Privacy, known in Europe as "data protection," looms as a serious trade issue between the United States and Europe. If the establishment of the World Trade Organization (WTO) represents an international statement in favor of global free trade, the European nations' data protection laws represent a threat to that regime. Currently at issue are countries' regulations governing financial privacy. Consumers and businesses on both sides of the Atlantic will benefit if the United States maintains a strong stand in trade negotiations to protect the free flow of information across borders and within the United States.

Under a European Union (EU) regime known as the Data Protection Directive, which took effect in 1998, an EU member nation may refuse to allow a U.S. firm operating in Europe to transfer personal data out of the country if privacy protection for the firm's data in the United States is determined to be inadequate. In July 2000, the U.S. Department of Commerce and European officials negotiated a "safe harbor" agreement describing what steps U.S. firms must take to satisfy the standard of "adequacy."1 The safe harbor agreement took effect in November 2000, but it did not apply to financial services companies. Financial services companies, Bush Administration Treasury representatives, and European officials carried out negotiations throughout 2001, with the Bush Administration rejecting Europe's first proposals.2

These negotiations are the latest stage in the evolution of privacy as a trade issue. U.S. lawmakers face pressure to reject the American tradition of the free flow of information and to develop a top-down regulatory regime for the governance of privacy and data. Some of this pressure stems from the differences between the EU countries and the United States: The EU countries have enacted broad data protection rules; the United States has not. Canada also has enacted a data protection regime similar to that in Europe.

The differential presents a classic trade problem. Country X prohibits or heavily regulates certain activity; country Y does not. The activity continues and expands in country Y, while representatives in country X become more frustrated. What should these countries do? Tolerate the regulatory arbitrage? Sanction country X to remove its regulations, or sanction country Y to adopt them? In large part, the answer depends on whether policymakers think that country Y or country X is doing the right thing. The assumption often is made that by passing data protection laws, the European nations are doing the right thing and the United States is not.

On close examination, this assumption is flawed. U.S. rules have favored the free flow of truthful information about real people and real events throughout the economy, with privacy as a carefully crafted exception rather than a default rule, and with protections for sensitive information that affects national security and defense. Only by protecting the free flow of information can consumers and firms around the world reap the full benefits of free trade.

PRIVACY AS A TRADE ISSUE

It may seem counterintuitive to consider privacy a trade issue. One might think that in regulating U.S. firms' compliance with data protection rules within European nations, those firms are merely being asked to comply with local law, and that familiar requirement does not usually raise trade issues. But this analysis is simplistic. The fact is that data protection rules do affect international trade.

A Historical Overview.
Since the horrors of the Holocaust, when census data were used to identify the households of ethnic and religious targets, Europeans have had a heightened sensitivity to privacy. As the national welfare states grew throughout Europe in the 1970s, the first "data protection" rules were enacted. The German province of Hesse passed the first law in 1970 in reaction to the computerization of information. Sweden passed the first national data protection law in 1973 at the time the country adopted national identity cards.

As these national laws were adopted, trade issues began to arise. For example, Sweden denied a British company a contract to make magnetic-stripe cards, finding that Britain's laws failed to give Swedish data enough protection. It is this component of data protection laws--the determination whether another country's laws are adequate--that transforms data protection laws from domestic matters into international trade issues.

Within the EU, the choice was made to avoid trade disputes not by restraining the application of data protection laws, but by harmonizing--or perhaps cartelizing--data protection across Europe. The first step came with the passage in 1981 of the Council of Europe's Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data. This was followed by the EU's Data Protection Directive, ratified in 1995. The preamble to the directive speaks of the importance of not permitting differences among national data protection rules to interfere with trade in goods and services across borders.3

From a European standpoint, "harmonization" of national laws under the Data Protection Directive would enable the creation of a free-trade zone for data within Europe. Each of the 15 EU nations would adopt some kind of data protection law within the guidelines of the directive. Regardless of the form that these national regimes ultimately take, the ratification of the directive means that there should be no more objections to free transfers of data within Europe.4

Regrettably, the directive transformed what was an intra-European trade dispute into an international one. The EU nations, having chosen to solve their own trade problem by adopting more regulation across the board (assuming for the moment meaningful compliance with the directive across Europe), rather than less, now find themselves at a competitive disadvantage compared with nations that allow the use of data with less regulation. This is not an unfamiliar situation; for example, European nations are also at a disadvantage because of their more tightly regulated labor markets. The directive stipulates that an EU nation may apply its data protection law to any data collector that collects or processes information within any EU state.5 Because the substance of the directive permits a determination of the adequacy of the legal regimes of other nations, the new data protection regime across Europe looms as a trade barrier between the U.S. and Europe.

