It is believed to be the first time that a US-based
multinational has been fined for unauthorised overseas transfers of
personal data.
La Commission Nationale de l'Informatique et des Libertes (CNIL)
has imposed the fine after discovering that Tyco's human resources
database was using personally identifiable information more
extensively than the company had admitted.
Tyco notified CNIL in 2004 that it was operating a human
resources database containing personal information, as required by
French law.
When at a later date CNIL requested further information from the
company, Tyco said that it had stopped using the database. An
inspection in 2006 by CNIL found that not only was the database
active, but that it was being used more extensively than the
company had indicated.
"The CNIL noted at an on-the-spot check that not only was the
use of the system not suspended, but that it was very regularly
used and updated, in spite of the many legal uncertainties raised
by the CNIL," said the CNIL in an unofficial translation of a
statement in French.
The CNIL said it has raised questions with Tyco about the
destination of data, the reasons for international transfer and the
safety and security of the data on the network.
The fine is evidence of the culture clash between US
corporations and European governments on the issue of data
protection. A fundamental principle of European data protection is
that personal information is only shared with countries with
equally stringent protections. The US is not classified as one of
those countries.
In recent months Europe and the US have clashed over data
transfers in airline systems and a banking system.
The Society for Worldwide Interbank Financial Telecommunication
(SWIFT) has been mired in controversy after it was discovered that
it had transferred thousands of financial transaction details to US
authorities.
SWIFT is based in Europe and co-ordinates international
payments. It has, since 2001, allowed US authorities access to the
international financial transactions of Europeans. The body has
been condemned by national and EU privacy chiefs, and the European
Parliament has now called on it to alter its business.
US authorities have also long had access to 34 pieces of
information about European travellers flying into the country under
a deal with the European Commission over passenger name records
(PNR). A new version of that deal, which is also opposed by the
European Parliament, is currently under negotiation ahead of a July
deadline.
