[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]
EXAMINING THE EU SAFE HARBOR DECISION
AND IMPACTS FOR TRANSATLANTIC DATA FLOWS
=======================================================================
JOINT HEARING
BEFORE THE
SUBCOMMITTEE ON COMMERCE, MANUFACTURING, AND TRADE
AND THE
SUBCOMMITTEE ON COMMUNICATIONS AND TECHNOLOGY
OF THE
COMMITTEE ON ENERGY AND COMMERCE
HOUSE OF REPRESENTATIVES
ONE HUNDRED FOURTEENTH CONGRESS
FIRST SESSION
__________
NOVEMBER 3, 2015
__________
Serial No. 114-97
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Printed for the use of the Committee on Energy and Commerce
energycommerce.house.gov
____________
U.S. GOVERNMENT PUBLISHING OFFICE
99-571 WASHINGTON : 2016
_______________________________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Publishing Office,
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
E-mail, [email protected].
COMMITTEE ON ENERGY AND COMMERCE
FRED UPTON, Michigan
Chairman
JOE BARTON, Texas FRANK PALLONE, Jr., New Jersey
Chairman Emeritus Ranking Member
ED WHITFIELD, Kentucky BOBBY L. RUSH, Illinois
JOHN SHIMKUS, Illinois ANNA G. ESHOO, California
JOSEPH R. PITTS, Pennsylvania ELIOT L. ENGEL, New York
GREG WALDEN, Oregon GENE GREEN, Texas
TIM MURPHY, Pennsylvania DIANA DeGETTE, Colorado
MICHAEL C. BURGESS, Texas LOIS CAPPS, California
MARSHA BLACKBURN, Tennessee MICHAEL F. DOYLE, Pennsylvania
Vice Chairman JANICE D. SCHAKOWSKY, Illinois
STEVE SCALISE, Louisiana G.K. BUTTERFIELD, North Carolina
ROBERT E. LATTA, Ohio DORIS O. MATSUI, California
CATHY McMORRIS RODGERS, Washington KATHY CASTOR, Florida
GREGG HARPER, Mississippi JOHN P. SARBANES, Maryland
LEONARD LANCE, New Jersey JERRY McNERNEY, California
BRETT GUTHRIE, Kentucky PETER WELCH, Vermont
PETE OLSON, Texas BEN RAY LUJAN, New Mexico
DAVID B. McKINLEY, West Virginia PAUL TONKO, New York
MIKE POMPEO, Kansas JOHN A. YARMUTH, Kentucky
ADAM KINZINGER, Illinois YVETTE D. CLARKE, New York
H. MORGAN GRIFFITH, Virginia DAVID LOEBSACK, Iowa
GUS M. BILIRAKIS, Florida KURT SCHRADER, Oregon
BILL JOHNSON, Missouri JOSEPH P. KENNEDY, III,
BILLY LONG, Missouri Massachusetts
RENEE L. ELLMERS, North Carolina TONY CARDENAS, California
LARRY BUCSHON, Indiana
BILL FLORES, Texas
SUSAN W. BROOKS, Indiana
MARKWAYNE MULLIN, Oklahoma
RICHARD HUDSON, North Carolina
CHRIS COLLINS, New York
KEVIN CRAMER, North Dakota
Subcommittee on Commerce, Manufacturing, and Trade
MICHAEL C. BURGESS, Texas
Chairman
JANICE D. SCHAKOWSKY, Illinois
LEONARD LANCE, New Jersey Ranking Member
Vice Chairman YVETTE D. CLARKE, New York
MARSHA BLACKBURN, Tennessee JOSEPH P. KENNEDY, III,
GREGG HARPER, Mississippi Massachusetts
BRETT GUTHRIE, Kentucky TONY CARDENAS, California
PETE OLSON, Texas BOBBY L. RUSH, Illinois
MIKE POMPEO, Kansas G.K. BUTTERFIELD, North Carolina
ADAM KINZINGER, Illinois PETER WELCH, Vermont
GUS M. BILIRAKIS, Florida FRANK PALLONE, Jr., New Jersey (ex
SUSAN W. BROOKS, Indiana officio)
MARKWAYNE MULLIN, Oklahoma
FRED UPTON, Michigan (ex officio)
------
Subcommittee on Communications and Technology
GREG WALDEN, Oregon
Chairman
ROBERT E. LATTA, Ohio ANNA G. ESHOO, California
Vice Chairman Ranking Member
JOHN SHIMKUS, Illinois MICHAEL F. DOYLE, Pennsylvania
MARSHA BLACKBURN, Tennessee PETER WELCH, Vermont
STEVE SCALISE, Louisiana JOHN A. YARMUTH, Kentucky
LEONARD LANCE, New Jersey YVETTE D. CLARKE, New York
BRETT GUTHRIE, Kentucky DAVID LOEBSACK, Iowa
PETE OLSON, Texas BOBBY L. RUSH, Illinois
MIKE POMPEO, Kansas DIANA DeGETTE, Colorado
ADAM KINZINGER, Illinois G.K. BUTTERFIELD, North Carolina
GUS M. BILIRAKIS, Florida DORIS O. MATSUI, California
BILL JOHNSON, Missouri JERRY McNERNEY, California
BILLY LONG, Missouri BEN RAY LUJAN, New Mexico
RENEE L. ELLMERS, North Carolina FRANK PALLONE, Jr., New Jersey (ex
CHRIS COLLINS, New York officio)
KEVIN CRAMER, North Dakota
JOE BARTON, Texas
FRED UPTON, Michigan (ex officio)
C O N T E N T S
----------
Page
Hon. Michael C. Burgess, a Representative in Congress from the
State of Texas, opening statement.............................. 2
Prepared statement........................................... 2
Hon. Janice D. Schakowsky, a Representative in Congress from the
State of Illinois, opening statement........................... 3
Hon. Fred Upton, a Representative in Congress from the State of
Michigan, opening statement.................................... 5
Prepared statement........................................... 5
Hon. Anna G. Eshoo, a Representative in Congress from the State
of California, opening statement............................... 6
Hon. Greg Walden, a Representative in Congress from the State of
Oregon, opening statement...................................... 7
Prepared statement........................................... 8
Hon. Frank Pallone, Jr., a Representative in Congress from the
State of New Jersey, opening statement......................... 8
Prepared statement........................................... 9
Witnesses
Victoria Espinel, President and CEO, Business Software Alliance.. 11
Prepared statement........................................... 13
Joshua Meltzer, Senior Fellow, Global Economy and Development,
Brookings Institute............................................ 19
Prepared statement........................................... 21
Marc Rotenberg, President, Electronic Privacy Information Center. 41
Prepared statement........................................... 43
John Murphy, Senior Vice President for International Policy, U.S.
Chamber of Commerce............................................ 61
Prepared statement........................................... 63
Submitted material
List of 4,400 Safe Harbor organizations \1\...................... 100
Statement of the Internet Association, submitted by Ms. Eshoo.... 101
Article entitled, ``EU Safe Harbor Demised Raises Retroactivity
Concerns,'' Bloomberg Government, October 7, 2015, submitted by
Mr. Olson...................................................... 104
Statement of International Trade Administration, submitted by Mr.
Burgess........................................................ 107
Statement of the Direct Marketing Association, submitted by Mr.
Burgess........................................................ 111
Statement of the Information Technology & Innovation Foundation,
submitted by Mr. Burgess....................................... 114
Statement of American Action Forum............................... 136
Statement of alliance of automobile manufacturers................ 139
----------
\1\ Available at: http://docs.house.gov/meetings/if/if16/
20151103/104148/hhrg-114-if16-20151103-sd015.pdf.
EXAMINING THE EU SAFE HARBOR DECISION AND IMPACTS FOR TRANSATLANTIC
DATA FLOWS
----------
TUESDAY, NOVEMBER 3, 2015
House of Representatives,
Subcommittee on Commerce, Manufacturing, and Trade,
joint with the
Subcommittee on Communications and Technology,
Committee on Energy and Commerce,
Washington, DC.
The subcommittees met, pursuant to call, at 10:00 a.m., in
room 2123, Rayburn House Office Building, Hon. Michael Burgess
(chairman of the subcommittee on Commerce, Manufacturing, and
Trade) presiding.
Present from the subcommittee on Commerce, Manufacturing,
and Trade: Representatives Burgess, Lance, Blackburn, Harper,
Guthrie, Olson, Pompeo, Kinzinger, Bilirakis, Brooks, Mullin,
Upton (ex officio), Schakowsky, Clarke, Kennedy, Welch, and
Pallone (ex officio).
Present from the subcommittee on Communications and
Technology: Representatives Walden, Latta, Shimkus, Blackburn,
Lance, Guthrie, Olson, Pompeo, Kinzinger, Bilirakis, Johnson,
Long, Collins, Barton, Upton (ex officio), Eshoo, Welch,
Clarke, Loebsack, Matsui, McNerney, and Pallone (ex officio).
Staff present: Gary Andres, Staff Director; Ray Baum,
Senior Policy Advisor for Communications and Technology;
Leighton Brown, Press Assistant; James Decker, Policy
Coordinator for Commerce, Manufacturing, and Trade; Andy
Duberstein, Deputy Press Secretary; Melissa Froelich, Counsel
for Commerce, Manufacturing, and Trade; Grace Koh, Counsel for
Telecom; Paul Nagle, Chief Counsel for Commerce, Manufacturing,
and Trade; Tim Pataki, Professional Staff Member; David Redl,
Counsel for Telecom; Charlotte Savercool, Professional Staff
for Communications and Technology; Dylan Vorbach, Legislative
Clerk for Commerce, Manufacturing, and Trade; Gregory Watson,
Legislative Clerk for Communications and Technology and
Oversight and Investigations; Michelle Ash, Chief Counsel for
Commerce, Manufacturing, and Trade; Christine Brennan, Press
Secretary; Jeff Carroll, Staff Director; David Goldman, Chief
Counsel for Communications and Technology; Lisa Goldman,
Counsel; Tiffany Guarascio, Deputy Staff Director and Chief
Health Advisor; Lori Maarbjerg, FCC Detailee; Diana Rudd, Legal
Fellow; Ryan Skukowski, Policy Analyst; and Jerry Leverich,
Counsel for Communications and Technology.
OPENING STATEMENT OF HON. MICHAEL C. BURGESS, A REPRESENTATIVE
IN CONGRESS FROM THE STATE OF TEXAS
Mr. Burgess. Very well. I will ask all of our guests to
take their seats. The joint subcommittees on Commerce,
Manufacturing, and Trade and the subcommittee on Communications
and Technology will now come to order.
I will recognize myself 4 minutes for the purpose of an
opening statement.
And I do want to welcome you all to our joint hearing on
the Transatlantic Data Flows and the Impact of the European
Union Safe Harbor Decision.
Over 4,400 businesses have self-certified compliance with
the Safe Harbor agreement through the Department of Commerce. A
lot of jobs, a lot of industries are connected to those 4,400
businesses. The Safe Harbor agreement has provided a mechanism
to carry out commerce with the European Union. There is no
trade partnership, no trade partnership that is more important
than the trade partnership with the European Union. The depth
and breadth of the United States and the European Union
relationship is not simply economic. It is strategically
important, and it is also one of respect and cooperation.
In today's world, as our members know, you can't do
business without digital data flows. So today, our two
subcommittees send an important message. There is no reason to
delay. Both sides have all that is needed to put a sustainable
Safe Harbor agreement into place. It is our understanding that
there is an agreement in principle. And I certainly thank the
important work that the Department of Commerce has done to
achieve a new agreement. They offered a bipartisan briefing to
our members. Their message was the correct one. We cannot let
anything get in the way of moving as quickly as possible to
secure the new Safe Harbor agreement.
I also want to thank the important enforcement work that
the Federal Trade Commission has done enforcing the existing
Safe Harbor framework. I know that they will continue to do the
same for the new Safe Harbor.
For the sake of our jobs, for the sake of small and medium-
sized businesses relying on the Safe Harbor, and of all of the
jobs that they support in both the United States and the
European Union, I encourage all parties to stay at the
negotiating table to solidify a new data transfer agreement
well in advance of the January 2016 deadline. There is no other
path forward. And I can assure you that our committee will
continue to watch the negotiations closely and to be helpful
where we can.
[The prepared statement of Mr. Burgess follows:]
Prepared statement of Hon. Michael C. Burgess
Over 4,400 businesses self-certified compliance with the
Safe Harbor agreement through the Department of Commerce. An
awful lot of jobs and an awful lot of industries are connected
to those 4,400 businesses.
The Safe Harbor Agreement had provided a safe mechanism to
carryout commerce with the European Union. There is no trade
partnership more important than the trade partnership with the
EU. The depth and breadth of the U.S. and EU relationship is
not simply economic--this is a strategically important
relationship of respect and cooperation. But in today's world,
as our members know, you can't do business without digital data
flows.
So today, our two subcommittees send an important message.
There is no reason to delay. Both sides have all that is needed
to put a sustainable Safe Harbor agreement in place. Our
understanding is that there is an agreement in principle. And I
applaud the important work the Department of Commerce has done
to achieve a new agreement. They offered a bi-partisan briefing
to our Members last week. Their message is the right one--we
cannot let anything get in the way of moving as quickly as
possible to secure the new Safe Harbor agreement. I also want
to applaud the important enforcement work that the Federal
Trade Commission has done enforcing the existing safe harbor
framework. I know that they will do the same for the new safe
harbor.
For the sake of the small and medium sized business relying
on the Safe Harbor, and all of the jobs they support in both
the U.S. and the EU, I encourage all parties to stay at the
negotiating table to solidify a new data transfer agreement
well in advance of the January 2016 deadline. There is no other
path forward that I can support. And I can assure you that our
Committee will continue to watch the negotiations closely.
Mr. Burgess. I would now like to recognize the vice chair
of the Communications subcommittee, Mr. Latta, for the
remainder of the time.
Mr. Latta. Well, I thank the chairman for yielding, and I
also thank our witnesses for being here today.
We are all aware of the crucial role the internet plays in
the trade relationship between the United States and the
European Union. For over a decade, the U.S.-E.U. Safe Harbor
agreement has recognized the internet's importance and kept
cross-border data flows open to reduce barriers to trade.
However, since the Court of Justice ruled the agreement
invalid, the U.S. has diligently worked on revising the
framework to prevent a hindrance to the global economy. My hope
for today's hearing is to continue the discussion on a
framework that will provide marketplace stability and
adequately protect consumer data. It is imperative for U.S. and
European companies to be able to operate and conduct
transatlantic business with certainty.
And with that, Mr. Chairman, I yield back the balance of my
time.
Mr. Burgess. The chair thanks the gentleman. The gentleman
yields back.
The chair recognizes the ranking member of the Subcommittee
on Commerce, Manufacturing, and Trade, Ms. Schakowsky, for 4
minutes for an opening statement, please.
OPENING STATEMENT OF HON. JANICE D. SCHAKOWSKY, A
REPRESENTATIVE IN CONGRESS FROM THE STATE OF ILLINOIS
Ms. Schakowsky. Thank you, Mr. Chairman, and Chairman
Walden as well for calling today's joint hearing on the
implications of the Schrems v. Data Protection Commissioner
decision on the Safe Harbor agreement and the future of U.S.-
E.U. cross-border data flows. This is an important and timely
subject for our subcommittee to consider, and I welcome our
witnesses.
The Safe Harbor framework included principles that U.S.
companies could follow in order to meet E.U. standards for data
security and privacy. That framework has enabled American
companies to attract and retain European business with the
American and E.U. economies representing almost half of the
global economic activity, the value of a functional Safe Harbor
agreement cannot be overstated.
