Adequacy versus equivalency: Financial data protection and the U.S.–EU divide

In 1995, the European Union passed Directive 95/46/EC, which set the legal framework for European Union citizens to own the rights to their personal data. However, American law bestows ownership to the holder of the data, not the individual, and officials feared the European Union initiative might disrupt data sharing among United States and European Union affiliates. Thus, they negotiated the 2000 Safe Harbor Agreement to allow companies to voluntarily submit to yearly certifications that fulfilled European Union demands, but kept U.S. businesses in control of their data; nevertheless, the Agreement does not include financial and banking services. Instead, the United States argued that the privacy protections within the Gramm-Leach-Bliley Act adequately fulfilled European Union guidelines. The European Union disagreed and financial data sharing has operated under a moratorium for the past decade. However, the 2008 financial crisis has governments and clients clamouring for more data transparency to determine risk in the financial system. These global efforts, the European Union's recent push to strengthen the Directive, and the Dodd-Frank Act have pushed data sharing to the policy forefront. This article asserts that transatlantic data sharing will ultimately have to accommodate the privacy cultures in both the United States and the European Union, but firms must be prepared to cope with demands on their data by establishing government relations offices, standardizing information systems, enhancing education for compliance officers, and improving business school curricula.