The Adequacy Determination.
Specifically, Article 25 of the Data Protection Directive prohibits the transfer of electronic information to non-EU countries ("third countries") that do not provide an "adequate level of protection."6 Article 26 does suggest some exemptions and exceptions that allow information to be sent across borders even in a case of "inadequate" regulatory protections, such as the consent of the subject of the information, or protections built into the contract between the subject and the data collector.

Since the traditional American approach to privacy problems is far less regulatory than the European approach, it is likely that in some contexts EU officials will see U.S. protection as inadequate; in reality, the difference in protections reflects fundamental differences between U.S. and European ideas about business and the free flow of information.

It is the determination of "adequacy" that transforms the privacy question from a concern over compliance with local laws in Europe to an international trade issue. Ordinarily, a country's protections for its citizens stop at its own borders. A country doing business in France must comply with France's consumer protection laws; if a French citizen wants to travel from France to the United States, the French government does not undertake a determination as to the adequacy of U.S. consumer protection law or criminal law before allowing the travel. Under the Data Protection Directive, however, information about the citizens of European nations is "protected" even after it leaves the country; and unfortunately for trade, this will entail an inquiry into the "adequacy" of other nation's laws.

Perhaps the data protection laws technically do not offend traditional notions of jurisdiction. The European nation does not claim jurisdiction over the firm's behavior in another country, merely over the act of exporting certain data from the nation itself. Yet the notion of determining the "adequacy" of another country's laws is clearly a mischievous one.7 The EU nation may be regulating behavior within its borders, but the end goal is to affect behavior beyond those borders, even to the extent of insisting that foreign governments pass certain laws restricting information use.

Admitting the legitimacy of such an approach invites trade war upon trade war as nations take turns standing in judgment of one another's internal regulatory regimes. Indeed, some European nations' legal regimes could be deemed inadequate to preserve the economic benefits of the free flow of information to consumers, or their labor laws could be determined to be inadequate to protect free labor markets, and so on.

Data Protection or Data Protectionism?
Another reason that EU data protection laws present a trade issue is the danger that the rules adopted in Europe could effectively protect European firms from U.S.-based competition. Several factors contribute to this risk.

The standards of "adequacy" are not specified in the Data Protection Directive--leaving the various European nations with broad discretion as to how to enforce their data protection laws. In some nations, like Greece and Italy, regulatory enforcement is very lax. Even in the United Kingdom, it is believed that many companies do not comply with the new data protection law.8 There is evidence that data protection rules are not being enforced against Web sites; U.S. companies are far ahead of European ones in posting privacy policies online.9 Any U.S. firm that wishes to begin to process employee or customer data in Europe faces months of delay in winning approval from data protection regulators.10 For example, Spanish officials used data protection laws to niggle with Microsoft over the colors and typefaces in Windows 98.11 Yet it is far from clear that this level of compliance is being demanded of their foreign competitors.

Further complicating the issue, the principles underlying data protection laws are grossly overbroad; for example, in theory, a businessman who accepts a business card from a client in Rome and then decides to travel to New York must provide the client with some kind of explicit notice and opt-out before leaving the country. If the directive is taken literally, merely taking a laptop on an airplane is a tremendously controversial act.12 In practice, of course, it would be absurd to prosecute the travelers in such cases. But this means that there will be far more violations of data protection rules than cases worth prosecuting; enforcement can be arbitrary.

All of this will tempt European officials to insulate European-based firms from competition by focusing enforcement efforts on firms from outside the EU. At least, while negotiations continue regarding financial services, there has been no broad effort to enforce data protection laws against U.S.-based financial services companies.13

European authorities also should recognize that the de facto focus on U.S. or other foreign firms would harm European consumers by limiting choice and competition. It harms European businesses that deal with U.S. companies as well.14 Both parties to a free trade agreement benefit from the free trade. While free trade regimes such as the WTO have been established to address the threat of such regulatory protectionism, the agreements leave individual national governments with considerable leeway to take protectionist measures so long as the law can be justified by some colorable excuse. Thus, some European restraints on the import of beef grown with certain hormones or restraints on television programming with certain cultural content remain in place. Data protection rules could turn out to be another such instance.

