anyway it was a great pleasure that I'm
here today to introduce our next session
so for many of you who've worked in
global organizations and had to look at
us and EU privacy issues often there
appears to be a lot of differences
between the two regimes but our next
session will be examining this in a bit
more detail and exploring the
commonalities and differences in the US
and EU approach how much conflict is
there really and we have an expert
keynote panelist for you this morning
first of all representing the u.s.
delighted to introduce Julie Brill who
is a commissioner for the federal trade
commission commissioner burrell has been
with the FTC since 2010 and has
extensive experience on privacy and
particularly on the consumer protection
side prior to her current law she was
with the Senior Deputy Attorney General
chief of consumer protection antitrust
the North Carolina Department of Justice
a lecturer at Columbia University School
of Law assistant attorney general for
consumer protection antitrust the state
of Vermont for over 20 years numerous
awards for protecting consumers written
numerous articles and served on the
number of expert panels so eminently
experienced to represent the u.s. today
our second speaker representing the EU
delighted to present isabelle Felka
perrita with the chairwoman of the canal
and article 29 working party Madame
Falco Parata has been a member of kimmel
since 2004 came chair in 2011 re-elected
2014 and was elected the chair of the
article 29 working party dobri of this
year again has numerous experience in
privacy technology expert advisors for
the OECD chair the advisory board and
general delegate of the French internet
right forum so again eminently suitable
to represent the EU in our
debate this morning and finally our
referee or should I say moderator for
this I'm sure very candid debate is Yeti
Telamon who is a partner at Covington
and Burling LLP in Brussels yet his
co-chair of the firm's privacy practice
and she's been selected to join the
European Commission or the expert team
on privacy she advises all aspects of EU
DP and security regular speaker on
privacy and she has law degrees from
both Belgium and the US so linking our
two speakers so once again I'd like to
welcome our keynote panel what I'm
assured is going to be a candid and
interesting debate on the commonalities
and differences between the US and EU
welcome our panelists thank you
thank you sooo good morning everybody
this is a well packed room I even see
some people sitting on the steps there
so we hope this will be a good panel and
that is worth while sitting on those
steps commonalities and differences
between the u.s. and the EU approach to
data protection what are we are we just
in the US and the EU are we just very
far cousins who see each other once or
twice a year or are we brothers and
sisters but we haven't quite realized it
yet well the purpose of this panel is to
find the question the answer to that
question but we're not going to find the
answer for you you're going to have to
find the answer yourself and those two
distinguished ladies sitting here with
me on the on the stage here they're
going to help you find the answers
Commissioner brill the FTC madam file
capital of the hill and the chairwoman
of the article 29 working party I can't
think of two more distinguished and more
appropriate people to be sitting here
and to help you answer that question and
the way we we thought we would be doing
this is we would take a number of topics
topics that are very much alive on both
sides of the ocean and see how they're
being dealt with on both sides of the
ocean and see whether there are miles
apart the east and the Western into
shall never meet or whether they're
actually a lot closer than we all think
right now we have only 40 minutes and
some of them are already gone so let's
dive straight into it first topic that
we would use as an example is big data
very much alive on both sides of the
ocean and if I can start with You
Commissioner brill there's been a lot of
activity in the United States on big
data recently you have the White House
who recently released the report you
have the FTC who organized a very
interesting workshop and my question to
you is can you give us a flavor of what
went on there what the latest thinking
is and I would be especially interested
and I imagine the audience would be
especially interested
to see whether we're moving away in the
United States from the traditional
notice and consent form whether we go to
a control of views that's being made of
data rather than a control at the point
of collection is there some is there
some movement that where is this heading
so Thank You Yeti and let me just say
thank you so much to the eye appt us to
come speak the eye appt important
organization and I think that what they
do what's evidenced here is they bring
together people who really care about
privacy we may not always agree on you
know what it is that regulators are
doing but the conversation is so deeply
important and so thank you to Trevor
thank you to Omer thank you to Mindy and
everyone else at the ia PP who does such
a fabulous job organizing these
conferences ok big data well actually
let me give a cheat sheet answer to your
big question in the question that's soo
posed cheat sheet answer you know I
actually think that our commonalities
are much much greater than our
differences I do think there are
differences because we have different
systems and different laws but I think
there's a tremendous amount that is
