Incoterms_® and Commercial Contracts

1 APPLICATION OF US PRIVACY LAWS

In contrast to the EU approach to data protection discussed below¹³¹, the United States does not have a comprehensive federal law regulating the use of and collection of data. The United States makes use of a combination of a federal and state laws, and regulations that overlap and can even conflict with each other. The United States also makes use of a series of guidelines developed by governmental agencies and industry groups that are not legally enforceable but are considered part of best practice and a self-regulatory framework.

There are of course many existing federal privacy related laws that regulate the collection and use of personal data. Some of the legislation concerns itself with categories of information, such as health¹³² and financial¹³³ information or electronic communications¹³⁴. Other laws affect particular activities that make use of the personal information, such as
[Page127:]
collection of information from minors¹³⁵, telemarketing¹³⁶, e-mail¹³⁷, employment records¹³⁸, privacy of government-held data and privacy from government data collection¹³⁹, and privacy of miscellaneous records and activities¹⁴⁰. The application of US privacy laws for agreements performed outside the United States depends upon the scope of each statute and whether they affect information that can be collected by Franchisors in the United States.

2 APPLICATION OF EUROPEAN UNION (“EU”) DATA PROTECTION LAWS

The EU approach and data protection rules are set out in the 1995 Data Protection Directive 95/46/EC (“the Directive”). These rules aim to protect the fundamental rights and freedoms of natural persons, and in particular the right to data protection, as well as the free flow of data. The Directive has been complemented by further legal instruments relating to the communications sector¹⁴¹ and the protection of personal data in police and judicial cooperation matters¹⁴². The right to the protection of personal data is also specifically recognized in the European Union’s Charter of Fundamental Rights of the European Union (Article 8) and the Lisbon Treaty.

The Directive’s governing principle is the protection of personal data. Its purpose is not the protection of privacy as such. The Directive’s primary objective was to harmonize existing regulations to safeguard the data subject’s right to informational privacy and to create a common European market for the free movement of personal data¹⁴³.

The implementation of the Directive is delegated to each individual Member State. This inevitably results in some variation as to its implementation as between Member States.

[Page128:]
In general, the EU data protection law follows three principles: transparency, legitimate purpose and proportionality¹⁴⁴. These principles are laid down in Article 6 of the EU directive:

Member States shall provide that personal data must be:

• processed fairly and lawfully;
• collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards;
• adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
• accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which is inaccurate or incomplete, having regard to the purposes for which it was collected or for which it is further processed, is erased or rectified; and
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which it is processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.

The criteria for lawful data are set out in Article 7 of the Directive¹⁴⁵. Personal data may be processed only if:

• the data subject has unambiguously given his consent; or
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or
• processing is necessary for compliance with a legal obligation to which the controller is subject; or
• processing is necessary to protect the vital interests of the data subject; or
• processing is necessary for the performance of a task carried out in t he public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject, which require protection under Article 1 (1).

The minimum security standards required by the Directive are set out in Article 17 which provides that “the data holder must implement appropriate technical and organization measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.”

[Page129:]

3 CROSS-BORDER DATA TRANSFER

a. European Union and third countries

Article 25 of the EU Directive addresses the transfer of personal data to countries that are not Member States, such as the United States. The EU Member State is required to provide that the transfer to a third country (a country not in the EU) of personal data that is undergoing processing or is intended to be processed after transfer may take place only if, having complied with the national provisions, the third country ensures an adequate level of protection.

Those countries currently listed as having sufficient levels of protection are: Andorra, Argentina, Australia, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey and Switzerland¹⁴⁶.

b. United States and the European Union

Companies operating between the United States and EU may engage in cross-border transfers of data between Europe and the United States in compliance with the EU Directive by having certification under the Safe Harbor program, using European Commission-approved model contracts, or for multinationals, implementing Binding Corporate Rules. The Safe Harbor program was created by the Commission and the US Department of Commerce to address the Commission’s view that the United States does not have in place a regulatory framework sufficient adequately to protect personal data being transferred from the European Economic Area. If an organization in the United States is subject to the jurisdiction of the FTC, or in the case of some transportation organizations subject to the jurisdiction of the US Department of Transportation, then it can participate in the Safe Harbor program. A list of the current participants to the Safe Harbor program may be found on the US Department of Commerce website¹⁴⁷.

