQs.
Sincerely,
Gail H. Littlejohn
1. Our comments do not address the numerous concerns raised by applying the requirements of the notice, choice, onward transfer and access principles in this context, but these are of course no less problematic and constitutionally suspect.