shared between the United States and
Europe so diving into those issues on
big data so the White House began its
effort almost a year ago but it came out
of the Snowden revelations and the
president announced that he wanted to
re-examine the ways in which information
was being used not only on the
government side but also on the
commercial side and began a big data a
series of workshops and came out with a
report independently because we are an
independent agency the FTC began looking
at big data issues and that grew out
separately not so much out of the
Snowden revelations but out of our 2012
privacy report where we did a big
rethink about the way in which privacy
ought to be thought of in the United
States and it also grew out of a data
broker workshop of data broker workshop
and report that we did I OT
um Internet of Things workshop we've
been doing a lot of thinking and having
a lot of workshops and doing a lot of
reports around big data issues so some
of the things that we have been thinking
about big data does have huge potential
benefits for society you know and this
is reflected in the White House report
but also in our data broker report
whether it's health care whether it's
transportation whether its use of
resources energy resources or education
there are huge potential benefits but we
also see some risks with respect to Big
Data data security we just heard from
Miko a tremendous amount about data data
security Internet of Things and big data
also present data security issues when
we have a collect at all now and maybe
think about potential uses later to me
first and foremost that raises data
security issues collection of health and
other sensitive information or the
creation of health or other sensitive
information these are also of concerns
and we need to be thinking about what
are the appropriate mechanisms for
informing consumers and being
transparent around collection and
creation of health information and one
of the things that we are beginning to
speak about in the United States and one
of the things that our workshop on Big
Data whether it's a tool for inclusion
or exclusion one of the things we're
thinking about is the potential for
discriminatory and unfair use of big
data so the challenges are real I mean
when it comes to big data the challenges
around transparency and choice
mechanisms and providing appropriate
knows notice to consumers it is a
challenge I mean especially in the
internet of things where you have
devices that may not have a user
interface but this doesn't mean that
notice and choice goes away from my
perspective and I think from the
perspective of the Commission as a whole
we need to be thinking about how notice
choice transparency ought to be um I cut
it ought to come to fruition in the
world of big data and in the world of
internet of things not whether they
apply but
how they apply so trans and the other
thing I would say is transparency is an
incredibly important issue with respect
to consumer trust to the extent that we
really do want a big data world in to
the extent that we really do want to see
these potential benefits come to
fruition we need to ensure the consumers
trust the system and the way that that's
going to happen is by transparency and a
providing appropriate notice and choice
in in the right circumstances so the
analogy that I like to use is an
automobile analogy we need to give tools
to consumers on the dashboard we need to
give them notice and choice when
appropriate we talk about the context of
the transaction if we're within a
context of the transaction maybe notice
and choice needs can be a little bit
lesser because it's part of the overall
transaction but when you're talking
about collection and use that's
completely outside of the context of the
transaction that's when we talk about
needing to provide more notice in
information and transparency to
consumers um so I think about this in
the automobile term terms providing
information on a dashboard when
appropriate but also companies need to
be looking under the hood that is
engaging in privacy by design really
examining what they're doing as well as
providing information to consumers on
the dashboard one of the things that
people are talking about a lot in the
United States and I think here are use
frameworks risk-based frameworks when it
comes to big data very important
discussion I think there is a very
important role for youth based
frameworks and risk-based frameworks but
it can't be the end of the conversation
it's part of what of an overall approach
to privacy in this new world but I don't
think that it can be the end of the
conversation again security issues come
into play and also when you talk about
what's inappropriate use I think that
you need to bring the public into that
conversation in other words if it's just
the company's deciding what
inappropriate uses or what risk is I
don't know that the choices will
necessarily always be the best sunshine
is a very important element
so I think that one of the big questions
is who is going to decide what an
appropriate uses who's going to decide
what appropriate risk is in those kinds
of frameworks again being a part of an
overall framework there again I think
the public really needs to be a part of
it and very very briefly an important
role for anonymization the
identification we talked in the at the
FTC about using the root most robust
tools possible for technical d
identification but we all know that it
won't be a silver bullet there will
always be the potential for re
identification so we want a couple d