The Safe Harbor program requires a voluntary adherence to a set of seven principles: notice, choice, transfers to third parties, access, security, data integrity, and enforcement. The Commission has recognized these principles as providing adequate protection and therefore meeting these principles will allow compliance with the Commission’s requirements. The organization is required to join a self-regulatory privacy program that adheres to the US-EU Safe Harbor Framework’s requirements, or develop its own self-regulatory privacy policy that conforms to the US-EU Safe Harbor Framework. The participating company is required to implement a privacy policy that complies with these principles and to renew its self-certification annually. The organization must in general provide: (1) notice of its privacy policy; (2) a choice to individuals in relation to the use of personal information; (3) access to the information; and (4) protection of the data.

Alternatively, standard contractual clauses (model contracts) can be used to regulate the transfer of personal data from the EU¹⁴⁸. The
[Page130:]
contractual clauses aim to establish adequate safeguards by imposing obligations similar to those set out in the Safe Harbor program, and incorporate the Directive’s principles. US multinationals also have the option to develop a set of binding corporate rules to regulate data protection and apply to all intra-group transfers of personal data outside of the EU¹⁴⁹. The binding corporate rules must be approved separately in each EU Member State where the multinational has an office, and the applicant must describe the data protection audit plan, the processing and flows of information, the data protection, safeguards, and mechanisms for reporting and recording changes. Moreover, the multinational company is required to demonstrate that these rules are binding both internally and externally.

c. Australia

On the contrary, the Australian Privacy Act 1998 permits organizations to choose one of several options set out in NPP 9 to make it acceptable to transfer personal information of individuals to overseas destinations. NPP 9 states that an organization in Australia or an external territory may transfer personal information about an individual to someone (other than the organization or the individual) who is in a foreign country only if:

• the organization reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that effectively upholds principles for fair handling of the information that are substantially similar to the NPPs;
• the individual consents to the transfer;
• the transfer is necessary for the performance of a contract between the individual and the organization, or for the implementation of pre-contractual measures taken in response to the individual’s request;
• the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the individual between the organization and a third party;
• all of the following apply:
• the transfer is for the benefit of the individual;
• it is impracticable to obtain the consent of the individual to that transfer; and
• if it were practicable to obtain such consent, the individual would be likely to give it; or
• the organization has taken reasonable steps to ensure that the information that it has transferred will not be held, used or disclosed by the recipient of the information inconsistently with the NPPs.

[Page131:]

d. Canada

Privacy legislation in Canada does not specifically prohibit the cross-border transfer or disclosure of personal information. However, special considerations and notice requirements apply¹⁵⁰.

As discussed above, whenever there is a transfer of information, service provider organizations continue to be held accountable for the protection of personal information. This is also true with respect to cross-border transfers of information. Additionally, under PIPEDA, organizations must notify individuals that their information may be processed or stored outside Canada, and that local courts, law enforcement and national security authorities of that jurisdiction may have access to the information¹⁵¹.

The province of Québec restricts the transfer of personal information outside the province in its private sector privacy legislation. An organization may not communicate personal information outside of Québec if the organization considers that the personal information may be used for purposes other than those for which it was collected or disclosed to third parties without consent¹⁵².

In the province of Alberta, if an organization outside of Canada collects, uses or discloses personal information, the organization’s policies and practices must include information (in writing) regarding (a) the countries outside Canada in which the collection, use, disclosure or storage is occurring or may occur; and (b) the purposes for which the service provider (which includes affiliates) outside Canada has been authorized to collect, use or disclose the personal information¹⁵³. Notice of an organization outside of Canada’s use, collection or storage of personal information must be given before or at the time the personal information is collected or transferred outside of Canada and a description of the way in which the individual may obtain access to written information about the organization’s policies and practices with respect to service providers outside Canada must also be provided. The individual must also be provided with the name or position of a person who is able to answer the individual’s questions about the collection, use, disclosure or storage of personal information by service providers outside Canada for or on behalf of the organization.

---

---