‘Of Mice and Men’ by john Steinbeck and ‘The Withered Arm’ by Thomas Hardy Essay

Points of comparison between ‘Of Mice and Men’ by john Steinbeck and ‘The Withered Arm’ by Thomas Hardy. Include social and historical context, setting, plot, characters, theme and language. ‘The Withered Arm’ written by Thomas Hardy and ‘Of Mice and Men’ written by John Steinbeck have many differences in their social and historical background but similarities can be seen between the two. Of Mice and Men’ is set in Soledad, California during America’s great depression in the 1930’s. Transport was very different then, most people travelled around on foot or by horseback. There were busses but very few of them and if you were a couple of ‘bindle stiffs’ like George and Lennie you never got a full ride or taken to where you wanted to go. A train were available but for people like George and Lennie hiding in boxcars and riding for free was more common. As it was during the great depression many business es went bankrupt and many people lost their jobs. This was the reason that many people, including George and Lennie, travelled around so much looking for work. Work was mostly found on farms and ranches but pay was very little. Wages were $50 per month with food and accommodation included. However the accommodation was very basic, they were communal bunkhouses so George and Lennie and anyone else had little privacy. Jobs on the ranch weren’t that glamorous either, ‘barley bucking’ was the most common then there were skinners, stable bucks and swappers. There were few employment rights and no job security because as soon as a job was finished workers were just dropped and had to move on to find other jobs in other places. Even through all the work there was plenty of entertainment. Betting and gambling were very popular, any chance they had to play a game of horse shoes or a game of cards they would more than likely always have a bet on each game. When they had enough money they would go into the local town for a couple of drinks in ‘cat houses’. Punishment for any crime committed was severe, but there was no real law. It was normal for just anyone to take the law in to their own hands, as shown in the story when Lennie killed Curley’s wife and Curley went out to shoot Lennie and it wouldn’t matter, † ‘ I’m gonna get him. I’m going for my shotgun. I’ll kill the big son-of-a-bitch myself’ † ‘The Withered Arm’ is set in holmstoke in Wessex in the mid 1800’s. Holmstoke is a very isolated little village and is only joined to Anglebury, a near town, by a cart track. Transport back then was even more primitive than in ‘Of Mice and Men’. People mostly travelled by foot and by horse and cart along dirt tracks, as there were no proper roads. Pretty much everyone was labouring class as the only jobs really available were on farms an d land. Dairy and animal farming was very popular. The farms were owned by wealthier farmers that employed the local people to do the farming and dairy work. The wages were 37p per week, which just like in ‘Of Mice and Men’ is very little. The women did the milking in the dairies and cider making and the men did the harvesting, just like in ‘Of Mice and Men’, cropping and wood cutting but just like in ‘Of Mice and Men’ there was little job security and hardly any employment rights. Entertainment was still a big part of people’s lives. The farmers had house gatherings and even back in the 1800’s drinking was still popular as in ‘Of Mice and Men’. Local bands were often booked for traditional dances and festivals. They celebrated Christmas with little plays from house to house. You could also go and see a hanging when there was one and purchase a part of the rope used. Punishments for even little crimes like theft could be punishable by death. There were almost no legal rights for anyone in the labouring class and if u were just thought to be guilty of a crime you could still be hanged for it and you weren’t given a chance to prove yourself innocent. The settings for these two stories are quite similar even though both are set in different countries and years apart. In ‘Of Mice and Men’ a vision of the place is clearly described. It is set on a rural farm that ‘bucks barley’. The local town is Soledad where the men found some of their entertainment. Steinbeck makes the setting sound very bare and lonely and portrays the idea that the farm is cut off and very much on its own very well. The valley is described well and is described as open and free, â€Å"On one side of the river the golden foot hill slopes curve up to the strong and rocky Gabilian Mountains, but on the valley side the water is lined with trees†. There is a ‘brush’ in this story, which Steinbeck mentions clearly, â€Å"The sycamore leaves turned up their silversides, the brown, dry leaves on the ground scudded a few feet†. Farming is a big part in each story as well, even though the farms themselves are different , the different types of countrysides are both described well by each other in their own well. In ‘The Withered Arm’ a clear description of it’s setting is also given. This story is also set in and around farmland but this farm is a dairy farm unlike the one in ‘Of Mice and Men’. The setting in this story however is much greener with more of a typical English countryside. It is set just outside of Holmstoke and is surrounded by Egdon Heath, which is described as barren moorland, â€Å"their course lay apart from the others to a lonely spot high above the water-meads and not far from the border of Egdon Heath, whose dark countenance was visible in the distance†. This makes the place sound very cut off and lonely just as in ‘Of Mice and Men’. In ‘The Withered Arm’ dairy farming dominates and is the main way of working and living just like in ‘Of Mice and Men’ where crop farming is the main way of working and living. In each of the stories there are similarities in the plots. In ‘Of Mice and Men’ Lennie and George are two incomers to the farm where the story is based. They are wor kers that travel around to find work in different places and to gat some money. They arrive just down the road from the farm as the bus driver refuses to drive them any further. They are there to work as ‘barley buckers’ which is pretty much the lowest rank of worker. Their welcome to the farm from the other workers wasn’t that pleasant because to them Lennie and George were just another pair of passers by. When they first arrived all they got was a † ‘ The boss was expectin’ you last night’ † The other workers were a bit curious about George and Lennie because normally men travel around on their own so they thought there was something suspicious going off between them,† ‘say-what you sellin’?’ † In ‘Of Mice and Men’ Curley’s hand gets broken. Curley provokes Lennie and starts hitting him, Lennie is really very gentle but he grabs hold of Curley’s hand and squeezes it until he ends up breaking every bone, † Looks to me like ever’ bone in his han’ is bust†. Also in both stories there is an unhappy marriage. In ‘Of Mice and Men’ the unhappy marriage is the marriage of Curley and his wife. She’s thought of so little that she isn’t even given a name. She tells Lennie how she only married Curley on the rebound to get away from her mother, † Well, I wasn’t gonna stay no place where I couldn’t get nowhere or make something of myself, an’ where they stole your letters. So I married Curley. Met him out to the Riverside Dance Palace that same night† Curley doesn’t seem to pay that much attention to her or care about her, as he doesn’t hesitate to go to the ‘cat house’ in town with all the guys and leave her on her own. In ‘The Withered Arm’ the incomer in this story is Gertrude. She enters the story as Farmer Lodges new wife. Unlike Lennie and George, Gertrude enters the story at the top of the social scale. However, like George and Lennie she also doesn’t receive the friendliest of welcomes and all the villages are very curious about her on her arrival, † ‘Well, did you see her?’ â€Å". In ‘The Withered Arm’ there is also an injury but this one is very different to the one in ‘Of Mice and Men’. This injury has a strange, paranormal meaning to it as the dream Rhoda had about hitting Gertrude’s arm mysteriously comes true when a hand mark appears on her arm and it starts to wither, â€Å"She uncovered her left arm, and their outline confronted Rhoda’s gaze as the exact original of the limb she had beheld and seized in her dream†. In this story there is also an unhappy marriage of Gertrude and Farmer Lodge. At the beginning of the story they seem like a happy couple in love but he only really sees her as is pretty girl to go on his arm, â€Å"you must expect to be stared at just at first, my pretty Gertrude†. When Gertrude becomes marked and her arm begins to wither, Farmer Lodge begins to loose interest. As Gertrude becomes imperfect the marriage begins to fall apart, â€Å"‘six years off marriage and only a few months of love’ † The female characters in both stories have many differences through how they live but some similarities can be made between the three. In ‘Of Mice and Men’ the female character is Curley’s wife. She is described as young and pretty but she hates the life she’s got with Curley on the farm. She had dreams of living a life a luxury and being put it the ‘pitchers’, † ‘Well a show come through, an’ I met one of the actors. He says I could go with that show’ â€Å". Women were pretty much at the bottom of the social scale compared to men so Curley treated her like she belonged to him, Steinbeck show this in the story by not giving her a name and just referring to her as Curley’s wife. Curley goes off in to town with the other guys in to the ‘cat house’ withou t giving his wife any consideration. In ‘The Withered Arm’ there are two female characters, Gertrude Lodge and Rhoda Brook. Rhoda is a dairymaid on Farmer Lodges farm and just like Curley’s wife has been treated badly by a man. Rhoda had once bin the lover of Farmer Lodge and accidentally got pregnant, because of this Farmer Lodge ended it and left her to bring up their son on her own with no help. He tries to ignore