Our previous post began to explore findings from almost one hundred interviews of leading corporate privacy officers, regulators and other privacy professionals in five countries—and what they can teach us about how the structure of the corporate privacy function can affect the success of measures to protect privacy.

We ended that post with a surprising finding: The two countries in which privacy officers were most empowered, and most involved in shaping firm strategy, couldn’t be more different in terms of their regulatory substance and form—Germany and the U.S.

This is especially startling, because in global debates the German legal commitment to privacy protection is frequently held up as representing one end of the spectrum (strongest), while the U.S. approach is placed at the other.

It is also remarkable, given that the definitions of privacy we found at work within corporations in each country are similarly distinct. In the U.S., CPOs reported an amorphous and evolving definition of privacy, infused by the consumer protection-oriented objectives of key regulators (the Federal Trade Commission and state Attorneys General) in a manner that makes achieving privacy obligations a more forward looking, externally oriented and dynamic task.

In Germany, by contrast, corporate DPOs describe privacy efforts centered around compliance with data protection law—as do their colleagues in Spain and France.

Why then, are German corporate privacy practices largely different from those in other European jurisdictions? And why are they most similar to those in the U.S., where approaches to privacy are decidedly different?

While our research indicates that a large number of elements combine to shape the privacy landscape in a country, a few elements of the German scene stand out in explaining some of the similarities:

• In Germany we found that data protection within the firm is solidly and specifically influenced by other ethical frameworks that—like consumer protection in the U.S. context—require DPOs to be more actively engaged in sorting out privacy’s meaning as it is shaped by a negotiation with a variety of players in the privacy “field.”
• As an initial matter, our interviewees described, privacy in Germany is conceived within a broader ethical framework of human dignity derived from the atrocities of World War II, and therefore engages a number of social and political players beyond the privacy profession in shaping its meaning.
• Secondly, information privacy is considered a strong element of commitments to protect and respect employees—commitments protected elsewhere in German law, which mandates the existence of a powerful workers council within each firm, exercising representation on the corporate board.
• These additional institutional structures, committed to engagement with negotiations about the meaning of privacy, and empowered to ensure corporate accountability, support the work of DPOs within the firm and provide a richer language that DPOs can leverage to engage firm leadership, garner resources for privacy and move beyond a purely compliance focus.

It is important to note that despite a longstanding statutory requirement for firms to employ DPOs—with protections guaranteeing independence and management access similar in many respects to the requirements set out in the EU Draft Regulation—the German DPOs who we interviewed indicated that the DPO role has only achieved its full and robust form in recent years.

Thus our interviews suggest that statutory command—while sufficient to establish a data protection office within firms—did not, on its own, deliver the robust DPO equipped with the power, authority and resources to push privacy aggressively into firm activities.

According to our interviewees it took: (1) risks to firm reputation flowing from the increased possibility of negative publicity wrought by higher fines and penalties meted out by regulators, (2) the adoption of data breach laws in a growing number of countries and (3) the fact that these two developments empowering existing institutional players like consumer groups, workers councils and the legally-mandated DPO to fully realize the lead privacy officer roles they now occupy.

This suggests that ensuring DPO power and authority to influence privacy within the firm requires more than a statutory mandate. It also needs a focus on keeping privacy matters in the public spotlight and supporting constituencies—be they consumer and privacy organizations or labor representatives—that use information about firm practices and missteps to focus the attention of the public, regulators and firms fueling a constant improvement in policy and practice.