The Schrems decision threatens to undermine business
between our countries and the European continent. The more than
4,000 American companies and millions of U.S. employees who
have worked to abide by the Safe Harbor agreement cannot afford
that outcome.
But the Schrems decision does rightly call into question
the adequacy of U.S. data security practices. There are
legitimate concerns about the protection of personal
information collected and stored online, not just for European
citizens, but actually for our own as well.
As a former member of the House Intelligence Committee, I
believe that we must establish adequate and transparent data
security and privacy protections, and if we fail to do that,
the economic implications could be disastrous.
I will soon introduce legislation that would require strong
security standards for a wide array of personal data, including
geolocation, health-related, biometric, and email and social
media account information. It would also require breached
companies to report the breach to consumers within 30 days. My
bill would enhance data security standards here at home, and it
would probably have the added benefit of making the E.U. more
confident in U.S. privacy and data security standards.
I look forward to hearing our witnesses' prescriptions for
a path forward that will maintain cross-border data flows,
while enhancing the security of data held in the United States.
Our businesses, our workers and consumers in the United States
and European Union deserve no less.
And I would like to yield the balance of my time to
Representative Matsui for her remarks.
Ms. Matsui. Thank you. Thank you very much.
Data is a lifeblood of the 21st century economy and
critical to innovation and competition. Through my work as co-
chair of the Congressional High Tech Caucus, I understand the
importance of cross-border flow policies that support economic
growth.
This is about more than the over 4,000 businesses which
rely on Safe Harbor but also the hundreds of millions of
consumers in the United States and Europe that rely upon
services that move data across borders. We can all agree that
the Safe Harbor standards written before the advent of the
smartphone or the widespread use of cloud services deserve to
be updated, and we can do so in a way that recognizes the
importance of protecting private personal information while
also reaping the benefits of our interconnected economies.
I look forward to hearing from today's witnesses, and I
yield back the balance of my time.
Ms. Schakowsky. And I yield back.
Mr. Burgess. The chair thanks the gentlelady. The
gentlelady yields back.
The chair now recognizes the chairman of the full
committee, Mr. Upton, 4 minutes for an opening statement,
please.
OPENING STATEMENT OF HON. FRED UPTON, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF MICHIGAN
Mr. Upton. Well, thank you, Mr. Chairman.
Our partnership with Europe has always been marked by
friendship, shared interest, and mutual benefit. From autos to
ideas, an awful lot of things made in Michigan and across the
country have made their way across the Atlantic.
Of course, it is just not the U.S. that benefits from our
relationship with Europe. The exchange of goods and services
between the U.S. and E.U. amounts to almost $700 billion. It is
critical to both of our economies. Important to this trade
infrastructure is the free flow of information, and the
inability to pass data freely between the two jurisdictions is
a barrier to the growth of our two economies.
So we must move swiftly towards a framework for a
sustainable Safe Harbor. And while I recognize there are some
who want to leverage this important relationship and focus on
areas of disagreement, I would urge folks to keep in mind the
countless small and medium enterprises that rely on the Safe
Harbor framework. I support the work and direction of the
Department of Commerce in negotiating this new framework and I
encourage its speedy adoption, and yield the balance of my time
to Mrs. Blackburn.
[The prepared statement of Mr. Upton follows:]
Prepared statement of the Hon. Fred Upton
Our partnership with Europe has always been marked by
friendship, shared interest, and mutual benefit. From autos to
ideas, an awful lot of things made in Michigan have made their
way across the Atlantic. Of course, it's not just Michigan that
benefits from our relationship with Europe. The exchange of
goods and services between the U.S. and the EU amounts to
almost 700 billion dollars; it is critical to both of our
economies. Integral to this trade infrastructure is the free
flow of information, and the inability to pass data freely
between the two jurisdictions is a barrier to the growth of our
two economies.
We must move swiftly forward toward a framework for a
sustainable Safe Harbor. While I recognize that there are some
who want to leverage this important relationship and focus on
areas of disagreement, I would urge folks to keep in mind the
countless small and medium enterprises that rely on the Safe
Harbor framework. I support the work and direction of the
Department of Commerce in negotiating this new framework and I
encourage its speedy adoption.
Mrs. Blackburn. Thank you, Mr. Chairman.
And I am so appreciative of our witnesses being here and
for the hearing on this issue today. It is something that needs
some thoughtful attention, and we look forward to directing our
attention to solving the issue.
The chairman mentioned the amount of trade, and when you
are looking at nearly $1 trillion in bilateral trade and
knowing that the free flow of information is important to this,
data transfer rights are important to this discussion. We do
need to approach this thoughtfully.
Mr. Meltzer, I was caught by your stat on digital trade and
what it has done to increase the U.S. GDP, and then on the fact
that the U.S.-E.U. data transfers are 50 percent higher than
the U.S.-Asia transfers, and I think that the difference in
those flows is really quite remarkable. So I will want to visit
with you more about that.
Congress has attempted, through a couple of pieces of
legislation, as you all know, the Judicial Redress Act and the
Freedom Act, to address the privacy concerns. I had the
opportunity several months ago to be in Europe and discuss with
some of our colleagues, Members of Parliament, their concerns,
and I hope that we are going to be able to negotiate in good
faith and find some answers.
And with that, Mr. Chairman, I will yield to you the
balance of my time if any other Member would like to claim it.
Mr. Burgess. The chair thanks the gentlelady. The
gentlelady yields back.
The chair recognizes the gentlelady from California, Ms.
Eshoo, the ranking member of the subcommittee on
Communications.
OPENING STATEMENT OF HON. ANNA G. ESHOO, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF CALIFORNIA
Ms. Eshoo. Thank you, Mr. Chairman.
And I want to thank you and the ranking member of your
subcommittee for joining with Communications and Technology
Subcommittee to have this important hearing. I thank the
witnesses for being here. And we have a very full hearing room,
so there is not only a great deal of interest in this issue,
but there is a lot at stake.
In my Silicon Valley congressional district and on both
sides of the Atlantic, companies continue to reel from the
October 6 decision by the European Court of Justice to nullify
the U.S.-E.U. Safe Harbor agreement. As one expert remarked,
``aside from taking an ax to the undersea fiberoptic cables
connecting Europe to the United States, it is hard to imagine a
more disruptive action to the transatlantic digital commerce.''
For the past 15 years, thousands of companies, as has been
stated by, I think, every member that has spoken so far, both
small and large have relied upon this agreement to effectively
and efficiently transfer data across the Atlantic and in a
manner that protected consumer privacy.
Recognizing the magnitude of the court's decision, earlier
this month I joined with several colleagues, both sides of the
aisle, and a letter to Secretary Pritzker and the FTC
Chairwoman Ramirez urging the Administration to redouble their
efforts to come up with a new agreement with the E.U.
Given the strong economic relationship between the U.S. and
E.U., estimated over $1 trillion annually, $1 trillion, I mean
that is--you are really talking about something when you say $1
trillion--we have to move quickly with the European regulators
to provide a swift solution to what is no doubt creating a
great deal of uncertainty. In practice, this means reaching the
Safe Harbor 2.0 agreement as soon as possible.
I also think we have to acknowledge that there is an
elephant in the room, which is a major contributing factor in
my view in the court's ruling: privacy concerns relating to
U.S. surveillance methods. Having served on the House
Intelligence Committee for nearly a decade, I have consistently
worried about the impact of U.S. surveillance activities on
both U.S. citizens and companies. Given that the E.U.'s court
decision made clear that the U.S. must provide ``an adequate
level of protection'' for E.U.-U.S. data transfers, I look
forward to hearing from our witnesses about how this can be
achieved in the Safe Harbor 2.0.
I think if we don't really deal with this, we will be
missing a large point here. In a digital economy, there is
nothing more important than the free flow of data across
borders. A Congress that is united in support of this goal and
the reinstatement of a new agreement I think will ensure the
continued growth of digital commerce in the years to come.
So I thank our witnesses for being here today and for your
commitment to ensuring unfettered data transfers between the
U.S. and the E.U.
And with that, I yield back the balance of my time, Mr.
Chairman. Thank you.
Mr. Burgess. The gentlelady yields back. The chair thanks
the gentlelady.
The chair recognizes the chairman of the Communications and
Technology Subcommittee, Mr. Walden, for 4 minutes for an
opening statement.
OPENING STATEMENT OF HON. GREG WALDEN, A REPRESENTATIVE IN
CONGRESS FROM THE STATE OF OREGON
Mr. Walden. Thank you, Mr. Chairman. And I want to thank
our witnesses for being here. This is obviously an issue of
great importance to all of us.
The borderless nature of the internet is an important force
driving economic success and innovation. For internet-based
companies, the value of free flow of digital data between the
E.U. and the United States is obvious. But analysts have also
pointed out that up to 75 percent of the value added by
transnational data flows on the internet goes to traditional
industries, especially via increases in global growth,
productivity, and employment.
Communications and technology underpin every sector of the
global economy, from precision farming to sensor-monitored
shipping, from Facebook to McDonald's, from footwear
manufacturers to custom furniture makers. These networks are
the infrastructure of the 21st century economy, and free flow
of information is critical to making that infrastructure work.
The free flow of information has especially benefited small
and medium-sized companies by opening markets on both sides of
the Atlantic that were previously inaccessible. These are the
businesses that gain new consumers simply by virtue of the
nearly costless ability to find new suppliers, strike quicker
agreements, or access new markets. These are the businesses
that will suffer the greatest harm and bear the greatest risk
if we are not able to come to a new Safe Harbor framework.
The Safe Harbor cut down on the cost of compliance with the
various state privacy regulations in the European Union.
Without the shelter of a Safe Harbor, these businesses have the
choice of operating at increased risk, paying expensive costs
to lower that risk, or simply stopping the flow of information
altogether, that is, stopping business altogether.
The Department of Commerce estimates that in 2013, 60
percent of the 4,000-plus participants in the Safe Harbor
framework were small or medium-sized enterprises, spanning 102
different industry sectors. A break in the flow of data has the
potential to cause real impacts to the economies on both sides
of the proverbial pond.
So I am encouraged to hear that the negotiators on Safe
Harbor 2.0 have reached an agreement in principle--that is
really good news--and I cannot emphasize enough how important
it is to reach a new and firm agreement before the grace period
elapses in January.
I would like to thank our witnesses again for spending time
to discuss their understanding of the impact of the ruling of
the European Court of Justice. We welcome your thoughts and let
forward to hearing from you.
With that, I would yield such time as the--pardon me? Oh, I
guess Mr. Barton didn't want any time. Thank you. So I yield
back balance of my time.
[The prepared statement of Mr. Walden follows:]
Prepared statement of the Hon. Greg Walden
The borderless nature of the Internet is an important force
driving economic success and innovation. For Internet-based
companies, the value of the free flow of digital data between
the EU and the US is obvious. But analysts have also pointed
out that up to 75 percent of the value added by transnational
data flows on the Internet goes to ``traditional'' industries,
especially via increases in global growth, productivity, and
employment. Communications and technology underpin every sector
of the global economy--from precision farming to sensor-
monitored shipping, from Facebook to McDonald's, from footwear
manufacturers to custom furniture makers. These networks are
the infrastructure of the 21st century economy and the free
flow of information is critical to making that infrastructure
work.
The free flow of information has especially benefited small
and medium-sized enterprises by opening markets on both sides
of the Atlantic that were previously inaccessible. These are
the businesses that gained new consumers simply by virtue of
the nearly costless ability to find new suppliers, strike
quicker agreements, or access new markets. These are the
businesses that will suffer the greatest harm and bear the
greatest risk if we are not able to come to a new Safe Harbor
framework. The Safe Harbor cut down on the cost of compliance
with the various state privacy regulations in the European
Union. Without the shelter of a Safe Harbor, these businesses
have the choice of operating at increased risk, paying
expensive costs to lower that risk, or simply stopping the flow
of information altogether--that is, stopping business
altogether.
The Department of Commerce estimates that in 2013, 60
percent of the 4,000-plus participants in the Safe Harbor
framework were small or medium-sized enterprises, spanning 102
different industry sectors. A break in the flow of data has the
potential to cause real impacts to the economies on both sides
of the proverbial pond. I am encouraged to hear that the
negotiators on Safe Harbor 2.0 have reached an ``agreement in
principle,'' and I cannot emphasize enough how important it is
to reach a new and firm agreement before the grace period
elapses in January.
Mr. Burgess. The chair thanks the gentleman. The gentleman
yields back.
The chair recognizes the ranking member of the full
committee, Mr. Pallone of New Jersey, 4 minutes for an opening
statement, please.
OPENING STATEMENT OF HON. FRANK PALLONE, JR., A REPRESENTATIVE
IN CONGRESS FROM THE STATE OF NEW JERSEY
Mr. Pallone. Thank you, Mr. Chairman.
This is the committee's second hearing on the topic of data
moving across national borders. The digital movement of data
affects consumers and businesses in both the United States and
in Europe and in every country of the world.
The U.S. leads the world in technological innovation. It
has exported over $380 billion worth of digital services in
2012. Meanwhile, internet commerce grew threefold from 2011 to
2013 and is expected to reach 133 billion by 2018. And the
economic relationship between the United States and the
European Union is the strongest in the world.
Since our December 2014 hearing on this issue, the big
change is that the European Court of Justice invalidated the
Safe Harbor agreement between the United States and the
European Union that allowed American companies to transfer
European users' information to the U.S., and the elimination of
the Safe Harbor has caused great uncertainty.
However, as early as 2013, long before the court's October
2015 decision, the 15-year-old agreement was under
renegotiation. And during this time, the U.S. and the E.U. have
been working hard to strengthen the privacy principles of the
original agreement to ensure they cover the newest business
models and data transfers that exist.
Almost a year later, we today repeat our desire to see
those negotiations completed. I urge the parties to quickly
finalize a new agreement tailor-made for the modern economy and
the modern consumer. A new agreement can and should improve
consumer privacy and data security. Businesses can and should
adhere to strong privacy principles from inception.
Building trust with consumers worldwide requires a
multifaceted approach through appropriate legislation and
regulation, as well as through trade negotiations, and
therefore, I also would urge this Congress to act by passing
effective baseline privacy and data security protections. For
the internet of the future, economic gains and consumer
protections go hand-in-hand. When consumers feel safe that
their personal information is protected, they do more business
online.
I hope that today's discussion, as well as the ongoing
negotiations between the United States and the E.U. will
encourage a step in the right direction on data privacy not
only for Europeans but for American citizens as well. We can
have innovation and protections for consumer privacy. We have
done it time and time again. There is no reason why it should
be different in this space than in any other.
In today's heavily digital commercial environment, cross-
border data flows are not just a normal part of doing business
but essential to the American economy and American jobs. And I
welcome this opportunity, Mr. Chairman, to discuss the value of
secure and free data flow between the United States and Europe.
I yield back.
[The prepared statement of Mr. Pallone follows:]
Prepared statement of Hon. Frank Pallone, Jr.
Thank you, Mr. Chairman. This is the Committee's second
hearing on the topic of data moving across national borders.
The digital movement of data affects consumers and businesses
in both the United States and in Europe, and in every country
of the world.
The United States leads the world in technological
innovation. It has exported over $380 billion worth of digital
services in 2012. Meanwhile, Internet commerce grew threefold
from 2011 to 2013 and is expected to reach $133 billion by
2018. And the economic relationship between the United States
and European Union is the strongest in the world.
Since our December 2014 hearing on this issue, the big
change is that the European Court of Justice invalidated the
Safe Harbor agreement between the United States and the
European Union that allowed American companies to transfer
European users' information to the U.S. The elimination of the
Safe Harbor has caused great uncertainty.
