Ancient Worries and Modern Fears: Different Roots and Common Effects of U.S. and EU Privacy Regulation

Abstract

Much legal and technical scholarship discusses the differing views of the United States and European Union toward privacy concepts and regulation. A substantial amount of effort in recent years, in both research and policy, focuses on attempting to reconcile these viewpoints searching for a common framework with a common level of protection for citizens from both sides of Atlantic. Reconciliation, we argue, misunderstands the nature of the challenge facing effective cross-border data flows. No such reconciliation can occur without abdication of some sovereign authority of nations, that would require the adoption of an international agreement with typical tools of international law. In this Article, we explore an alternative means to achieve effective data interchange governance among the Western nations, arguing that the focus for addressing privacy issues created in cross-border data flows should instead be procedural, rather than substantive.

Beginning with the observation that both U.S. and EU cultures share a common fear of “chilling effects” infringing various rights to privacy, we link the differences in privacy fears to the comparative views of the role of the state. These differences are instructive in that while they limit the potential for substantive harmonization of privacy goals, they also create substantial opportunity for procedural harmonization.

Such procedural harmonization would afford many benefits, reducing transaction costs for multi-national organizations and increasing the probability that individuals can express (and rely upon implementation) of their privacy preferences. The result is a system we describe as Market-Supervised Regulatory Delegation, in which the substantive differences among nations can be respected and implemented in an international market for expressing privacy preferences which is not distorted by the overhead of competing compliance regimes.

Keywords: jurisdiction, privacy, chilling effects, surveillance, compliance, cross-jurisdictional privacy management, data protection reform, framework