her and his own son and tries to pretend he doesn’t really know who they are. When he sees his son he discards him as just another villager, † ‘I think he lives with his mother a mile or two off’ † the way Rhoda was treated by Farmer Lodge shows that she was just being used and treated like an object and not properly respected like she should be, this is just like how Curley treated his wife in ‘Of Mice and Men’. Gertrude Lodge is Farmer Lodges new wife. He is very proud of her in a way at the beginning because she is young and beautiful. However all this does change, when Gertrude’s arm begins wither and she become imperfect, Farmer Lodge slowly begins to loose interest. In this way she is also treated badly by a man like Curley’s wife and Rhoda Brook were. Farmer Lodge got to think very little of Gertrude, as she never gave him a child along with her disfigurement, he grew to not love her just because of they way she looked. In both stories all the women were treated very unfairly by men and can relate to one another by how badly they were treated by men. Each stories has different themes but the two main themes in these stories are friendship and loneliness. In ‘Of Mice and Men’, Candy, Crooks and Curley’s wife are the three main lonely ones. These three are considered at the bottom of the social scale. Candy is lonely because he is old and only has one hand, Crooks is lonely because he also has a disability and he is black and black people weren’t thought of very highly because of the colour of their skin and Curley’s wife is lonely because she is female and women were considered to be second class to men, she is only seen as Curley’s wife and not her own individual person. All three are lonely because they’re all different or have a disability in some way. The idea of loneliness is also expressed through the things Steinbeck writes about. When George is in the bunkhouse playing cards, â€Å"his solitaire hand† is mentioned, solitaire a game played on your own so this shows George’s loneliness. Also the local town is called Soledad and ‘sole’ is also expressing the loneliness of the story. The main and strongest friendship in ‘Of Mice and Men’ is the friendship of Lennie and George. When the Great Depression hit America men travelled around on their own looking for work but Lennie and George travel together. George and Lennie have been friends for years and Lennie is ‘simple’ so needs looking after, George is the one to do this, he looks after Lennie the best he can and cares for him. From some of things George says you can tell that he does care about him. â€Å"Jesus Christ, you’re a crazy bastard!† is said in a kind of sarcastic way and shows that George does like Lennie and cares for him but try’s not to show it. In ‘The Withered Arm’ Gertrude is the lonely one. She is lonely because she has come into the story and enters Holmstoke as a complete stranger and doesn’t know anyone. She finds herself very much alone after her arm starts to wither and her husband beings to loose interest in her and ignore her. Just like Candy and Crooks in ‘Of Mice of Men’ one of the reasons she feels loneliness is because of a disability or injury. The main friendship in ‘The Withered Arm’ is the friendship of Rhoda and Gertrude. This friendship is very different to the one of Lennie and George in ‘Of Mice and Men’. At first Rhoda didn’t like Gertrude just because she married Farmer Lodge and then Rhoda has her strange dream. When Rhoda meets Gertrude she sees how nice she is and then she finds out about Gertrude’s withering arm and realises it’s because of her dream and Rhoda feels guilty. Unlike Lennie and George’s friendship being based on care and love this friendship is partly based on Rhoda’s guilt over disliking Gertrude in the first place. In both stories dialect and slang are used by each writer to give you a more realistic view on each of the characters and the stories. In ‘Of Mice and Men’ the slang and dialect used could be quite hard to understand. In 1930’s California the speech is a very old American accent. Steinbeck used this in his story to convey a more realistic picture of the characters and how they spoke. † ‘She slang her pups last night,’ † said slim, simply means that she gave birth last night to her new puppies. † †Cause I can jus’ as well go away, George, an’ live in a cave’ â€Å", Simply means ‘of course, I can just go away and live in a cave’. † ‘We’ll take ‘um into Soledad an’ get ‘um fixed up’ â€Å", all ‘um means is him, and the ‘d’ is misses off of ‘and’. Using the actually dialect and slang makes the story sound more real and to try and give you more of an idea about what each character is like. In ‘The Withered Arm’ Hardy also uses slang and dialect to bring his characters to life and make them sound more realistic through the way they speak. Nineteenth century ‘Wessex’ has a very different dia lect to ‘Of Mice and Men’. † ‘He do bring his bride home tomorrow’ â€Å", almost doesn’t make sense but it just mean that ‘he will bring his bride home’. † ‘Ah- ’tis all a-scram’ â€Å", just means that ‘it is all shrivelled up’. The dialect in this story also has completely different word for things like ‘chimmer’ means bedroom and ‘fancied’ means imagined. Hardy uses all this language to make his story and characters more believable and to give the effect of the place it’s set in. Out of these two stories I preferred ‘Of Mice and Men’ by john Steinbeck. I think that this story has more of a powerful ending than ‘The Withered Arm’. I think that ‘Of Mice and Men’ is more realistic than ‘The Withered Arm’ because in ‘The Withered Arm’ the ending is all tied up neatly and really that’s not like real life. Where as in ‘Of Mice and Men’ it just ends and is left open like it can carry on, just like life really is. â€Å"Curley and Carlson looked after them. And Carlson said, ‘Now what the hell ya suppose is eatin’ them two guys?’ â€Å". I think that ‘Of Mice and Men’ has a more interesting plot that keeps your reading till the end unlike ‘The Withered Arm’ that I found got a bit boring.

Free Essays on Stop All The Clocks, Cut Off The Telephone

â€Å"Stop All the Clocks, Cut Off the Telephone † Wystan Hugh Auden is known for writing poetry that says something truthful about life. In his poem, â€Å"Stop All the Clocks, Cut Off the Telephone †, Auden writes of the importance of love in our life. The speaker in the poem has lost love in his life, and believes his life is meaningless without love. W.H. Auden uses imagery and diction to convey the idea that love should not be taken for granted, love is wonderful and without love the world is nothing. Throughout â€Å"Stop All the Clocks, Cut Off the Telephone†, Auden uses imagery to portray love to be vital to our life. The loss of his love seems to be so immense that the speaker creates a funeral for his love. The funeral is not just an ordinary funeral it is painted in the reader’s mind as a funeral fit for royalty. In this grand funeral, there are â€Å"aeroplanes circl[ing] moaning overhead† (5) and â€Å"crepe bows† (7) are put around â€Å"the white necks of the public doves† (7). Few funerals involve airplanes, â€Å"scribbling on the sky† (6) and doves wearing bows, a funeral life this would belong to someone great. The speaker is creating the idea that love is so magnificent that if it were to have a funeral, only the best would be fit. In the fourth stanza of the poem, Auden creates the image that without love everything else is worthless. The speaker believes that his love is dead so in turn everything else should die too. He p ortrays the universe to be inferior to love, â€Å"the stars are not wanted now: put out every one; Pack up the moon and dismantle the sun† (13-14), he is very nonchalant about theses massive structures. He lets the reader feel his pain; he no longer cares about the moon and the stars because his heart is empty. These are very powerful images, which show how important love is and how it feels to lose love. The diction in the first line of the poem sets the importance of love to the speaker. ... Free Essays on Stop All The Clocks, Cut Off The Telephone Free Essays on Stop All The Clocks, Cut Off The Telephone â€Å"Stop All the Clocks, Cut Off the Telephone † Wystan Hugh Auden is known for writing poetry that says something truthful about life. In his poem, â€Å"Stop All the Clocks, Cut Off the Telephone †, Auden writes of the importance of love in our life. The speaker in the poem has lost love in his life, and believes his life is meaningless without love. W.H. Auden uses imagery and diction to convey the idea that love should not be taken for granted, love is wonderful and without love the world is nothing. Throughout â€Å"Stop All the Clocks, Cut Off the Telephone†, Auden uses imagery to portray love to be vital to our life. The loss of his love seems to be so immense that the speaker creates a funeral for his love. The funeral is not just an ordinary funeral it is painted in the reader’s mind as a funeral fit for royalty. In this grand funeral, there are â€Å"aeroplanes circl[ing] moaning overhead† (5) and â€Å"crepe bows† (7) are put around â€Å"the white necks of the public doves† (7). Few funerals involve airplanes, â€Å"scribbling on the sky† (6) and doves wearing bows, a funeral life this would belong to someone great. The speaker is creating the idea that love is so magnificent that if it were to have a funeral, only the best would be fit. In the fourth stanza of the poem, Auden creates the image that without love everything else is worthless. The speaker believes that his love is dead so in turn everything else should die too. He p ortrays the universe to be inferior to love, â€Å"the stars are not wanted now: put out every one; Pack up the moon and dismantle the sun† (13-14), he is very nonchalant about theses massive structures. He lets the reader feel his pain; he no longer cares about the moon and the stars because his heart is empty. These are very powerful images, which show how important love is and how it feels to lose love. The diction in the first line of the poem sets the importance of love to the speaker. ...

Help Im a Workaholic!