However, as early as 2013, long before the Court's October
2015 decision, the 15-year old agreement was under
renegotiation. During this time, the U.S. and E.U. have been
working hard to strengthen the privacy principles of the
original agreement to ensure they cover the newest business
models and data transfers that exist.
Almost a year later, we today repeat our desire to see
those negotiations completed. I urge the parties to quickly
finalize a new agreement tailor-made for the modern economy and
the modern consumer.
A new agreement can and should improve consumer privacy and
data security. Businesses can and should adhere to strong
privacy principles from inception.
Building trust with consumers worldwide requires a
multifaceted approach through appropriate legislation and
regulation, as well as through trade negotiations. Therefore, I
also would urge this Congress to act by passing effective
baseline privacy and data security protections. For the
Internet of the future, economic gains and consumer protections
go hand-in-hand. When consumers feel safe-that their personal
information is protected-they do more business online.
I hope that today's discussion, as well as the ongoing
negotiations between the U.S. and E.U. will encourage a step in
the right direction on data privacy not only for Europeans, but
for American citizens as well. We can have innovation and
protections for consumer privacy. We have done it time and time
again. There is no reason why it should be different in this
space than in any other.
In today's heavily digital commercial environment, cross-
border data flows are not just a normal part of doing business,
but essential to the American economy and American jobs.
I welcome this opportunity to discuss the value of secure
and free data flow between the United States and Europe.
Thank you, I yield back.
Mr. Burgess. The gentleman yields back. The chair thanks
the gentleman for his comments.
This concludes Member opening statements. The chair would
remind Members that pursuant to committee rules, all Members'
opening statements will be made part of the record.
And we do want to thank our witnesses for being here today,
for taking time to testify before the subcommittee. You will
each have an opportunity to give an opening statement. That
will be followed by a round of questions from Members.
Our panel for today's hearing will include Ms. Victoria
Espinel, President and CEO of the Business Software Alliance;
Mr. Joshua Meltzer, Senior Fellow for Global Economy and
Development at the Brookings Institute; Mr. Marc Rotenberg,
President of the Electronic Privacy Information Center; and Mr.
John Murphy, Senior Vice President for International Policy at
the United States Chamber Of Commerce.
We appreciate all of you being here with us today. We will
begin the panel with you, Ms. Espinel, and you are recognized
for 5 minutes for a summary of your opening statement.
STATEMENTS OF VICTORIA ESPINEL, PRESIDENT AND CEO, BUSINESS
SOFTWARE ALLIANCE; JOSHUA MELTZER, SENIOR FELLOW, GLOBAL
ECONOMY AND DEVELOPMENT, BROOKINGS INSTITUTE; MARC ROTENBERG,
PRESIDENT, ELECTRONIC PRIVACY INFORMATION CENTER; AND JOHN
MURPHY, SENIOR VICE PRESIDENT FOR INTERNATIONAL POLICY, U.S.
CHAMBER OF COMMERCE
STATEMENT OF VICTORIA ESPINEL
Ms. Espinel. Thank you very much.
Good morning, Chairman Burgess and Ranking Member
Schakowsky, Chairman Walden and Ranking Member Eshoo, and
members of both subcommittees.
My name is Victoria Espinel. Thank you for the opportunity
to testify today on behalf of BSA, the software alliance. BSA
is the leading advocate for the global software industry in the
United States and around the world.
While the 19th century was powered by steam and coal and
the 20th century by electricity, cars, and computers, the 21st
century runs on data. Today, data is at the core of nearly
everything we touch. Banking, genome mapping, teaching our
children, and safely getting home from work and back again, all
run on data.
And this data economy is a global phenomenon. People around
the world are benefiting from data innovation. Accordingly, we
recognize that, as we proceed, we must be diligent to ensure
personal privacy is fully respected and robust security
measures are in place to guard the data involved.
Barriers to the free movement of data undermine the
benefits of the data economy. Recent developments in Europe
present a significant challenge that must be taken seriously
and warrants immediate action. Last month, the European Court
of Justice struck down the Safe Harbor. The Safe Harbor set out
rules that enabled nearly 5,000 American companies to provide a
huge array of data services to European enterprises and
individuals. Companies abiding by the Safe Harbor rules could
easily and efficiently transfer data to the U.S. consistent
with E.U. law.
The European Court of Justice decision upended this
process. The uncertainty about international data flows created
by the European Court of Justice's decision deters innovation
and makes it much more difficult for our members to serve their
millions of customers in Europe, which harms U.S.
competitiveness.
To address this, Congress and the U.S. Government should
engage immediately and actively with their European
counterparts to restore stability in transatlantic data flows.
Specifically, we need three things. First, rapid consensus on a
new agreement to replace the Safe Harbor; second, sufficient
time to come into compliance with the new rules; and third, a
framework in which the European Union and the United States can
develop and agree on a sustainable long-term solution that
reflects and advances the interests of all stakeholders.
To the first point, fortunately, the United States and the
E.U. were already deep in talks to revise the Safe Harbor
agreement when the European Court of Justice issued its
decision. And to this I want to join the chairman in thanking
the Department of Commerce for all the hard work they have done
on the negotiation far.
The new version of the framework will include up-to-date
safeguards. Updating the framework makes good sense. Much has
changed since the Safe Harbor was first set up in the year
2000. The volume of data is increasing exponentially. Here is
an incredible fact: More than 90 percent of the data that
exists in the world today was created in the last 2 years
alone, and that is a rate of change that will continue to
increase exponentially. The volume of business data worldwide
is doubling every 15 months, so these negotiations must
continue, and the new Safe Harbor must be finalized quickly.
Second, even if there is consensus on a new agreement, as
we believe there will be, companies will need an appropriate
standstill period in which to adapt their operations to the new
legal realities. An appropriate standstill period is essential
to consumers on both sides of the Atlantic.
And finally, while a new agreement to replace the Safe
Harbor is a vital and immediate step, it is not the complete
solution to the larger issue of privacy protections in the
digital age. We urge Congress and the United States Government
to look to the longer term.
The European Court of Justice ruling set a standard of
essential equivalence between privacy rules in Europe and the
United States, in effect, a comparative analysis of our
respective regimes. The European Court of Justice points most
sharply at U.S. surveillance regimes put in place to protect
our national security and their impact on individual privacy.
Balancing these essential goals is a task this Congress has and
will continue to consider. Most recently, the enactment of the
USA Freedom Act is recognition that the balance is ever-
changing and laws must stay up-to-date.
Ultimately, however, essential equivalence and the pursuit
of protecting privacy in a changing world will be a dynamic
concept that will change as laws and practices evolve. We need
a framework that is sustainable over the long term. The
original Safe Harbor lasted nearly 15 years. To achieve that
sort of stability, we will need to develop a more enduring
solution for data transfers.
The United States and Europe are not as far apart on
privacy as some might think. Where there are gaps span the
Atlantic, whether perceived or actual, we can close those
through a combination of dialogue and international
commitments, and Congress will be a key part of enabling this
to happen.
Thank you again for providing this opportunity to share our
views on these important matters, and I look forward to your
questions.
[The prepared statement of Ms. Espinel follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Mr. Burgess. The chair thanks the gentlelady.
Dr. Meltzer, you are recognized 5 minutes for an opening
statement, please.
STATEMENT OF JOSHUA MELTZER
Mr. Meltzer. Chairman Burgess, Chairman Walden, Ranking
Member Schakowsky, and Ranking Member Eshoo, honorable members
of both committees, thank you for this opportunity to share my
views with you on the Safe Harbor decision and the impacts for
transatlantic data flows.
Transatlantic data flows underpin and enable a significant
amount of trade and investment where this concerns personal
data of people in Europe and it is subject, therefore, to
European privacy laws. The Safe Harbor framework has allowed
personal data to be transferred from the E.U. to the U.S., but
as a result of a recent decision of the European Court of
Justice, the ability to do this has been called into serious
question.
I will briefly outline the link now between data flows and
transatlantic trade and investment and discuss the potential
implications of this European Court of Justice decision.
As has been noted already, the U.S.-E.U. economic
relationship is the most significant in the world. In 2014
alone transatlantic trade was worth over $1 trillion. And would
you also not forget the importance of the investment
relationship with stock of investment in both jurisdictions is
over $4 trillion.
Data flows between the U.S. and the E.U. are also the
largest globally, 55 percent larger than data flows between the
U.S. and Asia alone. These data flows underpin and enable a
significant amount of this bilateral economic relationship.
Just to give you a couple of examples, businesses use internet
platforms to reach customers in Europe. Internet access and the
free flow of data supports global value chains, and data flows
are essential when U.S. companies with subsidiaries in Europe
manage production schedule and human rights and H.R. data.
The global nature of the internet is also creating new
opportunities for small and medium-sized enterprises to engage
in international trade. For example, 95 percent of those SMEs
in the U.S. who use eBay to sell goods and services to
customers do so in more than four countries overseas. This
compares with less than 5 percent of such businesses when they
are exporting off-line. And this is obviously important as SMEs
are the main drivers of job growth in the United States,
accounting for 63 percent of net new private sector jobs since
2002.
Unfortunately, there is only limited quantitative data on
the impact of the internet in cross-border data flows on
international trade. If we focus on services that can be
delivered online, in 2012 U.S. exported over 380 billion of
such services, and over 140 billion of that went to the E.U.
So E.U. privacy laws require entities that are collecting
personal data to comply with privacy principles. And when
transferring this personal data outside of the E.U., this can
only be done under specific conditions. One of these is a
finding from the European Commission that the receiving country
provides an adequate level of privacy protection, which
essentially requires that they have privacy laws equivalent to
the E.U. There are other forms, models, contracts, and binding
corporate rules, though these are not well utilized.
The U.S. Safe Harbor framework has allowed for the transfer
of personal data from the E.U. to the U.S., despite differences
in approaches to privacy protection. In the recent Schrems
decision, the European Court of Justice has effectively
invalidated this mechanism for transferring personal data from
the E.U. to the U.S.
Now, in terms of its immediate impact of this decision, the
European data privacy actors have said that they will wait
until the end of January 2016 before enforcing Schrems. Since
2014, there has been an effort to renegotiate Safe Harbor, and
certainly one solution here would be for the newly renegotiated
Safe Harbor agreement to address all the concerns that the
European Court of Justice has outlined with the current Safe
Harbor framework. However, until we know the outcome of these
negotiations and, importantly, whether they are acceptable to
the European Court of Justice, there will remain considerable
legal uncertainty as to how transfers of personal data from the
E.U. to the U.S. can continue.
Failure to find a way for companies to transfer personal
data to the U.S. can have significant economic repercussions,
and these costs are likely to fall most heavily on small and
medium-sized enterprises who lack the resources to navigate the
complex legal issues and to manage the risk. In addition, some
of the other mechanisms available for the transfer personal
data to the U.S. such as binding corporate rules are often not
available to small and medium-sized enterprises who do not have
a corporate presence in the E.U.
I appreciate the opportunity to offer my views on this
important issue and look forward to your questions.
[The prepared statement of Mr. Meltzer follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Mr. Burgess. The chair thanks the gentleman.
Mr. Rotenberg, you are recognized for 5 minutes, please.
STATEMENT OF MARC ROTENBERG
Mr. Rotenberg. Thank you, Mr. Chairman, Ranking Member
Schakowsky, Chairman Walden, members of the committee. I
appreciate the opportunity to testify today. My name is Marc
Rotenberg. I am President of EPIC. I have also taught
information privacy law at Georgetown for the past 25 years and
study closely the developments of the European Union privacy
system.
I need to explain that the Safe Harbor framework from the
outset raised concerns among experts, consumer organizations,
and privacy officials, many of whom looked at the framework and
saw a familiar set of principles but were concerned about the
enforcement of those principles. Over the last several years,
there have been repeated calls on both sides of the Atlantic to
update and strengthen the Safe Harbor framework.
In our comments to the Federal Trade Commission, we
routinely ask the agency to incorporate strong privacy
principles to give meaning to the Safe Harbor framework, but
the agency was reluctant to do so. And so to us and others, the
judgment of the European Court of Justice did not come as a
surprise. The problems with Safe Harbor were familiar.
But I should explain also this approach to data protection
in Europe is familiar in the United States. The European
regulators are trying to protect a consumer interest, which is
data protection set out in a Charter of Fundamental Rights and
attempting to hold foreign companies to the same standards that
they would hold domestic companies. We do the same thing in the
U.S. with product safety, consumer products, automobiles.
Emissions standards, for example, must be equally enforced
against foreign auto suppliers, as they are against U.S. firms,
because U.S. firms should not have to carry a cost that foreign
firms would not. This is essential to understanding the notion
of essential equivalence in the judgment of the European Court
of Justice.
But another key point to make, which I set out in the
testimony on pages 10 and 11, is the language in the Charter of
Fundamental Rights. This is the European bill of rights, and
they have set out both privacy and data protection as
cornerstone rights within their legal system, one protecting
the right to privacy and the other explicitly saying that
everyone has the right to the protection of personal data. Such
data must be processed fairly and such compliance must be
ensured by an independent authority.
Now, I know it would be tempting in the context of the
current discussion to imagine that a Safe Harbor 2.0 could
address the challenge that the European Court of Justice has
set out, but my sense is that that approach will not be
adequate because part of what the European Court of Justice has
identified is also the concern shared by U.S. consumer groups,
privacy experts, and others, that the U.S. has not updated its
privacy law.
The data not only on European citizens but also on U.S.
citizens lacks adequate protection, and that is why in my
testimony today I am strongly recommending that you consider
long-overdue updates to domestic privacy law, that you not
simply see this as a trade issue. I propose, for example, four
specific steps I believe Congress could take that over the long
term would solve not only the Safe Harbor problem but would be
good for U.S. consumers and for U.S. business.
Specifically, I think the Consumer Privacy Bill of Rights,
which the President has proposed and reflects many privacy
bills that have gone through this committee as a good starting
point. I think updates to the U.S. Privacy Act would make a lot
of sense. I know they are already under consideration by
Congress. I think the creation of an independent data
protection agency in the U.S. is long overdue and could help
address concerns on both sides of the Atlantic. And finally, I
think we do need an international framework to ensure
transborder data flows not only between the E.U. and the U.S.
but among all of our trading partners around the world because
we are today in a global economy.
Now, I know you may think this is just the view of perhaps
privacy people or consumer groups, but I would like to share
with you the views that have recently been expressed by leaders
of the internet industry. It was Microsoft President Brad Smith
who, after the decision of the European Court of Justice, said
``privacy is a fundamental human right.'' It is Apple's CEO Tim
Cook who said just 2 weeks ago on NPR ``privacy is a
fundamental human right.'' These are the exact same words of
the European Court of Justice. This is the view of U.S.
consumer groups. I believe on both sides of the Atlantic there
is consensus for the view that privacy is a fundamental right.
Thank you.
[The prepared statement of Mr. Rotenberg follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Mr. Burgess. The chair thanks the gentleman.
Mr. Murphy, you are recognized for 5 minutes, please.
STATEMENT OF JOHN MURPHY
Mr. Murphy. Mr. Chairman, Ranking Member Schakowsky,
distinguished members of the committee, it is an honor to
appear before you this morning on behalf of the U.S. Chamber of
Commerce, the Nation's largest business association
representing companies of every size, sector, and state. And it
is representing those companies that I would like to share my
comments.
We have spoken this morning about the importance of the
international movement of data and how important it is to
companies of all kinds. I can speak on behalf of this dynamic
and multifaceted array of member companies to confirm that.
