Translation of Letter from Dutch Data Protection Authority to eBay regarding Data Transfers to the US 

Original (in Dutch) here available


iBazar, a company operating auction websites in different EU countries, has been taken over by the US company eBay. To ensure the transfer of iBazar consumers to the eBay-system as smoothly as possible, eBay wants to transfer the customer data from iBazar Netherlands to the United States. eBay proposes that the transfer be made unless the customer opposes it ('opt-out'), but that the data can only be used in the US once the customer gives his permission ('opt-in').

Position of the Data Protection Authority

Directive 95/46/EG requires an adequate level of protection for the transfer of personal data. Since there is no data protection legislation in the US, the EU and US have reached the 'safe harbor' agreement, which eBay does not propose to join. The performance or termination of an agreement gives no legal ground to the transfer the data, and the consent of the data subject is required. Opt-out consent is not sufficient, as consent requires a voluntary act of will. Thus, at the moment there is no legal basis for the transfer. A legal basis can be provided by consent of the customer, e.g., by the same procedure as the one eBay used for the transfer of customer data from iBazar France. Meanwhile, eBay has promised to follow the recommendation of the Data Protection Authority.
July 20, 2001, z2001-0784