Help Im a Workaholic! Okay, being a workaholic sounds doesn’t sound like a very positive description. You might consider yourself to be more along the lines of â€Å"too efficient† but the truth is, being extremely efficient at work can have its drawbacks, too. Consider these tips, inspired by Laura Vanderkam at FastCompany.com. Realize You Move at a Faster SpeedFirstly, if you’re driving at 90 mph and your coworkers are cruising along at the speed limit, odds are you’re pretty frustrated whenever you’re waiting on them to turn around an assignment or component for a shared project. The solution here isn’t to slow down, necessarily, but be aware that your natural pace may not match up automatically with those around you.And chances are, if you’re feeling frustration, others may be sensing it. Approach your workflow with all that characteristic efficiency, but build the time delays into it, so you know when to expect and how to respond to them.Don’t R ush Past Important Workplace CheckpointsSecondly, what if you know you’re the most productive person in the office, but promotions keep going to other people? Sure, maybe you’re just too valuable where you are, but  take a look at the politics of the workplace for a possible explanation.You may be working speedily and effectively, but are you taking the time to build personal relationships? Make the effort to accept a happy hour invitation at least once a month; support your colleagues by celebrating their milestones and pitching in on projects if they need help. Take 10 minutes to schmooze a little with someone you actually like talking to- you never know when a positive impression will come in handy.Besides, if you churn through your to-do list at a breakneck pace and don’t have a lot of patience for stragglers, you’re actually demonstrating poor management skills. Good managers motivate their teams, and help them balance responsibilities and tasks, r ather than steamrolling by and expecting them to follow automatically. Mentor your coworkers, particularly those further down the hierarchy- demonstrate to the higher ups that you may be a wunderkind, but you’re also a team player.Make Sure Your Contributions are KnownAnd finally, make sure someone knows how productive you are! The disadvantage to keeping your head down and your eyes on the target is that people may come to take for granted what you contribute. Schedule regular check-ins with your boss, disguised as a â€Å"status meeting† if necessary, to ensure that your accomplishments are on their radar.Then, kick back and enjoy leaving promptly at 5- virtue (or high level efficiency) can also be rewarded by the timely end to the work day.The Downside To Being Super Efficient At WorkRead More at Fast Company

Federal open market committee Essay Example | Topics and Well Written Essays - 1000 words

Federal open market committee - Essay Example The Federal Open Market Committee plays a key role in setting the rates of interest on loans etc. that are available with banks and other lending institutions. In fact if we consider carefully, monetary and fiscal policy are the two ways in which the money supply and interest rates within an economy are controlled. This has impact on the rates of inflation, employment, job creation, productivity and a whole lot of other factors that form part of our financial and economic well being and affect the National Statistics and state of the economy. In this assignment we are going to take on the role of the Federal Open Market Committee and make a decision on short term interest rates for the USA. Discussion The term ‘Open Market Operations’ refers to the actions of the FOMC in directly controlling the money supply available with banks and indirectly by affecting the rates of interest and lending available with banks (Samuelson & Nordhaus, 2004). If the FOMC has decided to tigh ten monetary supply and credit expansion, it will sell securities in the open market at a higher rate, which have to be picked up by the banks. Using part of their money supply to achieve this objective, it leaves the banks with reduced capacity to give out loans. As the amount of lending has a connection with available reserves, a reduction in lending reserves would automatically put a dent in credit expansion and lending would dry up. So here the FOMC has managed to reduce credit expansion. On the other hand, if it was desired to increase the credit supply in the economy, the FOMC would work to buy securities from the open market and in doing so, give the banks funds which they could use for lending purposes. This would make lending easier and the economy would receive a boost by way of increased trade and investment opportunities. It is notable that Open Market Operations is only one tool at the disposal of the FOMC to control the money and credit available in an economy. Being a Banker to the Government, printer of US currency notes, Bankers Bank, increasing and decreasing the Reserve Ratio, and even applying moral persuasion are some of the ways in which the Federal Reserve seeks to exert a good measure of control on prices, productivity, inflation and employment in the USA (Samuelson & Nordhaus, 2004). Analysis of Current Economic Conditions Let us now move on to the actual statistics at the present time. The CPI as of May 2011 stands at 224.804. Prices have been rising slightly in recent years, as costs to produce goods and services have gone up. The GDP was 15018.1 for Q1 of 2011 and GNP was 15255.1 for the same period. This also registered a slight increase, which may be a combination of price and productivity factors. Total nonfarm private payroll employment stood at 108677 as of June 2011. The Industrial Production Index stood at 92.9815 as of May 2011. All of these figures show a slight increase, indicating that the economy is on the rebound. The I ndustrial Production of Durable Goods was recorded at 88.3948 as of May 2011 and Industrial Production of Final Goods (Market Group) was recorded at 94.6823 for the same period. Increase trends here mean that the economy is still recovering from the depression. The figure for Housing Starts of new privately owned housing units was 560 in May 2011 picking up slightly from 541 units the month before. Number of units authorized but not started hovers around 81. The housing market has been most affected by the depression and will take some time to pick up- at the moment we are seeing lackluster demand despite low interest rates. A lot of homeowners were burned in the last financial crisis. Real retail sales for consumer and food items stood at 172202 in May 2011 registering a drop from 172902 a month before. This means that consumer confidence is still lacking and people are still apprehensive about their next paycheck- consequently consumer spending has hardly picked

Health and Safety Essay Example | Topics and Well Written Essays - 1000 words - 1

Health and Safety - Essay Example release of harmful substances or petroleum products into structures on the site, the ground, underground water or surface water in the property (Hughes & Ferrett, 2008). ISA encompasses the following aspects: analyzing relevant and existing documents and maps explaining local geological and hydrogeological conditions. It also evaluates existing aerial photographs of the site in order to determine prior activities and developments that will give a hint of the potential existence of harmful substances. ISA will also focus on the terrain of the site in order to determine if the project to be established will not pose a health or safety risk if constructed on the site. The topography is also critical in projects that will require the pumping of water or waste which is in liquid form as it will require pressure. Examples include water and sewerage projects. Access and exit routes to the site will also be addressed by the initial assessment report. These two factors are important in that it will determine efficiency of entry into the site. Such considerations are also important in cases of accidents and emergencies as knowledge of exit routes will ensure fast evacuation of the site (Hughes & Ferrett, 2008). The boundaries of the site are also important in the initial site assessment because if the project will entail the emission of hazardous waste, it is important that the boundaries are clearly defined to avoid contamination of adjacent surrounding areas. Such acts can result in healthy concerns for the nearing environs and costly law suits. Site controls are important in ensuring that health and safety concerns are addressed before the actual project is started. Planning is critical in ensuring that health and safety is integrated into the project from the initial stages of the project to avoid future complications that may arise in installing safety measures in the site. Some of the considerations that must be factored in include installation of fire exits,

Sage 50 Construction Accounting 2014 Research Paper

Sage 50 Construction Accounting 2014 - Research Paper Example The software also allows a company to come up with custom reports, draft budgets for various departments and branches, and integrate different organizations for financial reports among other functions (Franks pg95). Sage 2014 software contains various customization tools to enable a construction company smoothly run its activities. Some of the tools used are progress billing, robust job costing and industry specific reports. These tools are designed and premeditated in such a way that intensifies accuracy, save time and assist in understanding business profitability. Other tools and services provided by Sage are pro accounting that provides efficiency to your company, facilitate quick expansion, customize inventory, manage client contracts, trail jobs and facilitate shipping and vendor management. Premium accounting tool enables a constructing company manage its budgets, strategic planning and filter financial records. Last but not least is a quantum accounting tool which manages large amounts of data, and a wide range of customer access requirements. As the business world expands, it is now vital to integrate technology in business by use of electronic commerce packages. Sage 2014 construction accounting software integrates technology in business, by allowing online payment, by use of credit and debit cards. Online payment has opened up global buying and selling of the software thus increasing sales in the construction industry (Morris and Richard pg210). Use of electronic commerce saves on time and costs incurred in preparing documents. This software also enables twenty four seven services to customers and suppliers. The software also facilitates communication between the suppliers, clients and the construction industry. Complaints brought forward are dealt with within a short time. This leads to improved services as

Development of Electronic Data Flows