identification and anonymous ation with
social contracts that is the company
that says we're going to de-identify
we're going to anonymize will also make
a promise that it won't re identify the
data and anyone that it provides the
information to they will ensure that
that company does not seek to
re-identify the data and in that
circumstance again the amount of
consumer trust that will be engendered
by any Big Data project from information
that is d identified in that way I think
will be enormous so those are the kinds
of things that we're thinking about in
order to bring to fruition the benefits
of big data and yet have appropriate
tools in place to protect privacy and
security madam poca beulah does this
sound like this comes from another
planet or does it sound very familiar to
you well it doesn't come from another
planet and I'm glad to be here today to
have I don't know if it's a candid
conversation or pragmatic conversation
that's I'm happy to be here and share
ideas today um a few reactions towards
what Judy just said um first I think we
share the idea in Europe and at the
Working Party 29 levels specifically we
share the idea that big data is just not
only a new way to process that
this is a real i would say historical
breakthrough in other words it's a new
step in the digital age and i would call
it a stay a step in which the data
becomes a little bit ambient you see the
data is everywhere carried by any types
of device the telephone the sensors the
body sensors the electrical sensors the
CCTV everything is big data so I think
we share the conviction with the Podesta
report that we are facing something that
is really different second thing I think
we're sharing is that it brings a huge
amount of benefit and Julie mentioned
some of these new services brought
through big data so there is no
difference between us Third Point of
course we share also the concerns if not
the risks but the concerns
discrimination obviously another concern
maybe is about the role of the algorithm
because big data is based on algorithm
how does it work these algorithm are
they transparent do they know what's
behind what logics are behind the tree
the algorithm this is probably one of
the subject but generally speaking what
we fear about big data is that the
person the individual won't be in
control of this big data so in the
statement the Working Party 29 issued we
said the individual they have to stay in
control they have to be able to make
information toys towards big data
applications so does it mean we have to
review our principles that was your
question to what we have as an
experience
in Europe the answer from the g20 9
would be from the Working Party 29 is no
no because we don't have proof evidence
that our principles are no longer valid
on the contrary in each of our countries
we are already working on big data
applications using our principles so
they are definitely efficient and I
would say that on the contrary if we
were to change our principal and there
are ideas around this direction for
instance and Julie mentioned it the
risk-based approach we would be maybe a
little bit afraid because we believe
that the risk-based approach is a very
interesting approach to measure the
allocation of resources of DPA of data
controllers to proportionate
accountability obligations all of that
can be linked to the risk-based
approached but the rights of the data
subjects how can they be linked to the
risk-based approach and specifically if
the risk is assessed by the data
controller you have the right or you
don't have the right it's not related to
the risk so as a conclusion to you
question we believe that big data is a
dramatic new step for the digital age
that it doesn't pushes every all of us
to review our principles of course we
have to develop innovative thinking for
anonymization for market marketing
efforts for transparencies of course we
have to work on that but the principles
of our EU legal framework are still
valid we believe it thank you I hope
you're keeping score
common different I'm keeping my scores
right second one bridge incidents
unfortunately most of you in the room
during your professional life you're
gonna have one you're gonna have a
breach incident and you're gonna have to
go to your regulator now madam Alka p
about that in Europe contrary to the
United States we don't have a uniform
breach role you we have some Member
States very few actually who have a
breach notification law but of but
obviously we all know that in the draft
regulation it's very much in there and
it's very brought a very low threshold
very short period to to come to the
regulator and I would be interested I
would be interested in two things
actually one is it strikes me that this
is an area where the United States is
actually far ahead of Europe you have
had bridge laws for decades so is Europe
looking to the States sort of saying
those are mistakes that were made over
there we're not gonna make the same
mistakes will make our own mistakes but
not at least not those and I'm losing my
papers here that's my first question are
we looking at at the states here in
Europe and second is how are the dpa is
preparing for this this is going to be
an avalanche of notifications very
complicated could be cyber security
could be malware could be simple human
error could be forensics is the main
power within dps to do this is their
knowledge technical knowledge within dps
I'd be interested in your views yeah
this is a also a very key question
because for instance at the clean level
