Countries around the world are struggling to decide whether to adopt data protection law based on the proposed EU Data Protection Regulation or to use a U.S. approach to privacy protection. As I observed firsthand during a recent trip to Japan, the result is competition in global data protection policy making, with the European Commission on the one side and the U.S. government on the other side, both lobbying other countries to follow their respective models.

The sui generis nature of the U.S. system makes it difficult to sell abroad. For example, in a recent post on this blog, IAPP VP of Research and Education Omer Tene described its strengths as deriving from the growth of the privacy profession in conjunction with “self-regulatory initiatives; civil society engagement; academic programs with rich, multidisciplinary research agendas; formidable privacy practices in leading law and accounting firms; privacy seals; peaking interest by the national press; robust enforcement by federal and state regulators, and individual and class litigation.”

This sounds more like a description of U.S. society than a self-contained model of privacy regulation that other countries can implement.

Japan is an interesting example of a country that is currently working to reform its privacy laws and is not sure which approach to follow. In many ways, EU law is a natural model for Japan, given that the Japanese Civil Code is based largely on German law and that many countries outside the EU have already adopted legislation based on the EU Data Protection Directive.

Countries should resist becoming pawns in a power struggle between the EU and the U.S. They should see courtship by these two blocks not as requiring a black-or-white choice between them but as an opportunity to construct the best privacy regime based on their culture, interests and legal system.

At the same time, the Japanese are understandably concerned about basing their law on a proposal that might be substantially changed, or not adopted at all. They also worry that the regulation may hamper economic growth by restricting the potential of new phenomena such as Big Data. And the U.S. system holds certain attractions for Japan, such as the fact that the Japanese conception of constitutional rights is closer to U.S. law.

I found many of the people I met with in Tokyo to have a more detailed understanding of the regulation’s global implications than some European policymakers do. For example, the Japanese are rightly concerned about the negative implications of the regulation’s broad extraterritorial application to the Internet. In many ways, the EU policy-making debate has been parochial and inward-looking, with a fixation on issues involving the U.S. but little interest in the regulation’s implications for other parts of the world.

Other countries are losing patience with the interminable EU legislative process.

Moreover, the EU institutions seem not to realize that other countries are closely watching their lawmaking efforts, and the international influence of EU data protection law will be weakened if the final text is not attractive as a global model.

Countries should resist becoming pawns in a power struggle between the EU and the U.S. They should see courtship by these two blocks not as requiring a black-or-white choice between them but as an opportunity to construct the best privacy regime based on their culture, interests and legal system.

When considering how to deal with the EU regulation, other countries should concentrate on the general principles that it embodies, particularly those representing current best practices, rather than focusing on the minutiae of how particular provisions are drafted—the wording of which will inevitably change anyway. Examples of such principles include Privacy by Design, data breach notification requirements, data security obligations and increased accountability requirements for data controllers and processors. Such norms are likely to become widely accepted no matter the ultimate fate of the proposed regulation.

From the U.S., other countries can learn about the importance of basing regulation on a pragmatic determination of what actually works in practice, rather than an endless debate about normative principles. The strong position of the U.S. Federal Trade Commission also shows the importance of giving sufficient enforcement powers to privacy regulators.

Most importantly, the EU and the U.S. should realize that the most successful way to influence other countries would be to reform their current systems of data protection and privacy regulation so as to provide the best possible models to be emulated.

Both sides have much work to do in this regard.