Development of Electronic Data Flows 1. Introduction The current development on the flow of electronic data, especially those relating to personal data across nations is increasing daily. Most of the flows are related to business activities whereas services are provided to fulfill the needs of people. It also leads to the transformation of commerce, which becomes worldwide and increasingly international. The transfer of huge quantities of data, relating to customers and employees, are required and often occurred among entities that located in different countries. An example would be the system of outsourcing, a practice in which companies and governments hire an external service provider in another country to deliver a program or provide a service, such as managing database of human resources or customers. This can often result in improved efficiencies and levels of services. Further, the advancement of global networks, such as the internet, provides the possibilities to collect, process, and distribute personal data on an unprecedente d scale. However, the trans-border flow of personal data is not only performed by companies or governments but also conducted by individuals in everyday life as well. When the data is used by companies or government, this can represent a high volume of data, such as in the form of the transfer of databases. There will be a quite different volume of data when it is provided by individuals when they disclose their personal data while participating in particular activities, such as browsing the internet or registering on various websites to obtain certain services. Additionally, there is a strong possibility for individuals, who are engaging in data transfer activities to lack of full awareness concerning what could be done to their personal data. In some instances, they do not realize that they have disclosed their personal data and it is subject to transmission and processing within countries not offering the same level of protection as their own country. For example, a student physically located in the Netherlands may complete an online game registration form, containing several spaces soliciting his/her identities, not knowing that the actual service provider is registered in India. Another example, a social worker residing within the United Kingdom might disclose his/her personal data on a web application for an internet banking service provided by a bank based in the United States. From the short description above, the trans-border flow of personal data exists in everyday life on a daily basis and it becomes a vital need of every stakeholder, whether governments or private sectors, including individuals. Nevertheless, while the flow has led to greater efficiencies and economic benefits, on the other hand this kind of flow has also raised concerns that some information could end up in the hands of people for whom it was not intended. Worse even is the situation when no one has realized the flow has taken place, spawning a great opportunity for infringement upon ones privacy rights. Some rules concerning privacy and data protection have been set up at national, regional, and international levels to guarantee privacy as one of the human rights is not harmed by any activity, including data processing as the final purpose of trans-border flow. Consequently, the trans-border flow of personal data has to be conducted in a lawful manner. In this respect, a legal framework on trans-border flow of personal data has been enacted in Europe by the European Commission (EC) under two directives. The first one is Directive 95/46/EC concerning the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data. This Directive has been further equipped by the second directive, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). In relation to the research objective of this thesis, Directive 95/46/EC is the most relevant and therefore, Directive 2002/58/EC will be referred to when necessary. It should be noted that whenever a term the Directive is being used in this thesis, the term shall refer to Directive 95/46/EC. Under the Directive, a main rule concerning the trans-border flow of personal data has been set up. These include the obligation of data controller to use personal data for specified, explicit, and legitimate purposes, to collect only relevant and necessary data, to guarantee the security of the data against accidental or unauthorized access or manipulation, and in specific cases to notify the competent independent supervisory body before carrying out all or certain types of data processing operations. On the other hand, there is a series of rights for individuals as data subject, such as the right to receive certain information whenever data is collected, to access and correct the data, and to object to certain types of data processing. Nevertheless, all of the practice of these rights and obligations present a significant problem when the trans-border flow of personal data takes place from the European Union/European Economic Area (the EU/EEA) Member States to countries outside the EU/EEA, for the reason that the Directive requires an adequate level of protection in the destination countries. The transfer of personal data to a third country is prohibited when the third country does not have an adequate level of protection to ensure that the processing of personal data will not cause any violation to the rights of data subjects. The binding power of the Directive to the EU/EEA Member States requires each of the Member States to embed the provisions in the Directive into their national legal system. Thus, there is a free zone where trans-border flow of personal data can take place freely among the Member States because they provide the adequate level of protection. Any approval, adequate safeguard, or additional requirement is not necessary to any further extent. As far as public international law is concerned, by applying the extra-territoriality principle, the requirement of the adequacy is automatically fulfilled at the official representatives of the EU/EEA Member States in the third country, such as the Embassy or Consulate General because of the extended jurisdiction of the Member States. However, this principle is not extended to private sectors, since subsidiary offices of multinational companies, still have to abide to the national law in the third country although the base of operations of the company is located in the EU/EEA Member States. In this case, the adequate level of protection is still required even though the transfer is conducted internally among the subsidiaries of the company located in third countries. Currently, the EC has conducted some adequacy findings and has compiled a white list of countries providing an adequate level of protection. This approval means the trans-border flow of personal data can take place as in the free zone between the EU/EEA Member States. However, to date, the white list covers a limited list of countries, seven to be exact. This list might not prove too sufficient from the point of view of multinational companies in accommodating their interest, as it does not include many countries of growing commercial interest. From this point of view, there is a need to harmonize various privacy and data protection regulations in many countries through the establishment of an internationally congruent legal framework for privacy and data protection. Unfortunately, it will take some effort and time for the establishment, while a fast solution is needed. By considering the Directive thus far the strictest legal framework compared with other existing legal framework on privacy and data protection, obviously, there is a need for countries outside the EU/EEA Member States to improve their legal framework to become compliance with adequate level of protection requirement under the Directive. Since Indonesia is neither a Member State of the EU/EEA nor included in the white list of adequacy finding, the requirement of adequate level of protection is applied to Indonesia as a third country. The trans-border flow of personal data only can take place after the data controller is certain that the protection level of personal data in Indonesia is adequate under the Directive. Apparently, Indonesia is needed to criticize, whether or not its legal framework providing an adequate level of protection. Moreover, Indonesia as a Member State of the Asia-Pacific Economic Cooperation (APEC) has received a pressure to provide a sufficient level of protection on trans-border flow of personal data, in relation to the existence of the APEC Privacy Framework. This pressure has become heavier because of Indonesia position as the Association of South East Asian Nations/ASEAN Member States. Therefore, the main objective of this thesis is to examinehow Indonesia can improve its legal framework to comply with the adequate level of protection in view of Directive 95/46/EC. Conducting this examination is important in determining ways Indonesia might be developed into an attractive destination country for international commerce activities. In order to answer the objective of this thesis, three research questions have to be answered: firstly,currently, why Directive 95/46/EC is being acknowledged as the strictest legal instrument concerning privacy and data protection on conducting trans-border flow of personal data compared with other existing legal instruments. Secondly, how the European Commission determines the adequate level of protection in the third country in question under Directive 95/46/EC. Then, thirdly, to what extent legal framework of data protection in Indonesia measures up to the adequate level of protection in Indonesia under Directive 95/46/EC. In line with the effort to answer the first research question, this thesis will try to identify any possibility for improvement towards the current adequacy finding system. Hence, a balance accommodation might be obtained and maintained between the one who requires the adequate level of protection and the one who has to fulfill it. This thesis will be structured as follows. The first chapter is the introduction in which the objective of this thesis is explained. In the second chapter, there will be a brief comparison between the Directive with other legal instruments concerning privacy and data protection. Afterwards, some explanations on the requirement of the adequate level of protection in the light of the Directive will be provided, including the measurement to be used in conducting the adequacy finding and will explore any possible solution if there is no adequate level of protection in the third country in question. Further, this chapter will cover the current problems within the Directive as well as possible suggestions to overcome them. Thus, answering the first and second research question. In the third chapter, relevant issues surrounding Indonesian legal framework will be discussed, including a brief explanation on how Indonesia regulates privacy and data protection as well as a number of the difficulties experienced in doing so. The findings in the second and third chapters shall be employed to carry out the examination in the fourth chapter, which objective is to answer the third research question. The chapter serves to analyze the adequate level of protection of Indonesian legal framework by applying the measurements in the light of the Directive. The analysis will include various potential problems faced by Indonesia on its effort to improve protection of personal data along with several suggestions on how to overcome them. At the final stage, there will be a conclusion, to what extent Indonesia can be deemed as providing an adequate level of protection. As a result, a solution on how Indonesia might improve its legal framework under the Directive to both avoid a lack of protection and offer an adequate level of protection will be achieved. 