Examples of data flows take many forms, including a small
exporter operating through an e-commerce portal, a large
company with operations in multiple countries managing its
human resources, a wind turbine sending data on its performance
to the engineers who keep it running, or a transatlantic
tourist using a credit card. In short, today's hearing isn't
really just about internet companies but about companies. It
isn't about the internet economy; it is about the economy.
However, as we have heard, the tremendous benefits of
transatlantic data flows are now at risk. The invalidation of
the Safe Harbor agreement raises serious questions. I would
point out that before its decision, the European Court of
Justice did not conduct any formal investigation into U.S.
current surveillance oversight. In fact, the decision was based
largely on process concerns internal to the European Union.
Even so, more than 4,000 companies have been left asking
whether they can continue to transfer personal data from
Europe. They are now faced with the tough choice of deciding
whether to continue their transatlantic business or face
potentially costly enforcement actions.
While companies in the Safe Harbor program continue to
guarantee a high level of data protection for the users of
their products and services, alternatives cannot be devised
overnight. Data privacy systems are complex legally and
technically. One alternative suggested by the European
Commission, binding corporate rules, can cost over $1 million
and take at least 18 months to develop and implement. This is a
nonstarter for small businesses.
Or consider a U.S. hotel chain with locations across
Europe, each of which works with a host of small businesses
that might provide food for their in-house restaurant or
janitorial services. All of those relationships involve data
flows, and that means there are hundreds of arrangements across
hundreds of properties that may need to change at considerable
cost.
Another example comes from the auto industry, which uses
Safe Harbor to identify vehicle safety issues and for quality
and development purposes. However, the industry now faces the
challenge of meeting both U.S. and E.U. regulatory
requirements, which made diverge. Under U.S. law, auto
manufacturers must share a vehicle identification numbers of
cars sold globally in the event of a vehicle service campaign
such as a recall. This U.S. obligation may now conflict with
E.U. privacy rules.
So what is the outlook? Companies may be faced with a
patchwork of 28 different enforcement and compliance regimes in
different E.U. member states or more where local governments
are involved. There is a serious disconnect between the E.U.'s
stated goals of spurring innovation and fostering a startup
culture and statements by some European officials about the
need for IT independence and calls for data localization.
Further, some in Europe are trying to use legitimate
concerns about data protection as an excuse for protectionism,
and the uncertainty facing business worsens. This approach has
been frequently rebuked by many others in the E.U., but it
merits careful scrutiny.
While the business community is committed to working with
our European colleagues to ensure a balanced and proportionate
system of rules, we must be vigilant. We must ensure that the
European Union does not hold the United States to a different
standard on national security and law enforcement issues.
Specifically, what should be done? First, we need a new and
improved Safe Harbor agreement that reflects current
circumstances. The Chamber greatly appreciates the efforts of
the Department of Commerce and the FTC to provide clarity and
reach an agreement on a revised Safe Harbor. Further, we
applaud the House for taking an important first step toward
resolving related concerns with the passage of the Judicial
Redress Act, and we are encouraging the Senate to act swiftly
to give this bill final passage.
The recently announced Umbrella Agreement is also another
important step forward allowing data sharing in certain
circumstances between law enforcement and national security
agencies. Also important are other safeguards instituted in the
United States in recent years that provide a level of
protection equivalent to or even greater than that found in the
European Union and among its member states.
The Chamber appreciates the opportunity to provide these
comments to the committee, and we stand ready to assist in any
way possible to ensure data flows can continue across the
Atlantic.
[The prepared statement of Mr. Murphy follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Mr. Burgess. The chair thanks the gentleman for his
testimony, and thank all of you for your being here this
morning and sharing your thoughts with us. We are going to move
into the question part of the hearing, and I am going to begin
by recognizing Mr. Walden 5 minutes for his questions, please.
Mr. Walden. I thank the chairman, and I thank all of you
for your testimony. It is most enlightening and helpful as we
wrestle with this issue ourselves.
Ms. Espinel and Mr. Murphy, do you think the Department of
Commerce needs to be doing anything differently to arrive at
Safe Harbor framework that will stand up to scrutiny by the
European legal system, and if so, what would that be?
Ms. Espinel. So I would say, first, I want to thank the
Department of Commerce for all the work they have been doing in
negotiating the Safe Harbor. And our understanding is that
talks are well underway and we are at the moment cautiously
optimistic that we will be able--we meaning the United States
and the European Union--will be able to find our way to a new
Safe Harbor agreement.
And so on that I think the Department of Commerce is doing
all that they can. I would continue to urge Congress to
encourage the Department of Commerce to focus on that, and also
to the extent you are speaking to your European counterparts,
to encourage the Europeans to come to a speedy conclusion on a
new Safe Harbor agreement.
But I would also say that a new Safe Harbor agreement,
while I think it is the immediate short-term step that we need,
it will not solve the larger issue. And so I think we need to
focus first and foremost at the moment on resolution of the new
Safe Harbor agreement, but I think we need to quickly turn to
coming up with a longer-term, more sustainable, global solution
for data transfers. And that is something that we would like to
be working with Congress on and will be working closely with
the Department of Commerce, the FTC, as well as the governments
of the European Union and the European Commission.
Mr. Walden. All right. Mr. Murphy?
Mr. Murphy. I would agree with those comments. Just
briefly, the Department of Commerce has made every effort to
get ahead of this problem. In fact, before the European Court
of Justice decision had advanced significantly towards reaching
a new agreement, obviously further negotiations were required
after the ruling came out to reflect those findings. But they
have done a good job, and they have done a good job reaching
out to the business community to gather their input as well.
Mr. Walden. OK. Dr. Meltzer, what impacts will continuing
uncertainty around transatlantic data flows have on foreign
direct investment both in the United States and the European
Union from your perspective?
Mr. Meltzer. Thank you for the question. I think it is
important to recognize that the implications of the Schrems
decision at the moment are going to be direct on those who are
certified under the Safe Harbor framework, but the implications
are potentially a lot more significant. We already see in the
E.U., for instance, that some of the data protection
authorities in Germany have effectively stated that the other
mechanisms that the E.U. has for transferring data--namely,
standard model contracts and binding corporate rules
themselves--are likely to be available for transferring
personal data to the E.U.
So effectively, there is enormous legal uncertainty around
the whole process and available options for making this to
happen. So one would expect that, for the moment, all forms of
foreign investment that essentially are relying on
incorporating the transfer of personal data are going to have
to be reviewing their processes, and a lot of investment
decisions and trade is going to be placed under that sort of
higher level of risk and uncertainty for the time being.
Mr. Walden. And I noted in some of the testimony, too, it
is not just the E.U. anymore. I mean, other countries are
looking at this, what the E.U. has concluded, and now they are
starting to question whether their own Safe Harbor agreements
were correct. And somebody tell me how this is spreading and
what we need to be cognizant of going outward. Mr. Rotenberg?
Mr. Rotenberg. Thank you, Mr. Walden. I do discuss in my
prepared statement efforts that actually preceded the judgment
of the European Court in Canada, in Japan, in South Korea, and
part of the point that I am trying to make today is that this
is not simply a matter of trade policy. In other words, where
countries have established fundamental rights, they will see a
need to protect those rights.
And the second part of the Schrems decision doesn't just
invalidate Safe Harbor. It says that each one of the national
data protection agencies has the authority to enforce
fundamental rights, which means even in agreements between the
Department of Commerce and the Commission could be challenged
by a member country.
Ms. Espinel. But if I could just add briefly----
Mr. Walden. Please do.
Ms. Espinel [continuing]. There are a number of countries
around the world that are looking to put or considering putting
trade barriers in place to restrict the movement of data across
national borders for a variety of reasons. This is a fight that
we have been fighting for at least 5 years now market to market
around the world. I think one of the recent inventories of
countries that are considering put the number at 18, including
significant trading partners such as China but also Russia,
Nigeria, and a number of other trading partners.
So while the subject of this hearing is the U.S.-E.U. Safe
Harbor, and that is a subject of great concern to us, there is
a larger issue here, I think, about setting up a global
framework that allows data to move freely around the world
beyond just the United States and Europe.
Mr. Walden. Thank you. My time is expired.
Mr. Burgess. The gentleman yields back. The Chair thanks
the gentleman for his questions.
The Chair recognizes the gentlelady from Illinois, the
ranking member of the Subcommittee on Commerce, Manufacturing,
and Trade, 5 minutes for questions, please.
Ms. Schakowsky. Thank you, Mr. Chairman.
It has been reported that the Department of Commerce and
the European Union have agreed, at least in broad strokes, on a
replacement for Safe Harbor. And like you, I support passage of
a comprehensive privacy bill and a comprehensive data security
bill. However, I also hope that the new deal for Safe Harbor
can be reached soon and that it will contain significant
protections for consumers.
Mr. Rotenberg, in answering the following, please put aside
your call for changes to domestic law for a moment. I will ask
you that question a bit later. But in your opinion, what should
be in the new agreement if there is to be a new agreement to
afford consumers stronger privacy protections?
Mr. Rotenberg. It is a difficult question to answer. There
are 13 specific proposals that were presented by the European
Commission to the Department of Commerce, and the Department of
Commerce and FTC has tried in this negotiation to address the
issues that have been raised.
But the reason that it is a difficult question to answer,
as other witnesses have pointed out, is that neither the
Commerce Department nor the FTC has legal authority over the
surveillance activities undertaken by police or intelligence
agencies in the United States. And you could say that is kind
of a deal-breaker on the European side because it is explicit
in the opinion of the Court of Justice that there must be legal
authority to restrict that type of mass surveillance.
And I won't go into that debate right now, but the question
that you have asked, which is how do you solve the issues that
have been identified post-ruling in the Safe Harbor
negotiation, I actually don't think there is an answer to. And
this even puts aside my recommendation for changes in domestic
law. I think that is the reality on the European side as they
look at next steps in this process. So in your recommendations
for changes in the domestic law, you aren't looking at the
issue of government surveillance?
Mr. Rotenberg. Well, certainly, yes. I mean the Freedom
Act was a significant step forward for privacy protection in
the United States, but it limited only the surveillance
activities directed toward U.S. persons. That is the 215
collection program. The Freedom Act did not address the 702
program, which was collection directed toward non-U.S. persons.
And that remains a key concern on the E.U. side. And I don't
think that the Department of Commerce can negotiate that in the
context of a Safe Harbor 2.0. So at a minimum I think that
would have to be done to comply with the judgment of the court.
Ms. Schakowsky. So there have been various press accounts,
and of course, the terms of the new agreement have not been
made public, but are there certain provisions that you do
consider helpful? For example, we have heard that there will be
increased transparency. Is that something that you think they--
--
Mr. Rotenberg. Well, it would be good, but to be fair, in
the original Safe Harbor proposal, which we were involved with,
we actually favored the principles. We said these are familiar
principles. They exist both on the U.S. side and on the
European side, and they seem like a good basis to promote
transborder data flows. We were not against the principles in
the original Safe Harbor, but the problem was the lack of
enforcement.
And you see the lack-of-enforcement issue continues even in
the Safe Harbor 2.0 because unless Federal Trade Commission or,
as I have proposed, an independent data protection agency, has
the authority to enforce those principles, it won't have a
significant impact on how it is viewed on the European side.
But I agree. I think the steps are in the right direction,
but they don't solve the enforcement problem.
Ms. Schakowsky. In April, Mr. Rush, Congressman Rush and I
offered an amendment in the nature of a substitute to the Data
Security and Breach Notification Act that would require
commercial entities that owned or possessed consumers' personal
information to create and implement security procedures to
safeguard that data, among other things. Those procedures would
have to include processes for identifying, preventing, and
correcting security vulnerabilities. Is this important in
domestic----
Mr. Rotenberg. Yes, actually, I think that is a very
important proposal. Because there is increasing awareness on
both sides of the Atlantic of the need for data breach
notification, the Europeans have recently updated their law in
part in response to developments that have taken place in U.S.
law. And I think your proposal would carry that process forward
in a way that is favorable again for consumers and businesses.
I don't think this is a process that puts consumers against
business. I think we are all on the same page wanting to
maintain transborder data flows. So to the extent that these
changes help strengthen consumer confidence, I think it is a
step in the right direction.
Ms. Schakowsky. Thank you. I would like to have further
conversations with you at another time. Thank you very much. I
yield back.
Mr. Burgess. The chair thanks the gentlelady, and the chair
will recognize himself 5 minutes for questions.
Dr. Meltzer, you have indicated in your testimony that
cross-border data flows affect small and medium-sized business.
Can you give us an idea as to what that effect is?
Mr. Meltzer. So the effect is in multiple ways. I apologize
for some generality. As I mentioned in my opening statement,
there is unfortunately a paucity of very high data on this
issue. EBay, I mentioned, has been particularly helpful in
providing data about the way that small businesses export on
its platform, and I think it is a good example because it
captures a lot of the ways that small businesses are using the
internet to access customers globally, and that is certainly
the case when it comes to transatlantic trade. And so there is
one example where there is a lot of new opportunities for
engagement in the global economy by small businesses that
really was not possible before that relies on cross-border data
flows.
We will have a component of that, which is certainly
personal data, which is going to be significantly potentially
inhibited by the ruling in the Schrems decision. And as I think
has been mentioned before, this is an issue which is
transatlantic-specific but is global in its implications.
One of the things I think is worth recognizing is also
that there is essentially a global debate going on about the
appropriate form of privacy model protection going forward.
There is the U.S. version, which is essentially embodying the
APEC cross-border privacy principles, and there is the E.U.
approach, and both models are being discussed in different form
globally. and different countries are looking at different
approaches, and which way they go will have a significant
impact on how small businesses operate not only on a
transatlantic basis but how they use the internet to leverage
and engage globally in all countries around the world.
Mr. Burgess. Well, along those lines then, the benefits
that occur to small and medium-sized enterprises, they are not
unique to the United States-European Union relationship?
Mr. Meltzer. No, absolutely not. And in many respects the
opportunities for small and medium-sized enterprises are as
real here as they are in Europe, as they are actually in a
range of other countries, including specifically developing
countries, which have been be able to engage in international
trade in a way that was not possible. So the potential
implications of this are much broader than the transatlantic
nature, are certainly broader than for the SME sector here in
the U.S., but certainly globally.
Mr. Burgess. Thank you, and I thank you for those answers.
Mr. Murphy, the Chamber of Commerce obviously represents a
broad range of interests across the country. Can you give us a
sense what you are hearing from your members, how important it
is that the United States and European Union reach a new
agreement on a new Safe Harbor?
Mr. Murphy. Well, it is indispensable to U.S.-E.U. economic
relationship. It is without peer in the world today. And, as I
think several members of the committee have pointed out,
bilateral trade is $1 trillion annually, but that doesn't even
capture the additional $5 trillion in sales by U.S. affiliates
in Europe or European affiliates in the United States. There is
no relationship like that. U.S. investment in Europe is 40
times what U.S. companies have invested directly in China. So
getting this right matters for all kinds of companies.
I think for small businesses, they are just waking up to
it. Dr. Meltzer's comments about eBay and the large number of
companies that use that platform as exporters and the
uncertainty about what that would mean for them.
But I think that there are potential hidden costs for many
small businesses as well. For instance, I gave my example about
a hotel chain operating in Europe and the many small businesses
which provide services to that hotel. Certainly, many of them
have never thought about this. In the absence of a revised Safe
Harbor agreement, companies may face an incentive to bring that
kind of work in-house, and that could be very damaging for
small businesses going forward.
Mr. Burgess. So what is the current state of risk for your
members, and then, further, is that level of risk sustainable
for them?
