Case study:

• Privacy International versus Amazon UK
  a series of letters orchestrated by Simon Davies (Privacy International Director) - Sept-Dec 2000
  • 09/14/00: original inquiry to Amazon UK
  • 12/04/00: complaint to the UK Data Protection Commissioner
  • 12/04/00: belated(?) response from Amazon UK
  • 12/05/00: demands made to Amazon UK
  • 12/06/00: complaint re-iteration
  • 12/13/00: a cautious rejoinder from Amazon UK
  • 12/xx/00: parting shots made to Amazon UK
• for context, see 09/13/2000: Junkbusters versus Amazon.com

Topic notes

Relevant legal, regulatory documents and bills under discussion:

• the Children's Online Privacy Protection Act (COPPA) (15 USC sections 6501-6506) Oct 1998,
  restricting data collection on children over the Internet without parental consent,
  establishing safe harbours to facilitate compliance
• FTC's regulations for COPPA, 16 CFR 312, Nov 1999
• European Directive 95/46/EC, Oct 1995,
  on the protection of individuals with regard to the processing of personal data and on the free movement of such data,
  with consequences for data transfers from Europe to the US
• Directive on privacy and electronic communications (EU 2002/58/EC), Jul 2002,
  which requires opt-in from targets of unsollicited direct marketing communications
• La loi pour la Confiance dans l'Economie Numérique (Loi n°2004-575, Juin 2004,
  transposing the opt-in requirement of European directive 2002/58/EC into French law
• Loi n°2004-801, Août 2004, transposing European directive 95/46/EC into French law
• UK Data Protection Act 1998, July 1998, transposing European directive 95/46/EC into British law

Relevant guidance documents from

• the Federal Trade Commission: Complying with COPPA: Final Rule
• the European Article 29 Data Protection Working Party: WP 90: Opinion on unsollicited communications for marketing purposes
  (EU Directive 2002/58/EC, Art. 13)

The Safe Harbor (a EU approved, US managed mechanism for data transfers)

• US organization:
  • Overview
  • The 7 principles
  • How to join
• EU opinion
  • Oct 2004 report
  • Complaint form

EU compliance outside the Safe Harbor

• Standard Contractual Clauses:
  • first set, C(2001) 1539, June 2001
  • first set for data processors, C(2001) 4540, Dec 2001
  • second set, C(2004) 5271, Dec 2004
• Binding Corporate Rules:
  • Definition WP 74, June 2003
  • Process WP 107, April 2005
  • Checklist WP 107, April 2005