Global Flow of Personal Information Raises Consumer Privacy Risks

Two new studies call for stronger laws and corporate accountability

Washington — October 27, 2009 — As global companies and their customers increasingly rely on the Internet and advanced technologies for innovation and service, the diverse and sometimes contradictory laws and regulations of individual countries create a high-risk environment for both consumers and business that technology alone cannot resolve.

The Centre for Information Policy Leadership at Hunton & Williams LLP and The Privacy Projects, a non-profit devoted to privacy research, today announced the release of two research papers on corporate accountability and global movement of personal data. Both papers provide insight into organizational accountability, a concept that may be the key to addressing the issues of consumer privacy protection when data moves across international boundaries. Data protection accountability would set privacy protection goals for companies based on specific outcomes, supported by laws, self-regulation, and best practices.

The Centre's paper, "Data Protection Accountability: The Essential Elements," defines the essential elements of data protection accountability and recommends an accountability approach to information privacy protection. The paper represents the results of the Galway Project, an effort initiated by an international group of experts from government, industry and academia, including representatives from Intel Corp., Procter & Gamble and Eli Lilly, among others, to set privacy protection goals for global organizations.

"At a time when the responsibility for data protection is under review, this paper charts the course for establishing accountability-based data protection and motivating stakeholders to take the important steps in regulating information management," said Martin Abrams, the Centre's executive director.

The Privacy Projects' report, "Managing Global Data Privacy: Cross-Border Information Flows in a Networked Environment," written by Paul Schwartz, professor at the University of California, Berkeley, School of Law, investigates how six global companies protect personal data when moving data across national boundaries. 

"Laws and regulations governing data flows across borders have been outpaced by technology," said Richard Purcell, executive director of The Privacy Projects. "In the past 10 years, the flow of data has grown exponentially, setting the stage for an evolution in managing global data privacy."

"Successive revolutions in information technology have raised new challenges, risks and opportunities for consumer privacy protection," said Paul Schwartz, the paper's author. "This report illustrates the actual practices of global companies in processing personal information. A key finding of the report is the widespread extent to which global companies are adopting use of the 'cloud,' or of networked computer resources, to transfer personal information on a global basis."

The Centre and the Privacy Projects hosted a virtual press conference to discuss the research papers.

About the Centre for Information Policy Leadership

The Centre for Information Policy Leadership at Hunton & Williams LLP is a global think tank led by internationally recognized privacy professionals who are consistently ranked among the best in their field. The mission of the Centre is to develop practical and innovative approaches to information governance that foster robust use of data while respecting privacy and civil liberties. Privacy professionals at member companies look to the Centre’s analysis and processes to evaluate and improve their information practices. Visit the Centre website via this link.

About The Privacy Projects

The Privacy Projects (TPP) is an independent non-profit corporation established in 2008. It funds academic research into "evidence-based" privacy to enhance policies, practices and tools necessary to meet the power of the new technologies. The Privacy Projects is based in Nordland, Washington.