Mr. Murphy. I think that we are going through a bit of a
state of shock here in the wake of the ruling. There was a wide
expectation that the ruling might be in some way adverse. I
think the full dimensions of it were not fully appreciated in
advance. So there is a circling of the wagons right now to try
and work with the authorities to find a solution in the near
term.
I do agree with Ms. Espinel, though, that this is an issue
that even in the happy event that we are able to achieve in the
next weeks or couple of months a new Safe Harbor agreement,
this issue is going to require constant attention to get it
right on a global level.
Mr. Burgess. And thank you for your responses.
The chair yields back and recognizes Mr. McNerney 5 minutes
for questions, please.
Mr. McNerney. I thank the chair and I thank the witnesses,
very interesting hearing this morning.
Mr. Rotenberg, in my mind there is a significant
distinction between government surveillance on the one hand and
data breach from non-state actors, businesses, or so on on the
other hand that are trying to get information that they
shouldn't have. Which do you feel is more significant in the
Schrems decision?
Mr. Rotenberg. Well, the Schrems decision looks primarily
at a commercial trade framework, which is what Safe Harbor was,
and concludes that that trade framework did not meet the
adequacy requirement of European law. So in that respect I
guess you could say it is commercial. But you see, from the
European perspective, because privacy is a fundamental right,
the question of who gets access to it in some respects is not
as significant. It is the underlying privacy interest. So both
will remain important. The European privacy officials will look
to whether the personal data that is being collected is used
for impermissible reasons either on the commercial side or on
the intelligence side.
Mr. McNerney. Have you been keeping up with the exceptional
access question here in the United States?
Mr. Rotenberg. I am not sure if I understand the question.
Mr. McNerney. Well, the FBI and other organizations want to
have an encryption key----
Mr. Rotenberg. Right.
Mr. McNerney [continuing]. That is accessible to them so
they can look at data with proper provisions. Do you think that
that would hurt our businesses?
Mr. Rotenberg. Well, I certainly think that would be a
mistake. I understand the Bureau's concern. We have had this
discussion for many, many years. At the risk, of course, of the
so-called key escrow approach to encryption is that you leave
systems vulnerable to----
Mr. McNerney. Right.
Mr. Rotenberg [continuing]. Cyber criminals. In the best of
circumstances you can execute your lawful investigation, but we
know from experience there are many other scenarios, and those
weaknesses will be exploited.
Mr. McNerney. Well, what are some of the differences in
between data protection in the U.S. and data protection in
Europe?
Mr. Rotenberg. Well, I actually think there is much more
similarity between the two approaches than people commonly
think. The European Union privacy law mirrors many of our own
privacy laws, our Fair Credit Reporting Act, our Privacy Act.
All of these U.S. laws have many of the same principles that
the Europeans do. The difference, I think, is that we have not
updated our laws as the Europeans have, so the divide that you
are seeing today is really not one about disagreement as to
what privacy protection means. It is really divide over the
scope of application.
Mr. McNerney. Thank you. One more question for you. Do you
have specific recommendations then for data privacy? It sounds
like what you are saying is that we really should be more
proactive in terms of keeping up----
Mr. Rotenberg. Yes----
Mr. McNerney [continuing]. With the scope of the problem.
Mr. Rotenberg. I think we should update our national law.
Again, it is obvious there is no benefit to consumers to see
the disruption of transborder data flows. Everyone wants to
ensure that the data flows continue. But we also know that the
weaknesses in U.S. privacy protections will continue even with
a new Safe Harbor. So there has to be within the United States
an effort to update our privacy law, I believe.
Mr. McNerney. Thank you. Ms. Espinel, will American service
members stationed in Europe be able to communicate as easily
with their loved ones here in the United States absent Safe
Harbor?
Ms. Espinel. That is an excellent question, and I think,
you know, there are clearly going to be a number of impacts,
and I am happy to speak to those. I think we don't know today
what the full extent of those impacts will be, but
communication between the United States and Europe, I think, is
clearly one of the things that could be implicated, among a
number of other things as well.
Mr. McNerney. Well, how can U.S. companies ensure that our
service members are not cut off from their families?
Ms. Espinel. So I would say there are three things that we
need to happen. The first is one that we have talked about
already today, which is that we need to come to a new
resolution for the Safe Harbor. So that is sort of a first
immediate step. The United States and Europe need to come
together to agree on a new Safe Harbor.
The second thing that we need is we need some appropriate
amount of time for U.S. companies to be able to come into
compliance with those new regulations. And then, as we have
been discussing today, we need to be actively working on what a
long-term, sustainable solution is going to be. I think we are
all in agreement that while it is enormously important to come
to a new agreement on the Safe Harbor as quickly as possible,
that will not be our long-term solution and we need to be
working together on a long-term, sustainable solution.
Mr. McNerney. So you pivoted back to your opening remarks,
then, on the three things that we need to do?
Ms. Espinel. I think those are the three things that we
need to keep a laser focus on.
Mr. McNerney. Thank you. Mr. Chairman, I yield back.
Mr. Burgess. The chair thanks the gentleman. The gentleman
yields back.
The chair recognizes the gentlelady from Tennessee, Mrs.
Blackburn, 5 minutes for questions, please.
Mrs. Blackburn. Thank you so much, Mr. Chairman, and thank
you all for answering the questions and being right to the
point. We appreciate that.
Mr. Meltzer, I wanted to come to you. Your October 2014
working paper on transatlantic data flows, some great stats in
there and they really cause you to think when you look at the
worth of the digitally exported services and how that does
affect our trade. So thank you for that and for making that
available.
I want to go back to something Chairman Burgess was
beginning to push on a little bit, the short- and long-term
consequences as we look at solidifying a Safe Harbor framework.
And back to the issue of U.S. businesses, whether they are
large or small, and let's talk about between now and January
2016 and what the impact is going to be as you have got that
Article 29 Working Party trying to finalize the Safe Harbor
agreement. So I would like to hear from you, just let's narrow
this focus down and look at these businesses between now and
January 2016. We know the volume that is being exported and
look at what you think the impact is going to be and then what
consequences do you see arising if a new Safe Harbor agreement
is unable to be finalized.
Mr. Meltzer. Yes, thank you for that question. So to the
first part, assuming that the data protection authorities, all
of them, speak to the commitment not to enforce the Schrems
decision until the end of January 2016, then we are presumably
still in a reasonable status quo environment and data flows
should continue, though under a certain amount of increased
uncertainty.
Post-January, the question is going to be whether Safe
Harbor has been concluded. But as I think the witnesses have
said, I think even with conclusion of Safe Harbor, it is still
ultimately going to be a question of whether the satisfies the
European Court of Justice, and these will most likely have to
be ultimately settled again by the European Court of Justice
because the data protection authorities have been given the
clear authority to investigate complaints regarding adequacy of
data flows. So I would imagine a situation even after concluded
Safe Harbor 2.0 where you still get data protection authorities
looking into whether in fact there is adequacy. So this is
certainly going to increase the risk environment.
Stepping back a little bit, I think that there is clearly a
significant interest on the U.S. side to make sure that this is
resolved. I think this is an equally important interest on the
E.U. side to resolve this issue as well. The costs to the E.U.
economy are also going to be very significant if they don't
manage to resolve this transborder data flow issue. So I think
those two dynamics give me some hope that a solution is going
to be found, but a number of steps, I think, are going to have
to be taken before that is going to be clear.
Mrs. Blackburn. OK. Ms. Espinel, do you think they will
reach an agreement, and what do you see as the stumbling
blocks?
Ms. Espinel. We are, as I said, confident, strongly
cautiously optimistic that the Department of Commerce and the
European Union will be able to come to an agreement. All
indications are that the discussions are going well. And as Dr.
Meltzer pointed out, there are very strong interests on both
sides of the Atlantic to coming to an agreement.
So, while not wanting to diminish the difficulties inherent
in that, we do believe that they will come to an agreement in
the short-term, although I feel duty-bound to emphasize that we
also believe that the short-term agreement will not be the end
of this discussion, that we will need to come up with a long-
term solution, both to serve the interests of larger companies
but also to serve the interests of the many small and medium-
sized businesses that are affected by this and the millions of
customers on both sides of the Atlantic that are affected.
Mrs. Blackburn. Thank you. I am out of time, but I am going
to submit a question for answer dealing with transfer rights,
which I think is something that we probably should be having a
discussion on also.
So I will yield back.
Mr. Burgess. The gentlelady yields back. The chair thanks
the gentlelady.
The chair recognizes the gentlelady from New York, Ms.
Clarke, 5 minutes for questions, please.
Ms. Clarke. I thank the chairman, Mr. Burgess, and I thank
our witnesses for their testimony this morning.
Ms. Espinel, we know that big companies will likely be able
to use their legal and technical solutions to get by without
Safe Harbor, but what about small businesses? And do small
businesses have the resources and expertise necessary to
implement alternatives?
Ms. Espinel. So that is a fantastic question, and as has
been pointed out earlier in this hearing, most of the companies
that are affected by the Safe Harbor are small and medium
companies. There are two different aspects of this. One way,
obviously, to try to deal with this is to build data centers
around the world. That is a solution that is out of reach to
all but the very largest of companies around the world. It is
also a very inefficient way to do remote computing and data
analytics. And in fact, it is not only inefficient, it is
impossible if information is siloed in different locations. So
that is not an option for the smaller companies.
And the difficulties of living in a world where there is a
patchwork of regulations is even harder for smaller companies
to deal with. It is no picnic for the larger companies to be
sure, but I think it is impossible for smaller companies. And I
think one of the things that it does is there are enormous
efficiencies from remote computing, from cloud computing, from
data analytics that benefit big companies, but they also
benefit small companies, in some ways even more. As Chairman
Walden said, 75 percent of the value-add there is to
traditional industries, and there are many small companies
across all economic sectors that are affected by this. And
putting a shadow over what are still relatively nascent
industries, cloud computing and the data analytics at this
point, I think it is hard to actually measure what the negative
impact of that would be going forward.
Ms. Clarke. So if you were to advise small companies, given
what we know right now in the negotiations, what sort of
infrastructure or construct would you advise these smaller
companies to begin looking at?
Ms. Espinel. So, as I said, some options are just
completely out of the reach of small companies. I think what
the small companies need is in line with what we would
recommend generally. We all of us need to have a new Safe
Harbor agreement in place. We all of us need some appropriate
amount of time to come into compliance with those new
regulations. And then we all need a long-term solution that is
going to work. And that long-term solution, I think, needs to
have at least three aspects to it. One, we talked a lot about
the importance of privacy. I think it is important that
whatever long-term solution there is it provides that a
person's personal data will attract the same level of
protection as it moves across borders.
We need to have a solution that will allow law enforcement
to do the job that it needs to do and protect citizens around
the world, and we need to have a solution that will reduce the
amount of legal uncertainty that exists right now, not just for
big companies but for small companies as well.
Ms. Clarke. So, Mr. Murphy, given the Safe Harbor ruling's
impact on small businesses, are your organizations doing
anything to ensure that small businesses have the
understanding, expertise, resources necessary to continue their
business operations without a Safe Harbor agreement?
Mr. Murphy. Well, at present, the circumstances don't
really provide workable alternatives. As I mentioned in my
testimony, the European Commission, in the wake of the ruling
by the European Court of Justice, indicated that one valid
alternative is to use what is called binding corporate rules.
But as Cam Kerry, the former general counsel at the Department
of Commerce has pointed out, implementing these can cost $1
million and can take 18 months. This is completely out of the
reach of most of our small business members. While larger
companies may be able to move in some cases to adopt such an
approach, there is really no alternative for the small
companies to revise Safe Harbor agreement.
Ms. Clarke. Have any of you panelists--I only have a few
seconds left--given any thought to sort of the nuance that has
to be an agreement that would address the concerns of small
business in our country?
Mr. Rotenberg. What we haven't discussed is the role of
innovation in the internet economy. And our view is that
privacy rules would actually encourage innovation, particularly
with small firms. And what I have in mind is to the extent that
small and medium enterprises can develop their services in way
that minimizes the privacy risk, it also reduces the regulatory
burden, because what happens when people look closely at these
data protection assessments, they ask what kind of data is
being collected? Is the credit card information secure? Do you
need the Social Security number? I think small businesses can
actually compete in this space by coming up with business
practices that are actually modeled practices for privacy
protection. That is what I would recommend.
Mr. Burgess. The gentlelady yields back. The chair thanks
the gentlelady.
The chair recognizes the gentleman from Texas, the chairman
emeritus, Mr. Barton, 5 minutes for questions, please.
Mr. Barton. I want to thank both chairmen for this joint
hearing, and it is a very important topic.
I am in a little bit of a dilemma. I am the long-term co-
chairman of the Congressional House Privacy Caucus, and I am
also a pro-business Republican, so if I put my pro-business hat
on, I want to renegotiate this Safe Harbor agreement as quickly
as possible with as little muss and fuss as possible. But if I
put my privacy caucus co-chairman hat on, I think the European
Union has highlighted a substantial issue, and that the U.S.
privacy laws aren't as strong as they could be and that people
like me think they should be.
So I guess my first question to Mr. Rotenberg would be what
is the primary difference between the European Union privacy
protections for their citizens and the privacy protection
currently under law here in the United States?
Mr. Rotenberg. Well, first of all, Mr. Barton, I actually
wanted to thank you for all of your work as a pro-business
Republican in support of consumer privacy. I think you help
demonstrate that in this country privacy is actually a
bipartisan issue, and it is compatible with business.
But I think the point you make is also critical, which is
that the Europeans have brought attention to areas of U.S.
privacy law where we have more work to do. We have a good
framework. Our Privacy Act of '74 is a good law, our Fair
Credit Reporting Act of 1970 is a good law, but these are old
laws. They have not been updated. We really haven't thought yet
about biometric identification, genetic data, facial
recognition, secretive profiling of consumers. These are real
issues. And the Europeans have spent the last decade trying to
understand how to protect privacy while promoting innovation.
So my answer is I think we should continue down the road,
which we actually started in the U.S., which is protecting
privacy in law, but keep moving forward. I think the European
decision provides that opportunity.
Mr. Barton. Under the current negotiations that are going
on between the U.S. and the European Union to come up with a
new Safe Harbor agreement, does the U.S. delegation have the
authority to make substantive changes in U.S. policy, or are we
trying to finesse the substantive disagreement and come up with
just a better administrative solution?
Mr. Rotenberg. I think it will ultimately be for Congress
to make the changes in U.S. law that are necessary to provide
adequate protection not only for the European customers of U.S.
businesses but also for the U.S. customers of U.S. businesses.
Mr. Barton. Mr. Murphy, do you agree with that?
Mr. Murphy. Our read of the ruling of the European Court of
Justice is that it was fundamentally a federalism issue within
Europe having to do with the role of the European Commission on
privacy versus the role of the data protection agencies in the
28 member states. And to a significant degree the renegotiation
of the Safe Harbor reflects their need to reorganize how they
address privacy and the dissatisfaction with how it was handled
by the Commission.
That is a complex process. Federalism is always
complicated. I don't have to tell a Member of Congress. But the
ruling itself was more process-related and about those issues
than it was about U.S. privacy protection. After all, there was
no comprehensive examination of U.S. privacy law in the context
of the European Court of Justice ruling.
Mr. Barton. Mr. Chairman, it is rare that there is not a
silver lining in every issue, and this is an example of where
in the short term we want to work with our negotiators to solve
this problem because small businesses and large businesses all
over the United States need access to the European market and
need to be able to transfer data and information seamlessly
back and forth. But in the somewhat longer term, perhaps it
will give impetus to this committee and the Congress to address
some of the fundamental issues and hopefully come up with
stronger privacy protections for our citizens.