in most of our investigation we noticed
that there is a data security issue and
that there is I would say a sort of lack
of security culture within the data
controllers so of course we're very much
interested by the American example that
is a little bit ahead and compared to us
in the means to cope these data security
issue it's not entirely true
she said we have the uniform legislation
that was passed in 2009 and that has
started to be implemented in the
European countries in France for
instance it's in 2011 that we have
introduced the data notification in our
low so it's probably a bit too early to
have I would say in general conclusion
on the efficiency of this notification
within Europe but what we could say is
that from the at least the French
example and some others in interesting
comments first we haven't been floated
by notification and it's not exactly
what we expected second and generally
the notification a bit late compared to
the obligation of the law third these
notification they help the data
controller and I'm sure Julie will agree
to structure the internal internal
procedure for the security issue so
pedagogically it's very helpful for the
data controller but it's true that this
legislation yet is not really well
understood by the Europe and data
controller and in France for instance
we've had to make meeting with them to
re-explain the legislation in order for
them to understand it so for the g20 9
we have issued recently an advice and
opinion giving to the data controllers
some examples of good practices good
practice for instance to be examined for
notification to the data subjects so
there is a huge debate and reflection
about this legislation I think it's a
good legislation and I would say it's
not a good legislation which aims at
pointing out the data controllers that
has committed a mistake for us the main
interest of this legislation is to
structure the information flows and the
security culture within the data
controllers and to help I would say the
maturity of the issue to raise and it
takes time it was not in our habits but
I'm sure by the end it's going to be
very efficient Commissioner Burrell does
this sound familiar to you or you say oh
no we do it completely differently it
will um we we do it in a way that many
people in the United States don't
understand even but but actually the
principle behind it is precisely as
Isabel articulated which is that the
idea behind breach notification it is to
inform consumers so especially if it
involves their credit card or whatever
that they can take steps to try to
protect themselves against identity
theft however another very important
principle behind the breach notification
laws is to instill a culture of data
security and to basically tie the
company's reputation to data security
and this has been going on now for over
ten years in the united states
california was the first state to adopt
a breach notification law and the reason
i said it was complicated how it's done
is the breach notification laws are
actually at the state level there are 47
states that now have a breach
notification law so essentially it is
more or less universal in the united
states but at the state level with
respect to the underlying data security
that is what was happening with respect
to the breach and whether or not a
company had engaged in as we term it at
the Federal Trade Commission
unreasonable security practices that is
something that we examine at the federal
level at the FTC but it is the principle
behind it is precisely as Isabel
articulated
is to tie the company's reputation to
data security how are we doing in the
United States we still have a ways to go
as well in terms of instilling a
security culture I can't say whether
we're ahead or behind European companies
but i do think for instance most of the
people in this audience get it they
completely get it where we're working to
reach are the the long tail of say for
instance the app community or the long
tail of other service providers that is
entities that may not be able to send
representatives to a conference like
this or may not be represented by
attorneys who can come to a conference
like this but you know the traditional
sort of two guys are two gals in a
garage we've got to instill in them the
same security culture because size of a
company does not correlate to
sensitivity and importance of the data
so it's very important for from our
perspective to try to instill the
security culture everywhere but I
thought it might be interesting for
folks to hear a little bit too you know
about how we do it at the FTC so there's
breach notification and then there's
examining the underlying security the
Federal Trade Commission looks at that
through our FTC act we have brought to
date over like 40 50 cases if you suffer
a breach it doesn't necessarily mean
that we're going to bring an enforcement
action and conversely even if you don't
suffer a breach we still might bring an
enforcement action if we find that you
did not have reasonable security
practices that could lead to a clear
vulnerability and the clear potential
for a data security problem so you'll
see cases that fall into both categories
will we have federal legislation you
know again on the civilian normal
question the Federal Trade Commission
which is a bipartisan independent
commission has unanimously called for
federal legislation I as one of the five
members of the Commission do believe
there should
be a strong federal legislation and if
there's strong legislation for breach
notification then I'd be okay with