The free flow of consumer information within the U.S. economy has made the United States one of the world's most powerful service economies. To abandon this general principle would be to sacrifice one of America's foremost competitive advantages in the global economy. Competition between nations' regulatory regimes provides a check on over-regulation worldwide.

APPLICABLE PRINCIPLES IN EXISTING AGREEMENTS

Privacy policy generally should not be considered in isolation from trade policy. Trade negotiators should be aware of how addressing one set of principles affects the other. Several existing trade agreements incorporate relevant principles.

SHOULD DATA PROTECTION BE ON THE WTO'S AGENDA?

Like any extremely vague regulation, data protection rules could easily be applied in a discriminatory manner that reduces competition from foreign businesses operating in an EU nation. At an even more basic level, a restriction on the movement of information across borders clearly is a barrier to trade. The question remains, however: What is the proper forum for addressing this type of trade issue?

Several commentators have considered the possibility of raising privacy and data protection at the WTO,31 but raising the issue at the WTO could be a double-edged sword. Note, first, that there are two ways to bring data protection issues to the attention of the WTO. One way is to challenge EU nations' decisions to exclude U.S. firms on data protection grounds under the WTO's existing nondiscrimination principles. Clinton Administration officials had stated their willingness to do so if European nations began to exclude U.S. firms on data protection grounds, saying that "if we have to go to the WTO, we will."32 Such a step might indeed be desirable and would further the debate about whether, as some EU officials have urged, the world really needs to concede to Europe's insistence on data "protection." The harder question is whether data protection should be an agenda item at future WTO talks.

Adding privacy to the WTO agenda opens the possibility of developing new GATT or GATS principles that specifically address the data protection issue. Peter Swire, former White House Chief Counselor for Privacy, and Robert Litan, Brookings Institution Chair of Economic Studies, warn that the WTO may be an inappropriate forum for "complex issues such as privacy protection that are only modestly related to free trade and protectionism."33 This argument is weak; privacy is certainly complicated, but data protection laws are directly related to free trade because they restrain the free movement of information across borders. In this respect, privacy is much more obviously a trade issue than is, say, the environment.

Swire and Litan also point out, however, that the WTO may be dominated by EU officials who would prefer a more regulatory approach than that taken by the United States. Indeed, EU officials have supported the inclusion of e-commerce in the WTO's agenda for treaty talks, and one of their interests would be to further the cause of more data protection regulation worldwide.34

Principles developed at the WTO that challenge the EU justifications for limiting the flow of information across borders might be good for free trade. But then again, the new principles might be bad for trade and competition, creating exemptions from free trade principles (like the existing exemption in GATS) that would bring to a premature end the debate about whether data protection rules are a justifiable limit on free trade. Another temptation would be to accede to a global privacy regime to defuse the potential for protectionism with national data protection rules35 --when substantive questions exist as to whether following the EU privacy model would cause more harm than good for consumers and national economies.

At this point, it is still unlikely that data protection will become an issue at WTO negotiations, given the difficult nature of many of the other items on its agenda, such as agricultural quotas. Nevertheless, privacy eventually will arrive on the international trade stage either as an agenda item for a meeting or in a dispute resolution forum. When it does, U.S. negotiators should stand firm to preserve the freedom of trade when facing pressure to impose stricter data protection regulations.

THE REAL DEBATE FOR TRADE NEGOTIATIONS

The simple fact that Europe's data protection rules are different from those of the United States might lead one to the view that the main direction in trade negotiations should be toward more uniform rules. But treating this as the main issue assumes that objections to uniform rules based in considerations of national sovereignty or the need for competition between different regulatory regimes are unimportant--an assumption that the foregoing analysis shows is unwarranted. It also assumes that it does not make much difference which set of rules is adopted so long as the rules are uniform.

In reality, however, this latter assumption is also unwarranted. In fact, for both consumers and business, the U.S. regime, which favors the freedom of information, is superior. If the uniform rules follow the European model, the benefits of uniformity are likely to be outweighed by the costs of over-regulation.

The debate about privacy regulation has often presented a false dichotomy between morality and economics. In the context of trade negotiations, the dichotomy will likely be presented, initially at least, as free trade vs. human rights or consumer protection. (While the WTO exempts laws that protect "human rights" from being struck down as trade barriers, there has been little or no discussion of how this might affect the privacy debate.)

If the debate is allowed to be framed in this manner, free trade could be the loser--undeservedly so, because data protection regulations should not be serious contenders as "human rights" or "consumer protection" rules, as those terms are generally used. Indeed, the free movement of information across borders has a stronger claim to recognition as a human right--and offers a net benefit to consumers and economies.