And with that, Mr. Chairman, I yield back.
Mr. Burgess. The gentleman yields back. The chair thanks
the gentleman.
The chair recognizes the gentlelady from California, Ms.
Eshoo, 5 minutes for questions, please.
Ms. Eshoo. Thank you, Mr. Chairman. And I apologize to the
witnesses that I had to step out. There is a memorial service
for I just think one of the greatest individuals that ever
served in the Congress, the late Congressman Don Edwards. So I
hope that the questions that I ask haven't already been asked.
If they have been, it is because I had to step out.
First of all, Mr. Chairman, I would like to ask for
unanimous consent to submit for the record a November 3 letter
from the Internet Association to the chairs and the ranking
members of C&T and CMT subcommittees.
Mr. Burgess. Without objection, so ordered.
[The information appears at the conclusion of the hearing.]
Ms. Eshoo. And I thank you for that.
I mentioned in my opening statement what I think is a major
issue in this on the part of the E.U., and that is what type of
access the European data and American intelligence agencies,
you know, what should be given over because there is a very,
very large issue. I mean it is like right under the sheets, and
that is that--well, you all know what has taken place relative
to the surveillance and what was carried in the mainstream
press where American companies, products were stopped from
being shipped, things were inserted in those products,
repackaged, and sent off. Now, that is, I believe and others
believe, really damaging to the brand American product. And the
Europeans are deeply suspicious of that.
So, first of all, what I would like to ask you is how would
you handle that with the E.U.? Do you believe that there should
be an adjustment on the part of our country because this is a
big concern of theirs? And if so, how so? So just go quickly so
I just get a flavor from each one of you what your thinking is
on this issue.
Ms. Espinel. So I would just say quickly that is clearly
something that the opinion focused on as well. I think we need
to--and that is why we have been focusing on we need a short-
term solution but we also need a long-term solution because we
know that negotiation of Safe Harbor will not address all of
the larger issues, including that one.
USA Freedom Act I think was a good example of our Congress
being able to balance privacy and national security, so we
would be looking to work with Congress on this issue in the
future, and we are confident that that----
Ms. Eshoo. Do you think that the Europeans----
Ms. Espinel [continuing]. Balance can be found.
Ms. Eshoo [continuing]. Understand the steps that we took
very well? Or do you know of those conversations having taken
place so that the knowledge is deeper and broader? I don't
think we cured everything, must frankly. We really never do
because you have to develop consensus, and these are tough
issues.
Ms. Espinel. So I think that is a fantastic point, and I
think one of the things that we really need is to have a
political environment that is cooperative and constructive. And
so one of the things that I would respectfully urge Congress to
do, when you are talking to your counterparts in the European
Union, that I would urge the Administration to do that we can
do as well is to help the Europeans understand our privacy
system better, including some of the recent improvements like
the USA Freedom Act.
I take this opportunity to thank you all for voting for the
Judicial Redress Act and hope that the Senate follows your
leadership on that.
Ms. Eshoo. Great. Let me just get one more in to you and to
others. This weekend, the CEO and cofounder of Virtru authored
an op-ed in VentureBeat in which he suggested that encryption
and anonymization are ways to adapt to the E.U.'s new data
rules. Do you agree? Do you disagree? Do you think it is
helpful? Do you think that it will----
Mr. Rotenberg. This is almost exactly----
Ms. Eshoo [continuing]. Serve our interests?
Mr. Rotenberg. Yes, this is almost exactly the point I was
making to Congresswoman Clarke. I actually think both of those
techniques, encryption and anonymization, provide an
opportunity for internet-based businesses to minimize their
privacy burdens. I think it would be----
Ms. Eshoo. Has anyone taken this on voluntarily that you
know of?
Mr. Rotenberg [continuing]. A very good step forward.
Ms. Eshoo. Any companies to your knowledge taken this on
voluntarily?
Ms. Espinel. In terms of encryption----
Ms. Eshoo. To adopt these practices----
Ms. Espinel. So I would just say that----
Ms. Eshoo [continuing]. Post-Snowden----
Ms. Espinel [continuing]. Our companies care deeply about
privacy. Many of them have adopted various encryption practices
in order to protect their customers' data.
Ms. Eshoo. Thank you to the witnesses. Again, thank you,
Mr. Chairman.
Mr. Burgess. The gentlelady yields back. The chair thanks
the gentlelady.
The chair recognizes the gentleman from New Jersey, Mr.
Lance, Vice Chairman of the Commerce, Manufacturing, and Trade
Subcommittee, 5 minutes for questions.
Mr. Lance. Thank you, Chairman, and good morning to the
distinguished panel. And I commend you, Mr. Chairman and the
other chairman, Mr. Walden, for this very important hearing.
This is obviously a challenge based upon the decision, but
I think we have the expertise and the bipartisan cooperation,
particularly in this committee, to overcome the challenge and
to work together to an effective solution. And I guess in the
short-term or intermediate term, it is the negotiations now
occurring but then moving forward. My estimate would be is that
we probably ultimately need legislation. I would like the view
of each member of the panel on whether I am correct on that,
current negotiations, but then perhaps we will have to have
legislation as well, to each member of the distinguished panel.
Ms. Espinel. So in terms of having a long-term
sustainable----
Mr. Lance. Yes.
Ms. Espinel [continuing]. Global solution, we will need to
work with a number of countries on that, including the United
States.
I would say I don't want to dismiss the improvements that
have been made to our legislation recently in the last couple
of years and beyond legislation such as the President's Order
number 28 and increase FTC enforcement. I do think we may need
to look at other legislative options in the future. And we
would obviously like to be working closely with Congress on
that. But I think in order to come up with a global framework,
we will be needing to work with governments around the world to
either update their systems or to have a principle-based
approach that is flexible enough that it could work within all
of our systems.
Mr. Lance. Thank you. Dr. Meltzer?
Mr. Meltzer. Yes. I agree that a significant amount of
progress has been made here domestically. I mean the issues
around surveillance and collecting personal data is one which
is obviously important domestically and has been driven by
domestic factors rather than what the E.U. wants the U.S. to
do. And I think that will continue to be the case.
This discussion with the E.U. tends to be a bit distorted
because the European Commission has no authority over national
security issues. So what is missing in this debate on the E.U.
side is actually the fact that the national security agencies
are more or less doing very much what the NSA does and probably
with a lot less due process. So we need to remember that this
is not necessarily--the U.S. has got a particular balance
between national security and privacy, which is working
through, and this debate also needs to be, I think, invigorated
when we talk about this in the E.U. context as well.
Mr. Lance. And before answering, Mr. Rotenberg, let me say
I share Chairman Emeritus Barton's concerns regarding privacy.
And I think it is certainly possible to be a business-centric,
relatively conservative Republican and greatly interested in
privacy. And then I think it is also possible obviously on the
other side, on the Democratic side. So your views as to whether
we will need legislation ultimately?
Mr. Rotenberg. Thank you. I am quite certain you will need
legislation. And let me tell you what I think will happen----
Mr. Lance. Yes, sir.
Mr. Rotenberg [continuing]. If you don't have legislation.
Mr. Lance. Yes, sir.
Mr. Rotenberg. If you only have a revised Safe Harbor 2.0
and you don't address these 702 problems and wait until 2017
when that expires and you don't solve the problem that the FTC
actually doesn't have enforcement, I think you will almost
immediately see European data protection agencies attack the
revised agreement. So to have a meaningful agreement that
addresses the concerns that have been set out in the court's
opinion, you have to do at least those two things. You have to
update 702 and you need enforcement authority for the FTC.
Mr. Lance. Thank you. Mr. Murphy--and I am certainly
interested in you with the Chamber of Commerce because you
represent what is best in America and our entrepreneurial
spirit.
Mr. Murphy. Well, thank you. Certainly, it is in the realm
of a pro-business conservative to support privacy in businesses
as well.
Mr. Lance. Of course.
Mr. Murphy. Privacy is indispensable.
Mr. Lance. Of course. Of course.
Mr. Murphy. And companies take this very seriously.
I would just add a clarification, though, that with regard
to whether or not there should be further privacy legislation
in the United States, the ruling of the European Court of
Justice does not provide a roadmap for that. It was process-
oriented. It had to do with federalism within the European
Union. It did not assess in any comprehensive way U.S. privacy
laws.
Mr. Lance. Substantive--yes, it was a procedural matter.
I think this is very helpful, and I am sure we will
continue to work with the entire group. And this is an
important issue. And, Mr. Chairman, I yield back at 17 seconds.
Mr. Burgess. The gentleman yields back. The chair thanks
the gentleman.
The chair recognizes the gentleman from Vermont, Mr. Welch,
5 minutes for questions, please.
Mr. Welch. Thank you very much, Mr. Chairman, and thank the
witnesses.
Mr. Rotenberg, you mentioned that if we are--the
legislation would have to address the 702 problem and provide
FTC enforcement, correct?
Mr. Rotenberg. [Nonverbal response.]
Mr. Welch. I want to ask you, Mr. Murphy, whether that
would be problematic for you to allow the FTC to actually have
the enforcement authority and to address the 702 problem.
Mr. Murphy. I don't think we are in a position to assess
that right now, but as a general rule, the business community
has felt that the FTC does have extensive abilities to enforce
U.S. privacy laws that exist. And we are constantly trying to
educate our European colleagues about the misconceptions may
have about the U.S. privacy regime. There is----
Mr. Welch. Well, let me just interrupt a second because
this is really pretty critical. You have got, I think, general
agreement here that we definitely want to have this Safe Harbor
agreement extended. We want to be able to have this fluid flow
of information back and forth really for business reasons.
There is a general agreement on privacy. But in order for there
to be real enforcement, there has to be some mechanism to take
action in the event there is a breach that then gets us
sometimes in this committee into a debate about the authority
of, in this case, the FTC to act. There are a lot of folks, I
think, who are pro-business who would be in favor of proper
enforcement as long as it didn't go overboard. So I am just
looking for some indication from you as to the openness from
your perspective as someone who would be advocating for the
business advantages of having that include a proper enforcement
by a regulatory agency like the FTC.
Mr. Murphy. It is something that I think calls for further
investigation with our membership.
Mr. Welch. OK. Ms. Espinel, let me ask you a few questions.
Thank you very much, by the way.
Just to recount the amount of business that goes back and
forth, I mean, what are the implications for your industry in
the event this problem is not solved?
Ms. Espinel. So the implications are very significant, and
it is not just the nearly 5,000 companies that have used the
Safe Harbor. It is the millions of customers that rely on that.
But there are all sorts of other implications as well. For
example, one of the things that we talk about in the area of
cybersecurity is that you need information to follow the sun.
You need cyber threat information to be in the hands of
experts, wherever they are awake around the world, as quickly
as possible. And things like the revocation of the Safe Harbor
put that at risk.
Many of the companies that rely on the Safe Harbor using
that in part to process payroll so that their employees back at
home can be paid on time. Revocation of the Safe Harbor puts
that at risk.
I am confident that there are apps being developed in every
district represented in this room. If those small companies,
those small app developers want to extend into Europe, the
revocation of the Safe Harbor puts that at risk.
But more generally, the enormous business efficiency gains
by both big companies and small companies from remote
computing, from data analytics cannot work unless data can move
across borders. So the revocation of the Safe Harbor, one of
the big risks there is that it takes all of that efficiency,
all the enormous potential gained from that efficiency and puts
them at risk. And that affects every economic sector. That is
not just the software industry. That is every economic sector
in the world.
I will just close by saying briefly, beyond the business
effects, there are enormous societal benefits that are coming
from things like data analytics, from forecasting cholera
outbreaks to saving the lives of premature babies to helping
farmers reduce use of pesticides. But it is a very new
industry, and I think the shadow that the Safe Harbor decision
casts over a nascent industry is potentially very damaging.
Mr. Welch. OK. Thank you. I only have time for one more
question, but thank you. I consider that a call to action, Mr.
Chairman.
Dr. Meltzer, the dispute here, how much of it has to do in
your view with the revelations by Snowden where, on the one
hand, that raised questions about the privacy of information
that was accessible to national security authorities here, but
in Europe we are being told that in fact the security agencies
there do the same but with less protections?
Mr. Meltzer. Certainly, the Snowden revelations have cast a
significant pall over the entire political discourse in Europe
around this issue. There is generally large mistrust in a
number of member states about the way that the U.S. Government
accesses personal data, and it is not well understood about the
progress that has been made in the last couple of years to
change that balance. So I think getting that right has
certainly been part of it.
It is actually the case that this is a strange debate in
Europe to the extent that the national security agencies are
not part of the discussion here, and so the balance in the U.S.
between innovation, privacy, and that issue is being reflected
very differently in Europe.
Mr. Welch. OK. Thank you. I yield back.
Mr. Burgess. The gentleman yields back. The chair thanks
the gentleman.
The chair recognizes the gentleman from Ohio, Mr. Latta,
the Vice Chairman of the Communications and Technology
Subcommittee, 5 minutes for questions, please.
Mr. Latta. Well, thanks very much, Mr. Chairman, and again
to our witnesses, thanks very much for all of the information
you have given us today. It is very enlightening.
Because when we are talking about trade, it is important to
all of us. I visit a lot of my businesses in my district all
the time, and small businesses especially, it is amazing how
many of them are telling me that they are looking at overseas
to find more job creation for at home and then sell their
products abroad. So this is very, very important to them to
make sure that they can get their products out. And it is also
making sure that they keep the people employed.
If I could ask Mr. Murphy, again, we have been talking
about this. I know the gentleman from New Jersey was also
talking about it a little bit ago that when the European Court,
you said, did not examine the recent change in the U.S.
oversight electronic surveillance, and you get into the
essentially equivalent to the safeguards that exist in the E.U.
What we have to do right now to get the Europeans convinced
that we are going to have that, essentially the equivalent for
our businesses to be able to work with them overseas right now?
Mr. Murphy. Well, more than anything I think we can do on
this side of the pond, it is what we are seeing European
business do because if failure to achieve a new Safe Harbor
agreement is bad for American business, it is far worse for
Europe. According to ECIPE, the European Centre for
International Political Economy, the think tank in Brussels,
they conducted a study which found that complete data
localization in Europe, which is obviously the worst possible
outcome of the controversy today, would cost the European
economy 1.3 percent of GDP. That is more than $200 billion.
It would mean higher costs for European consumers. As
competition is lessened, small businesses in Europe would be
particularly hard hit, as I think we have discussed, in a
number of ways here. Some of the smaller E.U. member states
would be particularly sidelined. You think about major service
providers of digital services that are provided to companies
and consumers, in many cases they might simply overlook some of
the smaller member states.
We are often hearing from our European friends that they
want to develop their own Silicon Valley. They lament that for
some reason the U.S. economy is much more innovative. We have
an ICT sector in this country that is growing and growing and
why can't they achieve it. Well, this kind of ruling could have
a very chilling factor. And we should care about that because
Europe is our number one economic partner by far, and if their
economy, which is experiencing quite slow growth today, a
failure to find a path forward here would be very costly for
the American economy as well.
Mr. Latta. Thank you.
Mr. Meltzer, if I could turn to you, and again, your
testimony and also what you have written in your testimony that
when you look at the internet commerce in the United States
grew from over 13 billion in 2011 to the estimate of about 133
billion in 2018 we are seeing what is happening out there. But
another question is, will the invalidation of the Safe Harbor
agreement indirectly impact trade relations in economies of
countries that are outside the E.U.?
