CFP96 Paper
CFP96 Paper
The general pressures to conformity have increased as more and more countries have joined the "data protection club." At the end of 1995, of 24 OECD countries, only 7 (the US, Canada, Australia, Japan, Italy, Greece and Turkey) have failed to enact a comprehensive data protection statute, overseen by an independent oversight agency. The issue is firmly on the political agendas in each of these countries, with the exception of the United States.
To the extent that privacy protection policy will continue to converge, therefore, it will probably do so at high levels of generality. A continued convergence of the principles of data protection, and to some extent of the instruments through which those principles are enforced, does not necessarily mean a convergence of practice. Even in Europe, therefore, convergence will only extend to the expected principles rather than the observed practices, as no national data protection authority has the resources to audit organizations on a continuing basis to ensure that "adequate levels of protection" are indeed met. None, moreover, has been able to develop a yardstick by which to evaluate how a "level" of data protection may be observed, let alone measured (Raab & Bennett, 1995). The translation of fair information principles into fair information practice is a slow, halting and frustrating process which demands more than legal fiat and regulatory power. It also requires a shift in organizational culture and citizen behaviour which is dependent on a complicated and fluid set of organizational, cultural, economic and technological forces.
Proponents of a global privacy protection policy also have to confront the likelihood that policy convergence will never extend to every country on the GII. It will probably not even extend to the United States where privacy policy will continue to be susceptible to the vagaries of a fragmented and reactive political system in which anti-privacy interests will always be strong. This is ironic as the modern theory of "information privacy" and the associated "fair information practices" doctrine was largely an American invention. This American exceptionalism will continue to be justified with a number of specious arguments that proceed from the faulty assumptions that the US is "different" and that the hodgepodge of federal and state laws enforced through the courts amounts to data protection by other means.
The CSA Model Code is a different instrument from those "voluntary codes" developed by companies or trade associations. It is a standard and has the potential to operate in the same way as many other quality assurance standards (such as those within the increasingly popular ISO 9000 series). Organizations would be pressed by government, clients and/or consumers to demonstrate that they implement fair information practices, would adopt the standard and would then be obliged to register with an accredited certification or registration body. The scrutiny of internal operational manuals and/or onsite auditing would hopefully be a prerequisite for maintaining a registration (Bennett, 1995).
In 1995 the International Standardization Organization (ISO) began to examine the feasibility of an ISO privacy standard based on the Canadian model. Such a standard would assist international business in its attempts to claim an "adequate" level of data protection. It would bolster the enforcement of the EU Directive. It could add an important instrument of enforcement even within societies that have omnibus data protection law. A standards-approach is based on the assumption that higher levels of privacy awareness are required in some organizations over others, and that over time these higher standards would be forced through marketplace and governmental pressure.
An ISO privacy standard is not a replacement for law, which still constitutes the only instrument by which a society as a whole can draw a line between acceptable and unacceptable practices. On the other hand, an ISO standard could prove a valuable policy instrument that might "plug the leaks", enforce the adequacy standard within the EU Directive, subject the worst abusers of personal information to regular auditing and be more flexible than law to the new surveillance challenges of the global information infrastructure.
________. (1995) Implementing Privacy Codes of Practice: A Report to the Canadian Standards Association. Rexdale: CSA.
Canada, Information Highway Advisory Council (IHAC). 1995. Connection, Community, Content: The Challenge of the Information Highway. Ottawa: Minister of Supply and Services.
Canadian Standards Association (CSA). 1995. "Model Code for the Protection of Personal Information". CAN/CSA-Q830-1995 Rexdale: CSA.
European Union (EU). 1995. Directive on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data. Brussels, OJC 93, 13 April 1995.
Charles D. Raab & Colin J. Bennett. 1995. "Taking the Measure of Privacy on the Information Highway." Paper
Back to CFP96 plenary session page