2. The EU Legal Framework regarding trans-border flow of Personal Data The trans-border flow of personal data is stipulated by regulations concerning data protection. Since the early eighties, several regulations, drawn up by different organizations, have been published in this respect. The first initiative was performed by Organization for Economic Co-operation and Development (OECD) by establishing the Guidelines on the Protection of Privacy and Trans-border Flows of Personal Data (the OECD Guidelines) in 1980. The intention of the Guidelines is to prevent any conflicts between national laws, which can hamper the free flow of personal data between the OECD Member States. This establishment brought an awareness of the importance protection of the trans-border flow of personal data. A similar purpose with the OECD Guidelines has brought the Member States of the Council of Europe (the CoE) to publish a convention on their interest in the following year. They agreed that it is needed to reconcile the fundamental values of the respect for privacy and the free flow of information between them. The agreement is stated in the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108), with purpose to take into account the right of privacy and the increasing flow across frontiers of personal data in regards of automatic processing, as a way to extend the safeguards for everyones rights and fundamental freedoms. In 1990, by considering the UN has more Member States compared with the OECD and the CoE, Guidelines concerning Computerized Personal Data Files (the UN Guidelines) was established as a way to bring the principles on privacy and data protection being implemented wider among countries. The UN General Assembly through Resolution No. A/RES/45/95 on 14 December 1990, requests the Governments of every Member States to take into account this Guidelines in their legislation. Further, the governmental, intergovernmental, and non-governmental organizations are also requested to respect the Guidelines in carrying out the activities within their field of competence. Nonetheless, the OECD Guidelines, the CETS No. 108, and the UN Guidelines still have some weaknesses. There are some principles of data protection, which are required to be embedded in national laws of each of the Member States but there is no means for ensuring their effective application. For examples, there are no supervisory authority provision in the CETS No. 108 and a lack of procedural clauses in the OECD Guidelines. In another case, concerning the binding power of the instrument, the OECD Guidelines is voluntarily binding to its Member States as well as the UN Guidelines, even though the UN Guidelines has the supervision and sanction provisions. Therefore, Directive 95/46/EC on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data has been established by the European Union (the EU) to overcome the limited effect of the two Guidelines and the Convention as mentioned above. Good level of compliance, support and help to individual data subject, and appropriate redress to the injured parties are the means used by the Directive for ensuring the effective application of the content of the rules. Apart from the compliance issue, the obligations and rights set down in the Directive are built upon the OECD Guidelines, the CETS No. 108, and the UN Guidelines. These three legal instruments contain similar principles, except for lawfulness, fairness, and non-discrimination principles are from the UN Guidelines; and special categories of data and additional safeguards for the data subject principles are from the ECTS No. 108. While the rest of the adopted principles are collection limitation, data quality, purpose specification, use limitation, security safeguard, openness, individual participation, and accountability. Further, the aims of the Directive can be seen from two perspectives. The first one is the economical perspective, in relation to the establishment and functioning of an internal market, in which to ensure the free movement of goods, persons, services, and capital, including the free movement of personal data. The second is from the fundamental rights perspective, in which to set the rules for high-level data protection to ensure the protection of the fundamental rights of the individuals. The newest legal instrument concerning privacy and data protection is the APEC Privacy Framework 2004 (the Framework), established by Asia-Pacific Economic Cooperation (APEC). The purpose of the Framework is to ensure there are no barriers for information flows among the APEC Member Economies by promoting a consistent approach to data protection. There are nine principles in the Framework that are built based on the OECD Guidelines. In brief, the adopted principles are preventing harm, notice, collection limitation, uses of personal information, choice, integrity of personal information, security safeguard, access and correction, and accountability. However, this Framework has the same weakness as the previous legal instruments on privacy and data protection before the Directive, which is the absent of means for ensuring the effective application of the principles. Additionally, it should be noted that APEC is a forum that established based on a voluntary basis, without any constitut ion or legally binding obligations for the Member Economies. Hence, the Framework is not binding to the Member Economies. From the brief analysis above, currently, the Directive posses the highest level of protection compared with other existing legal instruments on privacy and data protection. In this respect, to achieve the objective of this thesis as stated in the first chapter, the research questions will be answered by focusing on the Directive. Therefore, in the next section, there will be an explanation on the legal bases of trans-border flow of personal data to third countries under the Directive, followed by a rationalization on how the European Commission (EC) determines whether or not an adequate level of protection exists in the third country in question. Subsequently, the means for ensuring the effective application of the content of rules will be elaborated upon a description on a series of possibilities if the third country in question is not deemed to provide an adequate level of protection. Although currently, the Directive provides high-level of protection, some problems and suggestions will be provided, as an effort to address input for improvement. The findings in this chapter will be used to carry out the adequacy finding of Indonesia as a third country (in the fourth chapter) by doing a comparison with the findings on Indonesian legal framework in chapter three. 2. The Legal Bases of Trans-border Flows of Personal Data to Third Countries The trans-border flow of personal data to a third country to be acknowledged as lawful, it has to be conducted in accordance with the national data protection law of the EU/EEA Member States. It is applicable to the data controllers established in the EU, both at the time when data is being collected and processed. In general, the law consists of a combination between the obligations of data controllers and the rights of data subject. Before the establishment of the Directive, these rights and obligations were regulated under some national data protection laws with different level of protection. In the light of the functioning of internal market in the EU/EEA, all these obligations and rights, including certain procedures to be applied in case of trans-border flow of personal data to a third country, are regulated in the Directive. Whereas the Directive is legally binding to the EU/EEA Member States, an adequate level of protection is fulfilled and consequently trans-border flow of personal data is able to take place among them. Further, when the personal data is used for electronic communication purposes, then the rights and obligations as lay down in Directive 2002/58/EC shall take place. There are three possible types of transfer under the Directive. The first and second types are a communication of personal data by a data controller based in the EU/EEA Member States to another data controller or to a processor based in a third country. Another possibility type is a communication of personal data by a data subject based in the EU/EEA Member States to a data controller based in a third country. Nevertheless, it should noted that the Directive does not cover transfers of personal data in the course of judicial and police cooperation activities falling within Titles V and VI of the Treaty on European Union. The main regulation in the Directive concerning trans-border flow of personal data to a third country is Article 25. The first paragraph of the Article sets out the principle that the EU/EEA Member States shall allow the transfer of personal data only if the third country in question ensures an adequate level of protection. From this provision, it is necessary to explain further on the subject of the transfer of personal data and an adequate level of protection. First, what the Directive means by the transfer of personal data. Undoubtedly, it is often associated with the act of sending or transmitting personal data from one country to another, for instance by sending paper or electronic documents containing personal data by post or e-mail. By seeing from a different perspective, the situation where one conducts a certain activity with the purpose to make data available for others, besides the owner of the data (the data subject), and located in another country, is included as a trans-border flow of personal data. However, by making data accessible for everyone who connects to internet by uploading any personal data on internet web pages, even though that person is located in another country, is not included in the meaning of transfer of personal data to another country. The reason for the previous statement is this kind of activity is properly acknowledged as publishing activity, not transferring activity. This exception is stated clearly by the Court of Justice in the Bodil Lindqvist Case as there is no transfer of personal data to a third country where an individual in a Member State loads personal data onto an internet page making those data accessible to anyone who connects to the internet, including people in a third country. Subsequently, since the Directive is binding to 27 EU Member States, including three countries (Norway, Liechtenstein, and Iceland), which are bound by the Directive by virtue of the European Economic Area agreement (EEA), personal data can flow freely among them. In other words, there is a free zone among the EU/EEA member states. Therefore, transfer in the light of the Directive has to be seen as transfer of personal data from EU/EEA member states to other countries outside EU/EEA, which are recognized as third countries, and the adequate level of protection in those third countries has to be assessed. There is a so-called white list of countries, which have been assessed by the EC and affirmed to provide an adequate level of protection according to the Directive. Currently, the list consists of seven countries as follows: Argentina, Canada (limited to private sector data), Switzerland, United States (Safe Harbor and specific type of transfer: Passenger Name Record/PNR), the Bailiwick of Guernsey, the Isle of Man, and the Bailiwick of Jersey. The approval of adequacy shall be analyzed more carefully because once a country is listed in the white list, does not automatically mean that personal data can flow to the country freely. One should pay attention whether the affirmation is given for the entire legal framework or only for certain part of it in a specific field, sector (public or private), or regarding a specific type of transfer. Insofar, even though the result of adequacy finding shows that the data protection level in certain countries is not adequate, the EC will not create a black list for that negative finding because of political consequences. Instead of the black list, the EC tends to enter into negotiation with the certain country in order to find a solution. It can be concluded from the foregoing, that the adequacy finding is temporary and subject to be reviewed. Procedure of the Adequacy Finding In acknowledging the adequacy finding, the EC has to follow certain procedure, which has been determined in Article 25 Paragraph (6) of the Directive and is known as comitology. At first, there will be a proposal from the EC, followed by an opinion from Article 29 Working Party and an opinion from Article 31 Management Committee, which needs to be delivered by a qualified majority of member states. Afterwards, the EC submits the proposed finding to the European Parliament (EP), who will examine whether the EC has used its executing powers correctly and comes up with recommendation if necessary. As a final point, the EC then can formally issue the result of the adequacy finding. In the next section, the measurements used by the EC in conducting the finding will be explained in detail. 