Mr. Meltzer. I think potentially, yes, absolutely it will
be through a variety of mechanisms. One of them certainly is
the fact that trade and commerce now happens in the context of
global value chains. So a lot of the cross-border data between
the U.S. and the E.U. is in fact incorporating imports and
products from around the world, certainly from our NAFTA
partners but more globally. And so the impacts and the flow-
through of reductions in transatlantic trade investment is
going to have global implications at that level.
More broadly is how this privacy debate, I think, plays out
globally, whether in fact the world moves down an E.U. top-down
privacy approach or adopts more of the U.S. bottom-up company-
led sectorial approach is going to, I think, have a broader
implications for the types of business models and trade flows
that happen globally and will have significant implications for
the U.S. going forward.
Mr. Latta. Let me ask a follow-up on that, then. What
should the U.S. Government be doing right now to preempt the
problems that could exist then for these countries outside the
E.U. because of the decision?
Mr. Meltzer. I think one of the main efforts by the U.S.
Government has been in the APEC context, the cross-border
privacy principles there, which has been a set of principles
around privacy, really quite similar to the ones that the E.U.
has. On the principle level there is not that much
disagreement. It is really about how they are going to apply it
and enforce, whether in fact businesses take responsibility for
the privacy of the data or ultimately it is going to be up to
sort of a more regulatory government approach to make sure that
that happens.
Now, the differences cannot be so great even on that front,
but that model, the APEC approach, is the one that the U.S. has
been trying to push through APEC and through other trade
agreements in another forum.
Mr. Latta. Well, thank you very much. Mr. Chairman, my time
has expired and I yield back.
Mr. Burgess. The chair thanks the gentleman. The gentleman
yields back.
The chair recognizes the gentleman from Illinois, the
subcommittee chairman of the Environment and the Economy
Subcommittee, 5 minutes for questions, please.
Mr. Shimkus. You forgot to say the powerful chairman of the
Environment and the Economy.
Welcome. We are glad to have you here. I am going to be
brief. I know my colleagues want to ask a few more questions,
and we are kind of beating a dead horse.
I just wanted to say, first of all, we need to get to Safe
Harbor 2.0 as soon as possible. And we really can't move to
data localization. It will hurt all these things on commerce
not just for big businesses but individual consumers. If you
look at banking transactions or you are looking at obviously
information, engineering data going back, so I am not sure that
the public understands the enormity of this issue, and so we
want the Administration to keep moving forward possibly in this
realm.
But I am always curious about the court ruling and the
European community not looking to their own backyard, and to
the fact that I think the French new national security
surveillance protocols are much more intrusive, and the
proposed U.K. could be just as bad on the issues of privacy.
So, Dr. Meltzer, can you talk about that little bit? And are
they more intrusive in how they might differ?
Mr. Meltzer. I think we are seeing in France following the
attacks, the Charlie Hebdo attacks and the attacks on the
Jewish supermarket, that there have been proposals to
reinvigorate and strengthen the way that the national security
agencies operate in France, and certainly some of the proposals
there would see collection of data and due process, which would
be less than what you see in the U.S.
I think the point is that each country has got to find its
own appropriate balance between national security and privacy.
The U.S. is clearly going for a revision of that balance here
following the Snowden leaks. The problem I think in the debate
is that the way that discussion is playing out is that we have
a separate debate on privacy as a human right when we talk
about this between the U.S. and the E.U., and it ignores the
security dimension to these, which is happening at the national
member state level.
Mr. Shimkus. But they are member states of the E.U., so it
is curious for many of us to say it is oK for them locally
within their own own country, but as a member of the E.U. to
place these additional barriers or concerns or disrupt trade
when internally they may be as----
Mr. Rotenberg. Mr. Shimkus----
Mr. Shimkus [continuing]. I want to continue. One more
question for Dr. Meltzer, and I did want to be brief. Can you
talk about the--Dr. Meltzer, back to the major part of the
economy. Any parts of the economy that would not be affected if
this Safe Harbor ruling stays in place?
Mr. Meltzer. Most certainly, I think this point has been
made and is worth reinforcing that this is very much an economy
issue. This is not a digital economy issue. This is not an IT
economy issue. The advanced economies of the United States and
Europe are increasingly digital in their entirety, whether we
are talking about manufacturing sector, services sector, and
certainly the IT sector, the automobile sector, you name it. So
there is no area that would not be affected by it.
Mr. Shimkus. Thank you, and I want to yield back my time.
Thank you, Mr. Chairman.
Mr. Burgess. The gentleman yields back. The chair thanks
the gentleman.
The chair recognizes the gentleman from Kentucky, Mr.
Guthrie, 5 minutes for questions, please.
Mr. Guthrie. Thank you, Mr. Chairman. I appreciate you all
being here. I was just in a meeting with our NATO Alliance
members, Members of Congress, parliaments from NATO Alliance,
and although we were talking about defense issues in our
meetings, almost every time we were walking in or out or just
coffee breaks, whatever, the European parliamentarians were
very interested in talking about this issue. So it is important
here, it is important there, and everybody is focused on that,
so I would bring that up.
But, Ms. Espinel and Mr. Murphy, I have a few questions. Do
you have member companies that are headquartered in the E.U.
but have operations, subsidiaries, or other investment vehicles
in the U.S.? And if so, how has this decision impacted their
business operations?
Ms. Espinel. We do have members that are headquartered in
the United States, and we also have members with significant
operations in the United States. But I would say for our
members, regardless of where they are headquartered, the risks
are the same. Our members, regardless of where they are
headquartered and the customers that they serve, need data to
be moving back and forth across borders. So I think regardless
of where--the world that we live in today, regardless of where
you are headquartered, I think the risk of the Safe Harbor
revocation or the risk of a world in which data cannot move
freely back-and-forth are the same.
Mr. Guthrie. Thank you. And, Mr. Murphy?
Mr. Murphy. Just very briefly, we have many members that
our U.S. affiliates of European multinationals, and they are
just as concerned as the American companies. They see no upside
in this. It doesn't provide some kind of a competitive
advantage for them to have this kind of forced localization,
which would be the worst possible outcome of the failure to
renegotiate Safe Harbor. So there is common interest in
securing a path forward here.
Mr. Guthrie. All right. So, Mr. Murphy, I will ask this to
you then. So data localization proposals have been considered
in a number of countries in the past 3 years. This topic was
the focus of another meeting of this subcommittee. What has
your experience been with the challenges these types of
proposals pose to the economies in today's global marketplace?
Cross data flows have international implications. Kind of
elaborate what you were just saying, I guess.
Mr. Murphy. Yes. In more than a dozen countries around the
world we have been active in trying to reach out to foreign
governments to explain to them why data localization is not in
their interest. As I mentioned earlier, there is nothing more
common than receiving a head of state at the U.S. Chamber of
Commerce who says we want to create our own Silicon Valley. The
idea of putting up protectionist walls that are going to
somehow force the location of servers in the country or the use
of domestic-created technologies is really the worst possible
prescription for them to be able to do that and do so in a
globally competitive manner.
So there have been victories in the past couple of years.
For instance, the Brazilian Government considered measures that
they later rolled back after hearing from businesses around the
world, and it has been quite a constructive relationship. But
we continue to see these issues pop up in market after market.
Mr. Guthrie. Thanks. I have one more question for you, and
if Ms. Espinel will comment as well.
So first, Mr. Murphy, how would you describe the FTC as an
enforcement agency for the Safe Harbor? And how do FTC
enforcement actions modify business behavior in the U.S.? And
do you see any differences in E.U. system that we should be
aware of? And, Ms. Espinel, if you will comment after he goes.
Mr. Murphy. Yes. Well, the U.S. has one of the strongest
systems of enforcement led by the FTC, and it has powers and
penalties that are significantly stronger than its counterparts
in the European Union, including 20-year consent decrees. We
think that many of our friends in the European Union don't take
that into account, and in particular, don't take into account
how these laws are actually enforced, whereas with some other
countries that may replicate an E.U. member state law, they
would accept their practices as somehow superior to those of
the United States, even if enforcement is not nearly on the
same level.
Mr. Guthrie. Thanks. Ms. Espinel?
Ms. Espinel. I would just say, you know, I think at a
fundamental level the systems and certainly the focus on
privacy between the United States and Europe are not that
different, but one of the things that is different about our
system is the enforcement authority of the FTC. And I would say
on behalf of the software sector we have seen the FTC
increasing its enforcement authority and using it in ways--and
we think that those are positive steps.
We do think, as has been alluded to earlier today, that
there may not be a full understanding on the other side of the
Atlantic of the improvements that have been made in our privacy
system, including FTC enforcement. I think that is something we
need to collectively try to address.
But to your basic question, we are supportive of FTC
enforcement, and we have been seeing more of that over recent
years, and we think that is a good development.
Mr. Guthrie. Thank you. And I yield back the balance of my
time. I appreciate it.
Mr. Burgess. The gentleman yields back. The chair thanks
the gentleman.
The chair recognizes the gentleman from Mississippi, Mr.
Harper, 5 minutes for questions, please.
Mr. Harper. Do you need to say Mississippi again, Mr.
Chairman? Did you get that?
Mr. Burgess. [Nonverbal response.]
Mr. Harper. Thank you. And thanks to each of you for being
here today. This is a critically important topic, and to
discuss this is very important.
And, Ms. Espinel, if I could ask you first, can you explain
how the United States can make the case that we offer essential
equivalence in terms of data protection currently?
Ms. Espinel. So, I would say a couple of things. I think in
terms of--as we said before, I think our immediate goal is to
try to get a new Safe Harbor, and I think that is a step that
the European Commission can take if they choose to do so. And
we are optimistic that they will choose to do so.
But in looking at the long term, essential equivalence or
the appropriate standing for privacy protection, that is
something that is going to continue to evolve, so that is our
opinion, as laws and practices change around the world. And so
what we need for the long term is we need a system that is
flexible enough. We believe we need a system that is based on
principles as opposed to prescriptive regulations. And we need
a system that recognizes the importance of privacy. And again,
I don't think the differences there between the United States
and Europe are that great, but also creates a framework so that
a person's personal data will attract the same level of
detection as it moves around the world. I think that is
something that is important to the United States, as well as
Europe.
And we need to be able to find the right balance. We need
to let law enforcement do the job that it has to do. And you
will not be surprised to hear, on behalf of the business
community large and small, we need to have a system that will
reduce the legal uncertainty of the situation that we face
today.
Mr. Harper. OK. And of course the challenge for us is to
make sure that the rules and regulations don't get in the way
of the technology that seems to move at a much faster pace on
occasion. So it is a challenge for all of us to go there.
Mr. Murphy, if I could ask you, and I know following up on
what has been discussed, what you have mentioned, the ECJ
ruling puts some European businesses who transfer data to
American companies at risk as well. Could you discuss further
whether European businesses have any incentive to put pressure
on the U.S. and the Commission to come to an agreement on the
Safe Harbor, and if so, how?
Mr. Murphy. Well, thank you for that question. Many of our
sister associations on the other side of the Atlantic are hard
at work reaching out to the European Commission and to member
state governments urging them to find a path forward as well.
If there is one thing that businesses of all sizes dislike, it
is uncertainty, and the reach of the ruling that came out in
early October was significantly further than anything that was
anticipated. And the absence of any kind of a clear transition
plan, guidance to companies on how they should behave in the
interim while--plus, potentially, this new Safe Harbor
agreement is concluded, has caused real concern across
companies in Europe as well. So we have encouraged them to make
their voices heard in Europe, as we are doing here.
Mr. Harper. Thank you, Mr. Murphy.
With that, I yield back, Mr. Chairman.
Mr. Burgess. The gentleman yields back. The chair thanks
the gentleman.
The chair recognizes the gentleman from Texas, Mr. Olson, 5
minutes for questions, please.
Mr. Olson. I thank the chair. And welcome to all four
witnesses.
In many ways, Europe is following Rahm Emanuel's--President
Obama's first chief of staff--lead. He said, ``you never want a
serious crisis to go to waste.'' The difference is this is not
a serious crisis. It is a problem. Again, it is not a serious
crisis. It is a problem that will be a crisis unless we fix it
by January 31 of next year.
Mr. Murphy, Ms. Clarke brought up the BCRs, the binding
corporate rules, also the model contract clauses. Companies
have those in effect right now. How are they impacted by the
ECJ decision with their data?
Mr. Murphy. How----
Mr. Olson. How are they impacted? How are the contract
clauses and the binding corporate rules--companies have those.
Their data, how is it impacted by the ECJ's ruling?
Mr. Murphy. Well, these mechanisms were not invalidated by
the ruling. However, they are practically out of reach for so
many different companies. And as was mentioned earlier, the
expense of $1 million and the time it takes, 18 months, to
negotiate a new one has made them really impractical for many
companies to consider this as an alternative. And you might
think that in the wake of this ruling that many companies are
considering whether and how they can enter into more of these.
And it appears that in the case of some large companies, they
are definitely examining some of these alternatives going
forward. But for the smaller companies, it simply isn't
tenable.
Mr. Olson. Ms. Espinel, care to comment on that issue, the
BCRs, the MCCs with your members?
Ms. Espinel. So many of our members are looking at various
mechanisms to address this, but I would echo what Mr. Murphy
said. Despite the fact that the European Court of Justice
opinion does not speak directly to things like the model
contract clauses, they are first out of reach for many, many
businesses around the world.
And second, to us, they do not represent the sort of long-
term solution that we need to have, and that is why we continue
to focus on the fact that, while we think it is immediate and
vital to have a new Safe Harbor in place and then have some
time for companies to come into compliance with that, we need
to have a long-term solution that moves beyond things like
model contract clauses so that we do not find ourselves in this
situation again a year or two down the road.
Mr. Olson. One final question for all witnesses, the ECJ's
decision may open up liability for data transfers from Europe
to America for the entire period of the 15 years of Safe
Harbor. A Bloomberg article says we may be exposed to
liability. My question is, is that real, Ms. Espinel? Is that a
real issue out there? Can 15 years be thrown away with this
court decision, exposed liability, American companies, European
companies?
Ms. Espinel. I think there is a real risk there. However, I
would echo what you said. I think what we are facing right now
is a significant problem, not a crisis, and I say that in part
because we are confident that the United States and Europe will
be able to come to a sensible resolution and conclude a Safe
Harbor and avoid that situation.
Mr. Olson. Dr. Meltzer, your comments, sir?
Mr. Meltzer. Let me just say briefly on your question about
BCR and contracts, I agree with what the panelists have said.
It is worth noting that data protection authorities in Germany
have specifically said that they do not think that BCRs and
contracts are legally viable mechanisms any longer. The concern
obviously is that the structural problems that the European
Court of Justice has found with the privacy regime here in the
United States is broadly applicable to contracts and BCRs as
well. So the issues there make these other mechanisms also
unstable.
Mr. Olson. Thank you. Mr. Rotenberg, the question about
liability thrown out for----
Mr. Rotenberg. Yes, Mr. Olson, I don't think there would be
retroactive application of the Safe Harbor decision for prior
data transfer, so the short answer is I don't think that risk
exists.
However, I think there is another risk to be aware of,
which is that this January 2016 deadline that people are
talking in terms of presumes that the Article 29 Working Party
can keep all of the data protection officials in Europe in
check. And all of those national officials have independent
authority, so it is actually possible that at any time over the
next few months there could be an enforcement action after the
Schrems decision became final.
Mr. Murphy, data for the last 15 years of our Safe Harbor,
some sort of liability for those?
Mr. Murphy. I don't have an answer for you, but certainly,
this is precisely the sort of uncertainty that alarms corporate
counsel and companies across the country.
Mr. Olson. I thank the witnesses. I ask unanimous consent
to enter the article from Bloomberg in the record. And,
Chairman, I yield back.