GUIDELINES FOR TRADE NEGOTIATORS

U.S. negotiators in trade talks would do well to keep in mind these points when discussing data protection:

• The free movement of consumer information across borders is a key part of a free economy and a free society. There is no need for U.S. businesses or government representatives to "apologize" for the U.S. approach to privacy. In the United States, the presumption against commercial regulation--allowing privacy regulation to trump the free movement of information only in exceptional cases--is morally and economically the superior position. Freedom of information has a far more respectable philosophical pedigree than novel principles of "data protection." Studies show that the costs of more privacy regulation to consumers are likely to far exceed the benefits.
  
  
• European consumers and businesses would also benefit from less regulation. Companies from the United States enter European markets to provide services to European consumers and businesses. They increase competition in European markets. Despite the recent economic downturn, the United States is still the world's greatest service economy, and the freedom to innovate with new uses of information has a great deal to do with that. Europe would do well to follow the U.S. example.
  
  
• The focus of privacy efforts should be on the threats to privacy posed by government over-regulation. Whether in the United States or Europe, governments have unique police powers that the private sector lacks, and thus pose a greater risk to misuse of information. In the United States, the Constitution, particularly the Fourth Amendment, provides significant protection for privacy where it is most threatened: in criminal cases. By contrast, the Data Protection Directive actually exempts criminal cases from the scope of its privacy protections.
  
  
• The facts about European data protection laws should be sought from firms and individuals doing business within the EU. Numerous key questions remain about the impact of data protection rules in European nations. What has the cost of these rules been? What has the effect of the rules been on small businesses and new business ventures? On the detection of fraud and the assessment of credit risk? How are the laws enforced? Official European sources may not be the best source for this information. The other side of the story should be sought from European businesses. Because data protection is such a radical departure from the tradition of freedom of information, the burden of proof should be on advocates of the regulation to show that it would do more good than harm.
  
  
• U.S. trade agreements should not adopt data protection as a means of satisfying EU requirements. This would set a terrible precedent for future trade disputes concerning labor and environmental regulation. It would also set a bad precedent for U.S. economic relations with Canada, another country that has adopted data protection laws similar to those in Europe--but without (so far) engaging in any inquiry into the adequacy of protections for Canadian data in the U.S. Moreover, a diet of data protection harms the emergence of innovative businesses and new consumer services, especially in developing countries.
  
  
• U.S. officials should be aware of discussions of data protection in other areas of the world. As in the United States, European officials are making the case for more restrictive data protection rules in other countries, particularly Asian countries. The adoption of tough data protection rules everywhere else would give the United States a competitive advantage from an economic standpoint, but we might well benefit more from the increased world economic growth that would be enabled by less regulation worldwide.
  
  
• In the area of financial services, the privacy provisions of the Gramm-Leach-Bliley Act are more than sufficient. In ongoing negotiations, EU officials may take the position that current privacy regulations for financial services, which allow consumers to opt out of inclusion in many marketing lists, are "inadequate." Many privacy advocates prefer an "opt-in" system. But consumers may find an opt-in system even more intrusive, and its costs are enormous. U.S. West, one of the few businesses in the United States to operate under a European-style opt-in system, found it cost $30 per customer contacted to obtain a consent and required an average of 4.8 calls to each household before the company reached an adult who could grant consent.43 U.S. trade representatives should not accept the view that opt-in regulation for financial services would benefit consumers.
  

CONCLUSION

Even in Europe, data protection dates back only as far as the 1970s, and at that time was intended mainly as a restraint on government information processing. As compared to the strong legal tradition of the freedom of information and the proven benefits of free trade, data protection has dubious justifications.

The foregoing analysis shows that European insistence on judging the "adequacy" of U.S. law before allowing trade in information to proceed is incompatible with the ordinary exercise of national sovereignty. "Data protection" laws can be expected to operate as trade barriers. The "safe harbor" approach to this problem has not eliminated this problem, both because of restrictive European interpretations of its principles and because its principles themselves are vague and overly regulatory. The "model contract" approach taken so far for financial services has likewise not succeeded well, again because the contracts supported so far by European officials do not seem to recognize fundamental business realities.

The Bush Administration has done the right thing so far in rejecting this approach. European officials who come to discuss information policy with U.S. representatives should realize that they have as much to learn as they have to teach.

Solveig Singleton is a lawyer and senior analyst with the Competitive Enterprise Institute's Project on Technology and Innovation.