preemption but I don't think there
should be preemption of all the state
laws unless the breach notification
portion of this law is strong that is
robust notification to consumers on the
issue of data security as opposed to the
breach notification I think they're the
argument for preemption is more
significant and and ought to be paid
more attention to I don't see how
companies could have different security
systems one for California one for North
Carolina 14 months it I just don't know
how that works so again I think that the
law should be a strong one and I'm very
hopeful that it will pass because I do
look we're doing a good job at the FTC
on data security but we could use a few
more tools in our toolbox in order to
improve and further instill the culture
that Isabelle was talking about whether
it's through rulemaking Authority or
civil civil money penalty authority or
additional tools i think that that would
be helpful in this area thank you let's
make this a little bit more difficult
for our ladies here I've been thinking
loud and heart and find something that I
think is typical European and I think I
found it the right to be forgotten so
let's not forget the right to be
forgotten manifold could be others then
where are we on the right to be
forgotten so you can have your drink
first if you want better for my voice
sorry um where are we exactly hmm good
start um we have a decision of the
European Court of Justice there is a
very crucial decision and I think this
decision it's not only dedicated and
directed to Europe it's a decision that
is addressed I would say not to the
entire world but at least to the privacy
community as a whole
and it says first and this is very
important that privacy is a fundamental
right and I think it's important that
the highest judiciary level in Europe
has said repeatedly and again privacy is
a fundamental right second technically
the decision is not so new because I
mean the right to erase the right to
oppose we knew this right in the
directive and the editors the bloggers I
mean it was already applied by the DPA
within Europe what is new is that the
search engine are now considered by the
court and so by the regulators as data
controllers so they have to apply these
rights having said that it's true that
the decision of the court has risen
enormous social expectations within
Europe and you probably have the figures
from google but it's more than 100,000
demands towards Google to delist content
what does it mean to us privacy
community it means that people they
won't somehow to control their digital
life and it's a new way that is offered
to them complimentary to go directly to
the editor primary editor of website for
instance to control this digital life so
it's we have to listen to that so what
the g29 has done since then of course
what we want is to have a kind of
harmonized application of this decision
within Europe why do we want that not to
exist but because we want the data
subjects wherever they are in Europe
to benefit from the same protection so
we constituted very quickly after the
decision of the court a working group in
order first to cope with the first
complaints we had and they had been
complaints all over Europe from the disc
on the decision the first decision of
Google because we know that roughly half
of the demands have been accepted and so
they listed by Google and so the
decision of Google are under the control
of the regulators the Privacy Protection
Authority or the judge so in all of
European countries we have had we have
received complaints so we have
constituted this working group to
coordinate ourselves to deal to assess
the complaints we have elaborated a kind
of dashboard in order to segment and to
to map the different complaints we were
receiving and what we are trying to do
now is from these ingredients practical
ingredients to be able and I hope next
week we will be able to do it to issue
guidelines common guidelines which means
first common criteria throughout Europe
on what criteria do we decide that
Google has made the right or the wrong
decision is it a public figure is it a
minor is it an accurate information I
mean we can figure out what kind of
criteria criteria could be on the list
it's already the practice of the DPA
it's also probably related to the
decision of the courts so common
criteria and second document that we try
to elaborate is a document that would be
that would explain how this right will
be de-listed is going to work which data
subjects
benefit from this right for instance
Chinese in Hong Kong is allowed to ask
for the listing and what is the what
will be the territorial effect of the
delisting decision is it only limited to
Europe is it a worldwide decision
depending on how the treatment is
organized you see they are a lot of
different technical aspects that we have
to deal with and the idea is to have at
the European level the common approach
and I think it's a very important
because again we believe that it's not a
technical subject for technicians it's a
subject for the life of every day every
everyday life of everyone so we
definitely as DPA need to bring a simple
understandable and come an answer within
Europe so next week we're going to have
our plenary session at the Working Party
29 and I hope we'll be able to provide
you with these common guidelines are
looking forward to them commissionable
are you gonna prove me wrong that this
is a typical European thing is there
such a thing in the United States well
uh needless to say as everybody knows