3. Assessing the Adequate Level of Protection The Article 29 Working Party has given an obvious statement thatany meaningful analysis of adequate protection must comprise the two basic elements: the content of the rules applicable and the means for ensuring their effective application.According to WP 12 of the European Commission (EC), a set of content principles that should be embodied in the existing regulations are the following: Purpose limitation principle: data should be processed for a specific purpose and subsequently used or further communicated only if it is compatible with the purpose of the transfer. Data quality and proportionality principle: data should be accurate and, where necessary, kept up to date. Transparency principle: individuals should be provided with information as to the purpose of the processing, the identity of the data controller in the third country and other necessary information to ensure fairness. Security principle: technical and organizational measures should be taken by the data controller that are appropriate to the risks presented by the processing. Rights of access, rectification and opposition: the data subject have the right to obtain a copy of all data relating to him/her that are processed, to rectification of those data that are shown to be inaccurate, and be able to object to the processing of the data. Restrictions on onwards transfers to non-parties to the contract: further transfers of the personal data by the recipient of the original data transfer only permitted if the second recipient provides an adequate level of protection. In addition to these content principles, another set of the means for ensuring the effective application of the principles, whether judicial or non-judicial, are required in order to fulfill the following objectives: Good level of compliance with the rules: the level of awareness of controllers and data subjects and the existence of effective and dissuasive sanctions are the measurements to examine the compliance level, including direct verification by authorities, auditors, or independent data protection officials. Support and help to individual data subjects: an individual should be able to enforce his/her rights rapidly and effectively without prohibitive cost. Institutional mechanism is needed to conduct independent investigation of complaints. Appropriate redress to the injured parties: where rules are not complied, redress to the injured party with independent adjudication or arbitration is provided, including compensation and sanction impose. Beyond the content principles, some additional principles are still needed to consider when it comes to certain types of processing. Additional safeguards when sensitive categories of data are involved and a right to opt-out when data are processed for direct marketing purposes should be in place. Another principle is the right for the data subject not to be a subject to an automated individual decision that intended to evaluate certain aspects, which can give any legal effects and have a significant effect to the data subject. These content principles, including additional principles, and the means for ensuring their effectiveness should be viewed as a minimum requirement in assessing the adequate level of protection in all cases. However, according to Article 25 Paragraph 2 of the Directive, in some cases, there will be two possibilities. There is a need to add the list with more requirements or to reduce it. To determine whether some requirements need to be added or reduced, the degree of risk that the transfer poses to the data subject becomes an important factor. The Article 29 Working Party has provided a list of categories of transfer, which poses particular risks to privacy, as mentioned below: Transfers involving certain sensitive categories of data as defined by Article 8 of the Directive Transfers which carry the risk of financial loss (e.g., credit card payments over the internet) Transfers carrying a risk to personal safety Transfers made for the purpose of making a decision which significantly affects the individual (e.g., recruitment or promotion decisions, the granting of credit, etc) Transfers which carry a risk of serious embarrassment or tarnishing of an individuals reputation Transfers which may result in specific actions which constitute a significant intrusion into an individuals private life (e.g., unsolicited telephone calls) Repetitive transfers involving massive volumes of data (e.g., transactional data processed over telecommunications networks, the Internet, etc.) Transfers involving the collection of data in a particularly covert or clandestine manner (e.g., internet cookies) To sum up, the circumstances should be taken into account when assessing adequacy in a specific case, being: the nature of the data the purpose and duration of the proposed processing operations the country of origin and the country of final destination the rules of law, both general and sectoral, in force in the country in question the professional rules and the security measures which are complied with in that country. Self -regulation From the circumstances as referred to Article 25 Paragraph 2 of the Directive, it can be seen that the assessments of the adequate level of protection is conducted according to the rules of law as well as the professional rules and the security measures. In other words, it has to be examined from a self-regulation perspective as well. The Article 29 Working Party presents a broad meaning of self-regulation asany set of data protection rules applying to a plurality of the data controllers from the same profession or industry sector, the content of which has been determined primarily by members of the industry or profession concerned.This wide definition offers the possibility to on the one hand a voluntary data protection code developed by a small industry association with only a few members and on the other hand a set of codes of professional ethics with quasi judicial force for a certain profession, such as doctors or bankers. Still, one should bear in mind, to be considered as an appropriate legal instrument to be analyzed, it has to have binding power to its members and has to provide adequate safeguards if the personal data are transferred again to non-member entities. Ob Development of Electronic Data Flows Development of Electronic Data Flows 1. Introduction The current development on the flow of electronic data, especially those relating to personal data across nations is increasing daily. Most of the flows are related to business activities whereas services are provided to fulfill the needs of people. It also leads to the transformation of commerce, which becomes worldwide and increasingly international. The transfer of huge quantities of data, relating to customers and employees, are required and often occurred among entities that located in different countries. An example would be the system of outsourcing, a practice in which companies and governments hire an external service provider in another country to deliver a program or provide a service, such as managing database of human resources or customers. This can often result in improved efficiencies and levels of services. Further, the advancement of global networks, such as the internet, provides the possibilities to collect, process, and distribute personal data on an unprecedente d scale. However, the trans-border flow of personal data is not only performed by companies or governments but also conducted by individuals in everyday life as well. When the data is used by companies or government, this can represent a high volume of data, such as in the form of the transfer of databases. There will be a quite different volume of data when it is provided by individuals when they disclose their personal data while participating in particular activities, such as browsing the internet or registering on various websites to obtain certain services. Additionally, there is a strong possibility for individuals, who are engaging in data transfer activities to lack of full awareness concerning what could be done to their personal data. In some instances, they do not realize that they have disclosed their personal data and it is subject to transmission and processing within countries not offering the same level of protection as their own country. For example, a student physically located in the Netherlands may complete an online game registration form, containing several spaces soliciting his/her identities, not knowing that the actual service provider is registered in India. Another example, a social worker residing within the United Kingdom might disclose his/her personal data on a web application for an internet banking service provided by a bank based in the United States. From the short description above, the trans-border flow of personal data exists in everyday life on a daily basis and it becomes a vital need of every stakeholder, whether governments or private sectors, including individuals. Nevertheless, while the flow has led to greater efficiencies and economic benefits, on the other hand this kind of flow has also raised concerns that some information could end up in the hands of people for whom it was not intended. Worse even is the situation when no one has realized the flow has taken place, spawning a great opportunity for infringement upon ones privacy rights. Some rules concerning privacy and data protection have been set up at national, regional, and international levels to guarantee privacy as one of the human rights is not harmed by any activity, including data processing as the final purpose of trans-border flow. Consequently, the trans-border flow of personal data has to be conducted in a lawful manner. In this respect, a legal framework on trans-border flow of personal data has been enacted in Europe by the European Commission (EC) under two directives. The first one is Directive 95/46/EC concerning the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data. This Directive has been further equipped by the second directive, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). In relation to the research objective of this thesis, Directive 95/46/EC is the most relevant and therefore, Directive 2002/58/EC will be referred to when necessary. It should be noted that whenever a term the Directive is being used in this thesis, the term shall refer to Directive 95/46/EC. Under the Directive, a main rule concerning the trans-border flow of personal data has been set up. These include the obligation of data controller to use personal data for specified, explicit, and legitimate purposes, to collect only relevant and necessary data, to guarantee the security of the data against accidental or unauthorized access or manipulation, and in specific cases to notify the competent independent supervisory body before carrying out all or certain types of data processing operations. On the other hand, there is a series of rights for individuals as data subject, such as the right to receive certain information whenever data is collected, to access and correct the data, and to object to certain types of data processing. Nevertheless, all of the practice of these rights and obligations present a significant problem when the trans-border flow of personal data takes place from the European Union/European Economic Area (the EU/EEA) Member States to countries outside the EU/EEA, for the reason that the Directive requires an adequate level of protection in the destination countries. The transfer of personal data to a third country is prohibited when the third country does not have an adequate level of protection to ensure that the processing of personal data will not cause any violation to the rights of data subjects. The binding power of the Directive to the EU/EEA Member States requires each of the Member States to embed the provisions in the Directive into their national legal system. Thus, there is a free zone where trans-border flow of personal data can take place freely among the Member States because they provide the adequate level of protection. Any approval, adequate safeguard, or additional requirement is not necessary to any further extent. As far as public international law is concerned, by applying the extra-territoriality principle, the requirement of the adequacy is automatically fulfilled at the official representatives of the EU/EEA Member States in the third country, such as the Embassy or Consulate General because of the extended jurisdiction of the Member States. However, this principle is not extended to private sectors, since subsidiary offices of multinational companies, still have to abide to the national law in the third country although the base of operations of the company is located in the EU/EEA Member States. In this case, the adequate level of protection is still required even though the transfer is conducted internally among the subsidiaries of the company located in third countries. Currently, the EC has conducted some adequacy findings and has compiled a white list of countries providing an adequate level of protection. This