Mr. Burgess. Without objection, so ordered.
[The information appears at the conclusion of the hearing.]
Mr. Burgess. The chair recognizes the gentleman from
Kansas, Mr. Pompeo. Thank you for your forbearance, and you are
recognized for 5 minutes for questions.
Mr. Pompeo. Thank you, Mr. Chairman.
I want to try and clear away some of what I think are the
underlying facts. We have talked a lot about policy. I want to
make sure we have got, as best I can, some basic facts in
place.
Ms. Espinel, maybe we will start with you. Your companies'
data, if the data belongs to a U.S. person or a non-U.S.
person, do your companies treat that data any differently?
Ms. Espinel. Our companies put the highest level of
protection and security on all of their customers' data,
regardless of the nationality.
Mr. Pompeo. Right. So they treat it identically. Mr.
Murphy, same for yours? It doesn't matter whether a U.S. person
or--the data is treated identically?
Mr. Murphy. Absolutely.
Mr. Pompeo. The same protections? We could go look at the
record. I have heard the word privacy concerns uttered maybe 50
times this morning. Concerns are one thing. Ms. Espinel, is
there any evidence of abusive practices from U.S. companies
with respect to handling PII of either U.S. persons or non-U.S.
persons? We have data breaches, we have data get out. I get
that. But yes, to you.
Ms. Espinel. So I will speak on behalf of my members. Our
members are not abusing the data of their customers.
Mr. Pompeo. Right. They are doing their best to protect it.
Mr. Murphy, I assume yours are as well?
Mr. Murphy. That is certainly my impression. And the
potential reputational damage from failure to do so is, I
think, a powerful factor in their consideration.
Mr. Pompeo. I completely agree. And let's talk about
reputational damage actually. Mr. Rotenberg in his written
testimony in the summary said ``transatlantic data transfers
without legal protections were never safe.'' Mr. Murphy, do you
think that is true? Do you think these data transfers have been
performed in an unsafe manner?
Mr. Murphy. No, I think that it has been a 15-year record
of success and really comparable in success to that related to
data transfers within Europe between member states.
Mr. Pompeo. Ms. Espinel, would you agree with that?
Ms. Espinel. Speaking for the members that I represent,
yes, I would agree with that.
Mr. Pompeo. So I think it is that kind of hyperbole that
has caused the European elected officials to have no backbone
on this issue. I get the politics, I get the protectionism. I
completely understand how they have all watched the Snowden
hearings and decided they could get elected but didn't defend
the privacy actions that are taken by your companies. We have
had talk today about Section 702. Mr. Murphy, do any of your
clients ever collect data under Section 702?
Mr. Murphy. I just have no information on that.
Mr. Pompeo. Yes. Ms. Espinel, do you know?
Ms. Espinel. I don't. But what I would say is that we have
made this point in the hearing before. I think one of the
things that is crucial here is that there is a real lack of
understanding on both sides of the Atlantic, but I think the
Europeans, both on privacy regimes but also, as was touched on
earlier, the complications of our various surveillance regimes.
And one thing that I don't think has been done but I think be
very useful is to have a comprehensive analysis of the
surveillance regimes across the European Union states because I
don't think there is a good and clear understanding, and I
think that has led to a lot of confusion, you know, deliberate
or not.
Mr. Pompeo. Yes, I think that is not lack of understanding.
I think that is willful ignorance. But maybe we disagree.
Mr. Rotenberg, I want to make sure I understood something
you said. You talked about Section 702 a bit. I know a little
bit about it but maybe you know more. Is it your position that
U.S. persons and non-U.S. persons should be treated identically
with respect to the U.S. Government collection of information?
Mr. Rotenberg. I think under the Foreign Intelligence
Surveillance Act there is a clear distinction----
Mr. Pompeo. No, I am asking if you think. You have
suggested a modification to U.S. law. That is U.S. law. I guess
my question is, is it your position or your organization's
position that U.S. persons and non-U.S. persons should be
treated identically with respect to government information
collection?
Mr. Rotenberg. As a general matter, yes. And most of U.S.
privacy law takes that position, particularly on the commercial
side. There is no distinction in our commercial privacy law----
Mr. Pompeo. Yes.
Mr. Rotenberg [continuing]. Between U.S. persons and non-
U.S. persons.
Mr. Pompeo. Fair enough. Just so you know, that would be
historic. You could very well be right about it being proper,
but no nation has ever behaved that way with the collection of
data for their own citizens as against the others. There is
always a wrinkle. There is always an exception. There is always
a Section 1233, executive order. There is always a way that
nations have, in their efforts to provide national security for
their own people, have behaved that way. And I actually think
the United States has done a remarkable job of protecting
citizens all around the world and protecting their data in
their efforts to keep us all safe. I think that is important.
Mr. Rotenberg. Sir, may I ask, do you think that the Office
of Personnel Management has done an excellent job protecting
the records of the federal employees----
Mr. Pompeo. Well, no, sir. There are errors all along the
way. I am asking----
Mr. Rotenberg. Twenty-one-and-a-half million records----
Mr. Pompeo [continuing]. About policy. I am asking about
policy and----
Mr. Rotenberg. SF-86, those----
Mr. Pompeo. Yes.
Mr. Rotenberg [continuing]. Are the background
investigations----
Mr. Pompeo. Very familiar with that. I filled one out and I
think mine was released as well, sir, so I am intimately
familiar with that. I didn't say we didn't have errors and
mistakes. I am simply talking about policy.
Let me ask one more question. Mr. Murphy, you talked about
this million-dollar cost for private solutions, these BCRs or
other delegated methodologies. Is there any way to drive that
cost down? Is there any way to make that a hundred-thousand-
dollar cost instead of a million-dollar cost?
Mr. Murphy. Not substantially. And I think that as we look
at some of these alternatives like BCRs to the degree that they
do continue to be relevant going forward, it is a field day for
lawyers. And I suppose there is some job creation in that. But
that is clearly not the intention of the policy.
Mr. Pompeo. Thank you. I am past my time. Thank you for
bearing with me, Mr. Chairman. I yield back.
Mr. Burgess. The chair thanks the gentleman. The gentleman
yields back.
The chair recognizes the gentleman from Florida, Mr.
Bilirakis, 5 minutes for your questions, please.
Mr. Bilirakis. Thank you, Mr. Chairman. I thank the panel
for testifying.
This issue arose quickly, and I am glad we are addressing
it today so that some certainty can be given to the numerous
businesses seeking answers as they tried to continue the
pursuits in a global marketplace.
Ms. Espinel and Mr. Murphy, I know you touched on this a
bit, but what challenges are companies facing as they evaluate
and even implement the other mechanisms in the E.U. that permit
data transfers to countries outside the E.U.?
Ms. Espinel. So one specific challenge that companies are
facing, big companies and small companies, is the processing of
their payroll and making sure that their employees get time. If
there is not a resolution of the Safe Harbor, that is something
that could be at risk. And that is obvious business disruption,
but it is also disruption to the lives of human beings that are
employed by those companies.
Let me mention one thing that I haven't mentioned before.
We did a survey last year, which I would be happy to share,
where we talked to the CEOs and senior executives of companies
in the United States and Europe in terms of what data meant to
them and how valuable it was to their business. And one of the
things that was really surprising to me is really small
companies, companies that have less than 50 employees, already
today find data enormously important to going into new markets,
serving their customers, developing new products. What I found
less surprising is that that is true on both sides of the
Atlantic. So for U.S. companies and for European companies the
ability to move data back and forth in order to do business is
critically important.
Mr. Bilirakis. Thank you, Ms. Espinel.
Mr. Murphy?
Mr. Murphy. Well, a little to add but I would just--to
recapitulate one point, the morning the ruling came out I think
many of us were just disappointed at the lack of any guidance
that came out from the European Commission. And there has been
a little more since then, but that is exactly the kind of
uncertainty that serves as a wet blanket on the economy at a
time when not only is the U.S. economy not growing as rapidly
as we would like, but in Europe, far worse. And it is the last
thing that the global economy overall needs right now.
Mr. Bilirakis. Well, thanks so much. Another question for
you, Mr. Murphy. What impact does the European Court of Justice
ruling have on the negotiations of other large-scale
international trade agreements like the TPP and the T2?
Mr. Murphy. So the United States and the European Union are
2 years into negotiating a comprehensive Transatlantic Trade
and Investment Partnership agreement. These negotiations are
still at a relatively early stage despite the length of time
involved. This kind of a ruling, though, it does certainly put
a damper on the mood in the room. After all, the TTIP, as that
negotiation is called, is intended to safeguard not just the
movement of goods and services across international borders but
also data as a trade issue.
U.S. trade agreements, including the TPP, have strong
measures to prohibit the forced localization of data. And of
course, privacy regimes coexist with those trade obligations.
And privacy obligations are not undermined by the trade
agreements.
But the situation we have right now with the invalidation
of the Safe Harbor agreement certainly has led some to question
the seriousness with which we can move forward in those
negotiations.
Mr. Bilirakis. So there are some national security concerns
until the Safe Harbor agreement is signed?
Mr. Murphy. Well, certainly for commercial data and the
ability to move it across border, that is very much a concern.
Mr. Bilirakis. Thank you. Thank you.
Dr. Meltzer, what impact has the global reach of the
internet had on small and medium-sized businesses? You
mentioned in your testimony that they are underrepresented in
international trade. Is this just a function of their size or
can we incentivize small- and medium-sized businesses in
international trade agreements going forward?
Mr. Meltzer. Traditionally, SMEs have not made big plays in
the international economic landscape. It has been for a variety
of reasons to do with cost and capacity. The internet has
certainly changed that for them. The International Trade
Commission did an interesting study which found that access to
information, for instance, about overseas markets has been one
of the key barriers for small- and medium-sized enterprises. In
just thinking about going global, the cost of getting that
information is obviously now close to zero. That is just one
example of the many ways that internet and internet platforms
are now providing new opportunities for SMEs to be part of the
global economy.
Mr. Bilirakis. Thank you. I yield back, Mr. Chairman. I
appreciate it.
Mr. Burgess. The gentleman yields back. The chair thanks
the gentleman.
The chair recognizes the gentlelady from Indiana, Mrs.
Brooks, 5 minutes for questions.
Mrs. Brooks. Thank you, Mr. Chairman.
My home State of Indiana has a large contingent of
pharmaceutical and device companies who depend on the Safe
Harbor to transfer, and I believe we have talked about the
issues of big data and those companies that are using big data.
Companies like Eli Lilly use the cloud-based software for the
users, can share of medical images with other departments and
centers and countries around the world to improve the product
design, to allow for nearly instantaneous interpretation and
diagnosis of medical records, and compile records for clinical
studies.
And we certainly know that the utilization of cross-border
data enables all of our life sciences companies in the country
to use these data sets so we can get treatments and that we can
improve faster development of treatments and diagnoses and
better health care for not just those in the U.S. but for the
world. So I certainly recognize the anxiety everyone is having
at this point in time based on the ECJ decision.
But I am curious, what do you think we should be watching
in these next few months as this January 2016 deadline is
approaching? What should we be watching and what--there has
been dialogue about this with our government and with the E.U.
members for years now. I actually participated in one of those
discussions in late 2013 in Brussels with some other Members of
Congress, a bipartisan delegation, but yet, it does not seem as
if we have bridged the gap of either trust or of understanding.
And I am curious what you all believe we need to be doing a
better job of doing to either get to a Safe Harbor agreement
2.0.
And my second question is why do we believe that the court
will even agree or why do we believe it would even be upheld
and not challenged immediately again? And I guess I would like
to hear each of your comments. Ms. Espinel?
Ms. Espinel. So in the short-term, as you say, I think we
need to focus on concluding the Safe Harbor. The kind of
discussion that you were having with your European counterparts
I think is really important. I think having hearings like this
that focus on the issue is really important. I think if we are
going to be able to make progress both in terms of concluding
in the short term the negotiations and the longer-term
solution, we need to have a constructive political environment.
And part of the way that we get there is by having Congress in
contact not just with the Administration but also with your
European counterparts both to help them understand our privacy
system better and understand the improvements that have been
made in that privacy system. I think that is a really important
role that Congress can play both in the short term and over the
longer term.
Mrs. Brooks. So I attended with the chair of the House
Intelligence Committee, Chairman Rogers and the ranking member,
Ranking Member Ruppersberger, in this delegation meeting. Are
you familiar with other conversations? That was in 2013. And
are you familiar with other conversations that Members of
Congress have had or that--because it is clear to me that what
the negotiations and the discussions between the Administration
officials, it is not working.
Mr. Rotenberg. Right----
Mrs. Brooks. So where are we falling down?
Mr. Rotenberg. Let me begin by saying I actually think
Congressman Sensenbrenner deserves a lot of recognition----
Mrs. Brooks. Yes.
Mr. Rotenberg [continuing]. For the work that he has done
on this issue. I think it is one more demonstration of how
privacy really does cross the aisle. And I know he has
expressed concern about making changes to 702, and that is one
of the issues that we think does need to be addressed.
But I think it is also important in the context of this
hearing to understand that there is a difference between the
political negotiation that takes place between the U.S.
Commerce Department and the European Commission and a judicial
decision from the top court in Europe. I mean this really is a
game changer, and it impacts what even the European Commission
can do in its negotiation with the United States. So to your
question, I think it will be very interesting to see over the
next few months how this change in European Union law, which is
what has happened, will influence the privacy officials across
Europe. They may decide to take enforcement actions.
Mrs. Brooks. Mr. Murphy?
Mr. Murphy. I think one of the most important things that
Members of Congress can do is to educate their European
counterparts on the importance of these data flows. And coming
back to your example about medical devices, just yesterday, we
were hearing from one of our member companies that manufactures
medical devices, and some of these, such as different scanners,
CAT scanners, PET scanners, MRIs are very large, expensive,
sophisticated pieces of equipment. In some smaller E.U. member
states there may be only a very small handful of them around.
And they are often maintained and used remotely. That is
another example of the kind of data which needs to flow.
And talk about taking the whole to date to a very personal
level, that the ability to get this kind of medical
information, the idea that it could be impeded by a failure to
arrive at a new Safe Harbor agreement is something that I think
all of us find concerning.
Mrs. Brooks. Thank you. I yield back.
Mr. Burgess. The gentlelady yields back. The chair thanks
the gentlelady.
The chair would just ask, are there any other Members
seeking time for questions?
Seeing none, I do want to thank our witnesses for being
here today. Before we conclude, I would like to submit the
following documents for the record by unanimous consent: a
statement from the International Trade Administration at the
United States Department of Commerce, a letter from the Direct
Marketing Association, a statement from the Information
Technology and Innovation Foundation, a statement from the
American Action Forum, a joint letter from the Auto Alliance,
American Automotive Policy Council, and Global Automakers, and
a list of all of the 4,400 United States companies who are
active beneficiaries of the Safe Harbor agreement. \1\ I will
not read them unless asked.
---------------------------------------------------------------------------
\1\ The list has been retained in committee files and is also
available at http://docs.house.gov/meetings/if/if16/20151103/104148/
hhrg-114-if16-20151103-sd015.pdf.
---------------------------------------------------------------------------
[The information appears at the conclusion of the hearing.]
Mr. Burgess. Pursuant to committee rules, I remind members
they have 10 business days to submit additional questions for
the record. I ask the witnesses to submit their responses
within 10 business days of the receipt of those questions.
Without objection, the subcommittee stands adjourned.
[Whereupon, at 12:17 p.m., the subcommittees were
adjourned.]
[Material submitted for inclusion in the record follows:]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
[all]