the ECJ decision was quite controversial
in the United States there were a lot of
First Amendment advocates who read this
as a slap in the face to the First
Amendment generally I don't want to take
a lot of time because this is a very
subtle and complicated issue with
respect to the United States in my view
I did give a speech about this in Vienna
a couple of months ago so the short
answer is I think that there are
elements in US law and in u.s. tradition
as well as in what the ft
she has called for to be implemented in
the united states that reflect a right
of deletion and or the the concerns
around a right of deletion or right of
erasure i don't think we would use the
terminology right to be forgotten I
worry that that's actually somewhat of a
misnomer or potentially misleading
because I don't think it really is a
right to be forgotten it but I think
Isabel mentioned you know these concepts
of right of deletion and right of
erasure have been around for a while in
the United States it's more targeted you
know it exists in the Fair Credit
Reporting Act consumers have the right
to have information removed from their
credit report if it's old or if it's
inaccurate and they have the right to
review their credit reports for accuracy
we have called for people search firms
that is entities that perform a similar
function to what was going on in the ECJ
decision the underlying facts similar
but not identical we've called for those
firms to give consumers the ability to
opt out or to erase their information so
there are elements of this that either
exists in US law now or that exists in
our thinking oh and the the face our
facebook consent order requires this
that social network to provide a right
of deletion for consumers in certain
circumstances so we do have these
concepts one of the things that I have
called for in my speech and and
elsewhere is clearly Europe is working
through these issues I mean is Isabel
just said and they are complicated
issues you know the ECJ just like the
Supreme Court decisions under the Fourth
Amendment they've got a set of facts in
front of them and they render a decision
how those set of facts now play out in
other circumstances is something that
needs to be determined over time I do
think one of the big questions will be
the territorial reach and I think that
there are some serious things to think
about in terms of whether the European
decision should have worldwide effect or
not I think that could raise some
potential concerns real real concerns
the United States but in the meantime I
think we need to play out we need to see
how this plays out just as we would any
Supreme Court decision under the Fourth
Amendment I was afraid the Commission
was gonna prove me wrong and she didn't
disappoint me she did prove me wrong sir
well not entirely not entirely um we
have exactly four and a half minutes
left to tackle an enormous subject
called to international data transfers
it's so I'll start to speak very very
fast it's it's the subject where I think
in a most visible way there is an honest
attempt by various countries various
continents to try to come to global
solutions vcrs CVP ours the apac regime
the referential magnificent step forward
if you ask me a matter fact is where are
we on this no I think I agree it's a
magnificent step two great two different
legal systems in a very operational way
and so the idea is to now once we have
elaborated the referential is to test if
it works so a working group has been
created and we have champions three
companies that have accepted to test the
referential two of them are already bc
your compliance and one is not to our
CBP are compliant and one is bc are
compliant and they are going to commit
to the other certification so we're
going to see how it works we're going to
have case studies i guess and we will
see what we can do beyond and what we
can do beyond is to provide the
companies with a comment certification
and how do you how do you call that
leaflet or you with practical tools it's
a bit probably too early now to see if
it's possible really to from the referee
referential to provide the international
companies with practical tools but it's
exactly what we are aiming at doing with
our champions were three champions
wonderful this will be of great interest
to the company's Commissioner Brill the
safe harbor I couldn't close this
without mentioning a safe harbor are we
on the same line or is this the east in
the West End additional never meet to me
you have the last word on this I am
deeply hopeful that we will come to an
appropriate conclusion to the safe
harbor discussions look I understand
that in Europe the safe harbor has been
of deep concern since the Snowden
revelations and since many people are
thinking about not only how government
is using data but also the role of
commercial entities in terms of the
transfer of data and I have said very
clearly in here in Brussels and
elsewhere that I think safe harbor is a
deeply important tool for consumer
protection and privacy it is the hook
that people like me and other folks who
are focused on protecting US citizens
privacy as well as Europeans privacy it
is the hook that we have to to offer
greater protection so I have said please
don't take it away from me as a law
enforcement official I do not want any
tools taken away now having said that
safe harbor is 15 years old and like any
tool it can be re-examined and
inappropriate ways improved and so we
have been working with our colleagues at
the Commerce Department which is the
entity that administers the program we