approval means the trans-border flow of personal data can take place as in the free zone between the EU/EEA Member States. However, to date, the white list covers a limited list of countries, seven to be exact. This list might not prove too sufficient from the point of view of multinational companies in accommodating their interest, as it does not include many countries of growing commercial interest. From this point of view, there is a need to harmonize various privacy and data protection regulations in many countries through the establishment of an internationally congruent legal framework for privacy and data protection. Unfortunately, it will take some effort and time for the establishment, while a fast solution is needed. By considering the Directive thus far the strictest legal framework compared with other existing legal framework on privacy and data protection, obviously, there is a need for countries outside the EU/EEA Member States to improve their legal framework to become compliance with adequate level of protection requirement under the Directive. Since Indonesia is neither a Member State of the EU/EEA nor included in the white list of adequacy finding, the requirement of adequate level of protection is applied to Indonesia as a third country. The trans-border flow of personal data only can take place after the data controller is certain that the protection level of personal data in Indonesia is adequate under the Directive. Apparently, Indonesia is needed to criticize, whether or not its legal framework providing an adequate level of protection. Moreover, Indonesia as a Member State of the Asia-Pacific Economic Cooperation (APEC) has received a pressure to provide a sufficient level of protection on trans-border flow of personal data, in relation to the existence of the APEC Privacy Framework. This pressure has become heavier because of Indonesia position as the Association of South East Asian Nations/ASEAN Member States. Therefore, the main objective of this thesis is to examinehow Indonesia can improve its legal framework to comply with the adequate level of protection in view of Directive 95/46/EC. Conducting this examination is important in determining ways Indonesia might be developed into an attractive destination country for international commerce activities. In order to answer the objective of this thesis, three research questions have to be answered: firstly,currently, why Directive 95/46/EC is being acknowledged as the strictest legal instrument concerning privacy and data protection on conducting trans-border flow of personal data compared with other existing legal instruments. Secondly, how the European Commission determines the adequate level of protection in the third country in question under Directive 95/46/EC. Then, thirdly, to what extent legal framework of data protection in Indonesia measures up to the adequate level of protection in Indonesia under Directive 95/46/EC. In line with the effort to answer the first research question, this thesis will try to identify any possibility for improvement towards the current adequacy finding system. Hence, a balance accommodation might be obtained and maintained between the one who requires the adequate level of protection and the one who has to fulfill it. This thesis will be structured as follows. The first chapter is the introduction in which the objective of this thesis is explained. In the second chapter, there will be a brief comparison between the Directive with other legal instruments concerning privacy and data protection. Afterwards, some explanations on the requirement of the adequate level of protection in the light of the Directive will be provided, including the measurement to be used in conducting the adequacy finding and will explore any possible solution if there is no adequate level of protection in the third country in question. Further, this chapter will cover the current problems within the Directive as well as possible suggestions to overcome them. Thus, answering the first and second research question. In the third chapter, relevant issues surrounding Indonesian legal framework will be discussed, including a brief explanation on how Indonesia regulates privacy and data protection as well as a number of the difficulties experienced in doing so. The findings in the second and third chapters shall be employed to carry out the examination in the fourth chapter, which objective is to answer the third research question. The chapter serves to analyze the adequate level of protection of Indonesian legal framework by applying the measurements in the light of the Directive. The analysis will include various potential problems faced by Indonesia on its effort to improve protection of personal data along with several suggestions on how to overcome them. At the final stage, there will be a conclusion, to what extent Indonesia can be deemed as providing an adequate level of protection. As a result, a solution on how Indonesia might improve its legal framework under the Directive to both avoid a lack of protection and offer an adequate level of protection will be achieved. 2. The EU Legal Framework regarding trans-border flow of Personal Data The trans-border flow of personal data is stipulated by regulations concerning data protection. Since the early eighties, several regulations, drawn up by different organizations, have been published in this respect. The first initiative was performed by Organization for Economic Co-operation and Development (OECD) by establishing the Guidelines on the Protection of Privacy and Trans-border Flows of Personal Data (the OECD Guidelines) in 1980. The intention of the Guidelines is to prevent any conflicts between national laws, which can hamper the free flow of personal data between the OECD Member States. This establishment brought an awareness of the importance protection of the trans-border flow of personal data. A similar purpose with the OECD Guidelines has brought the Member States of the Council of Europe (the CoE) to publish a convention on their interest in the following year. They agreed that it is needed to reconcile the fundamental values of the respect for privacy and the free flow of information between them. The agreement is stated in the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108), with purpose to take into account the right of privacy and the increasing flow across frontiers of personal data in regards of automatic processing, as a way to extend the safeguards for everyones rights and fundamental freedoms. In 1990, by considering the UN has more Member States compared with the OECD and the CoE, Guidelines concerning Computerized Personal Data Files (the UN Guidelines) was established as a way to bring the principles on privacy and data protection being implemented wider among countries. The UN General Assembly through Resolution No. A/RES/45/95 on 14 December 1990, requests the Governments of every Member States to take into account this Guidelines in their legislation. Further, the governmental, intergovernmental, and non-governmental organizations are also requested to respect the Guidelines in carrying out the activities within their field of competence. Nonetheless, the OECD Guidelines, the CETS No. 108, and the UN Guidelines still have some weaknesses. There are some principles of data protection, which are required to be embedded in national laws of each of the Member States but there is no means for ensuring their effective application. For examples, there are no supervisory authority provision in the CETS No. 108 and a lack of procedural clauses in the OECD Guidelines. In another case, concerning the binding power of the instrument, the OECD Guidelines is voluntarily binding to its Member States as well as the UN Guidelines, even though the UN Guidelines has the supervision and sanction provisions. Therefore, Directive 95/46/EC on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data has been established by the European Union (the EU) to overcome the limited effect of the two Guidelines and the Convention as mentioned above. Good level of compliance, support and help to individual data subject, and appropriate redress to the injured parties are the means used by the Directive for ensuring the effective application of the content of the rules. Apart from the compliance issue, the obligations and rights set down in the Directive are built upon the OECD Guidelines, the CETS No. 108, and the UN Guidelines. These three legal instruments contain similar principles, except for lawfulness, fairness, and non-discrimination principles are from the UN Guidelines; and special categories of data and additional safeguards for the data subject principles are from the ECTS No. 108. While the rest of the adopted principles are collection limitation, data quality, purpose specification, use limitation, security safeguard, openness, individual participation, and accountability. Further, the aims of the Directive can be seen from two perspectives. The first one is the economical perspective, in relation to the establishment and functioning of an internal market, in which to ensure the free movement of goods, persons, services, and capital, including the free movement of personal data. The second is from the fundamental rights perspective, in which to set the rules for high-level data protection to ensure the protection of the fundamental rights of the individuals. The newest legal instrument concerning privacy and data protection is the APEC Privacy Framework 2004 (the Framework), established by Asia-Pacific Economic Cooperation (APEC). The purpose of the Framework is to ensure there are no barriers for information flows among the APEC Member Economies by promoting a consistent approach to data protection. There are nine principles in the Framework that are built based on the OECD Guidelines. In brief, the adopted principles are preventing harm, notice, collection limitation, uses of personal information, choice, integrity of personal information, security safeguard, access and correction, and accountability. However, this Framework has the same weakness as the previous legal instruments on privacy and data protection before the Directive, which is the absent of means for ensuring the effective application of the principles. Additionally, it should be noted that APEC is a forum that established based on a voluntary basis, without any constitut ion or legally binding obligations for the Member Economies. Hence, the Framework is not binding to the Member Economies. From the brief analysis above, currently, the Directive posses the highest level of protection compared with other existing legal instruments on privacy and data protection. In this respect, to achieve the objective of this thesis as stated in the first chapter, the research questions will be answered by focusing on the Directive. Therefore, in the next section, there will be an explanation on the legal bases of trans-border flow of personal data to third countries under the Directive, followed by a rationalization on how the European Commission (EC) determines whether or not an adequate level of protection exists in the third country in question. Subsequently, the means for ensuring the effective application of the content of rules will be elaborated upon a description on a series of possibilities if the third country in question is not deemed to provide an adequate level of protection. Although currently, the Directive provides high-level of protection, some problems and suggestions will be provided, as an effort to address input for improvement. The findings in this chapter will be used to carry out the adequacy finding of Indonesia as a third country (in the fourth chapter) by doing a comparison with the findings on Indonesian legal framework in chapter three. 