are the backstop enforcement entity but
the Commerce Department administers it
the Commerce Department is leading the
discussions with a DG justice
to others in the Commission over how
safe harbor can be improved and we've
been working very closely with everyone
to give our views in terms of how safe
harbor can be improved look the
alternative dispute resolution fees i
think is something that clearly needs to
be addressed increased transparency
around who's in safe harbor who's out of
safe harbor who's it clearly can be
improved increased accountability on the
part of ensuring that those who are part
of safe harbor are complying with its
principles absolutely can be improved
but please don't take it away because I
will and my agency will enforce it and I
think we've put our money where our
mouth is just this week we announced a
very important settlement involving an
entity trustee that is it did not
involve it's safe harbor compliance but
rather trustee is a very important part
of the entire self regulatory program
with a bit concerned safe harbor trustee
also has an incredibly important role
with respect to children's privacy they
also provide a seal and safe harbor
program with respect to kapa children's
online privacy protection act so we just
announced a settlement involving trustee
because we found that in a minority of
large minority of cases that is a small
I should say a small minority of cases
they were not actually appropriately
recertifying the company the entities
that's what we alleged there was a
settlement we now have trustee under a
20-year order that's going to require
additional reporting requirements if
that order is violated their rule and we
and we prove a violation there could be
very significant penalties that that
will inure to or in your against trustee
but it isn't just the trustee case we
have brought now about 25 cases
involving safe harbor violations
including elements of the Google and
Facebook settlement so now any
case that we examine in the United
States with respect to privacy or data
security we look at whether or not there
is a potential safe harbor violation so
it's something that we at the FTC FTC
take tremendously seriously what is the
trustee settlement mean I really hope
that everyone here and everyone in
Europe will take away the message not
that safe harbor is broken therefore we
had to bring the trustee case but rather
that safe harbor works and backstop
enforcement by the FTC works because
what we will do look it doesn't happen
immediately there are all sorts of due
process rights in our justice system in
the United States so sometimes these
cases are slower than people would like
but we will take these cases seriously
and in appropriate circumstances we will
bring an enforcement action even against
entities whether it's Facebook or Google
or whether it's in a key player like
trustee we will in appropriate
circumstances bring enforcement actions
and I think that shows that the system
works thank you very much ladies you
were wonderful
one post applause remark I just wanted
to see a few comments on the safe harbor
because you imagine of course you I get
rebuttal time the last question was the
most delicate firm now we don't only
want improvement of the safe harbor we
want clear answers to the situation that
has been created by the Snowden
revelation so the Commission has made 13
proposition on these Thirteen's
proposition and specifically the 13th
one the DPA the European authorities
they are expecting real answers so it's
not a technical issue you know that has
to be improved year by year it's there
has been a kind of confident crisis
within Europe after the Snowden
revelation the safe harbor is one of the
most important compliance to between the
two continents so we need now to adopt
these tools who the new situation so we
will be very vigilant on the output and
so I get a tiny rebuttal but I there
were the Commission for forward 13
demands requests suggestions 11 of them
dealt with were in in my sphere and in
within the sphere of the Commerce
Department dealt with safe harbor as a
sort of an administrative tool and in
the enforcement tool and I was you know
we are deeply involved in in those 11
Isabelle's absolutely right there are
two recommendations that are outside of
my Riemann and frankly I think actually
outside of your remit and frankly
outside of DG justices remit rip as it
you know it in a box but I understand
there's deep concern about these issues
I think that there has been a tremendous
effort on the part of
the national security folks in the
United States to figure out how to
appropriately respond but it's not what
I do um but I do think that what you see
in the United States through breathing
great life into the pee Club the privacy
and civil liberties oversight board
through the chief privacy officers that
we have throughout the national security
system and through all sorts of
mechanisms that we are starting to
reexamine whether it's the FISA Court
and various bills that are being
examined and whatnot I think there is a
deep discussion in the United States not
only about how to deal with Europeans
concerns but frankly how to deal with
concerns of US citizens this is a
discussion that's deeply important and
will continue so I understand what
Isabelle saying I understand the linkage
that has been made but that is a
conversation that I can watch but I I'm
not competent to engage and I think the
competent folks the security folks need
to be a deep part of that conversation
thank you very much