2. The Legal Bases of Trans-border Flows of Personal Data to Third Countries The trans-border flow of personal data to a third country to be acknowledged as lawful, it has to be conducted in accordance with the national data protection law of the EU/EEA Member States. It is applicable to the data controllers established in the EU, both at the time when data is being collected and processed. In general, the law consists of a combination between the obligations of data controllers and the rights of data subject. Before the establishment of the Directive, these rights and obligations were regulated under some national data protection laws with different level of protection. In the light of the functioning of internal market in the EU/EEA, all these obligations and rights, including certain procedures to be applied in case of trans-border flow of personal data to a third country, are regulated in the Directive. Whereas the Directive is legally binding to the EU/EEA Member States, an adequate level of protection is fulfilled and consequently trans-border flow of personal data is able to take place among them. Further, when the personal data is used for electronic communication purposes, then the rights and obligations as lay down in Directive 2002/58/EC shall take place. There are three possible types of transfer under the Directive. The first and second types are a communication of personal data by a data controller based in the EU/EEA Member States to another data controller or to a processor based in a third country. Another possibility type is a communication of personal data by a data subject based in the EU/EEA Member States to a data controller based in a third country. Nevertheless, it should noted that the Directive does not cover transfers of personal data in the course of judicial and police cooperation activities falling within Titles V and VI of the Treaty on European Union. The main regulation in the Directive concerning trans-border flow of personal data to a third country is Article 25. The first paragraph of the Article sets out the principle that the EU/EEA Member States shall allow the transfer of personal data only if the third country in question ensures an adequate level of protection. From this provision, it is necessary to explain further on the subject of the transfer of personal data and an adequate level of protection. First, what the Directive means by the transfer of personal data. Undoubtedly, it is often associated with the act of sending or transmitting personal data from one country to another, for instance by sending paper or electronic documents containing personal data by post or e-mail. By seeing from a different perspective, the situation where one conducts a certain activity with the purpose to make data available for others, besides the owner of the data (the data subject), and located in another country, is included as a trans-border flow of personal data. However, by making data accessible for everyone who connects to internet by uploading any personal data on internet web pages, even though that person is located in another country, is not included in the meaning of transfer of personal data to another country. The reason for the previous statement is this kind of activity is properly acknowledged as publishing activity, not transferring activity. This exception is stated clearly by the Court of Justice in the Bodil Lindqvist Case as there is no transfer of personal data to a third country where an individual in a Member State loads personal data onto an internet page making those data accessible to anyone who connects to the internet, including people in a third country. Subsequently, since the Directive is binding to 27 EU Member States, including three countries (Norway, Liechtenstein, and Iceland), which are bound by the Directive by virtue of the European Economic Area agreement (EEA), personal data can flow freely among them. In other words, there is a free zone among the EU/EEA member states. Therefore, transfer in the light of the Directive has to be seen as transfer of personal data from EU/EEA member states to other countries outside EU/EEA, which are recognized as third countries, and the adequate level of protection in those third countries has to be assessed. There is a so-called white list of countries, which have been assessed by the EC and affirmed to provide an adequate level of protection according to the Directive. Currently, the list consists of seven countries as follows: Argentina, Canada (limited to private sector data), Switzerland, United States (Safe Harbor and specific type of transfer: Passenger Name Record/PNR), the Bailiwick of Guernsey, the Isle of Man, and the Bailiwick of Jersey. The approval of adequacy shall be analyzed more carefully because once a country is listed in the white list, does not automatically mean that personal data can flow to the country freely. One should pay attention whether the affirmation is given for the entire legal framework or only for certain part of it in a specific field, sector (public or private), or regarding a specific type of transfer. Insofar, even though the result of adequacy finding shows that the data protection level in certain countries is not adequate, the EC will not create a black list for that negative finding because of political consequences. Instead of the black list, the EC tends to enter into negotiation with the certain country in order to find a solution. It can be concluded from the foregoing, that the adequacy finding is temporary and subject to be reviewed. Procedure of the Adequacy Finding In acknowledging the adequacy finding, the EC has to follow certain procedure, which has been determined in Article 25 Paragraph (6) of the Directive and is known as comitology. At first, there will be a proposal from the EC, followed by an opinion from Article 29 Working Party and an opinion from Article 31 Management Committee, which needs to be delivered by a qualified majority of member states. Afterwards, the EC submits the proposed finding to the European Parliament (EP), who will examine whether the EC has used its executing powers correctly and comes up with recommendation if necessary. As a final point, the EC then can formally issue the result of the adequacy finding. In the next section, the measurements used by the EC in conducting the finding will be explained in detail. 3. Assessing the Adequate Level of Protection The Article 29 Working Party has given an obvious statement thatany meaningful analysis of adequate protection must comprise the two basic elements: the content of the rules applicable and the means for ensuring their effective application.According to WP 12 of the European Commission (EC), a set of content principles that should be embodied in the existing regulations are the following: Purpose limitation principle: data should be processed for a specific purpose and subsequently used or further communicated only if it is compatible with the purpose of the transfer. Data quality and proportionality principle: data should be accurate and, where necessary, kept up to date. Transparency principle: individuals should be provided with information as to the purpose of the processing, the identity of the data controller in the third country and other necessary information to ensure fairness. Security principle: technical and organizational measures should be taken by the data controller that are appropriate to the risks presented by the processing. Rights of access, rectification and opposition: the data subject have the right to obtain a copy of all data relating to him/her that are processed, to rectification of those data that are shown to be inaccurate, and be able to object to the processing of the data. Restrictions on onwards transfers to non-parties to the contract: further transfers of the personal data by the recipient of the original data transfer only permitted if the second recipient provides an adequate level of protection. In addition to these content principles, another set of the means for ensuring the effective application of the principles, whether judicial or non-judicial, are required in order to fulfill the following objectives: Good level of compliance with the rules: the level of awareness of controllers and data subjects and the existence of effective and dissuasive sanctions are the measurements to examine the compliance level, including direct verification by authorities, auditors, or independent data protection officials. Support and help to individual data subjects: an individual should be able to enforce his/her rights rapidly and effectively without prohibitive cost. Institutional mechanism is needed to conduct independent investigation of complaints. Appropriate redress to the injured parties: where rules are not complied, redress to the injured party with independent adjudication or arbitration is provided, including compensation and sanction impose. Beyond the content principles, some additional principles are still needed to consider when it comes to certain types of processing. Additional safeguards when sensitive categories of data are involved and a right to opt-out when data are processed for direct marketing purposes should be in place. Another principle is the right for the data subject not to be a subject to an automated individual decision that intended to evaluate certain aspects, which can give any legal effects and have a significant effect to the data subject. These content principles, including additional principles, and the means for ensuring their effectiveness should be viewed as a minimum requirement in assessing the adequate level of protection in all cases. However, according to Article 25 Paragraph 2 of the Directive, in some cases, there will be two possibilities. There is a need to add the list with more requirements or to reduce it. To determine whether some requirements need to be added or reduced, the degree of risk that the transfer poses to the data subject becomes an important factor. The Article 29 Working Party has provided a list of categories of transfer, which poses particular risks to privacy, as mentioned below: Transfers involving certain sensitive categories of data as defined by Article 8 of the Directive Transfers which carry the risk of financial loss (e.g., credit card payments over the internet) Transfers carrying a risk to personal safety Transfers made for the purpose of making a decision which significantly affects the individual (e.g., recruitment or promotion decisions, the granting of credit, etc) Transfers which carry a risk of serious embarrassment or tarnishing of an individuals reputation Transfers which may result in specific actions which constitute a significant intrusion into an individuals private life (e.g., unsolicited telephone calls) Repetitive transfers involving massive volumes of data (e.g., transactional data processed over telecommunications networks, the Internet, etc.) Transfers involving the collection of data in a particularly covert or clandestine manner (e.g., internet cookies) To sum up, the circumstances should be taken into account when assessing adequacy in a specific case, being: the nature of the data the purpose and duration of the proposed processing operations the country of origin and the country of final destination the rules of law, both general and sectoral, in force in the country in question the professional rules and the security measures which are complied with in that country. Self -regulation From the circumstances as referred to Article 25 Paragraph 2 of the Directive, it can be seen that the assessments of the adequate level of protection is conducted according to the rules of law as well as the professional rules and the security measures. In other words, it has to be examined from a self-regulation perspective as well. The Article 29 Working Party presents a broad meaning of self-regulation asany set of data protection rules applying to a plurality of the data controllers from the same profession or industry sector, the content of which has been determined primarily by members of the industry or profession concerned.This wide definition offers the possibility to on the one hand a voluntary data protection code developed by a small industry association with only a few members and on the other hand a set of codes of professional ethics with quasi judicial force for a certain profession, such as doctors or bankers. Still, one should bear in mind, to be considered as an appropriate legal instrument to be analyzed, it has to have binding power to its members and has to provide adequate safeguards if the personal data are transferred again to non-member entities. Ob