* What you must do in the U.S. but can't do in France
If you think that you’re having trouble implementing the various parts of the regulatory compliance puzzle, Burton Group Senior Vice President Dan Blum reports in his blog that at the recent RSA Security European Conference he heard that it’s impossible to comply with both the Sarbanes-Oxley Act and French law at the same time.
The major issue, according to Blum, is the SOX requirement that corporations provide an anonymous line for whistleblowers who wish to reveal financial improprieties. While American enterprises dislike whistleblowers, the French people have a cultural aversion to informers, perhaps dating back to World War II and the German occupation. At any rate, French data protection laws outlaw anonymous whistleblower lines, which could be used maliciously to hurt a person’s reputation.
So for American corporations doing business in France, or French corporations doing business in the U.S. (or, for that matter, Brazilian enterprises doing business in both the U.S. and France) there appears to be no way to comply with the laws of one country without violating the laws of the other. According to Blum, McDonald’s and other companies have been fined by the French for creating a SOX-compliant anonymous whistleblower’s line in France.
Blum says: “There are some sneaky workarounds to this problem,” but adds, “I can’t talk about them publicly for fear of ruining their effectiveness.”
There are many laws on the books in many jurisdictions that are simply not enforced, although these usually pertain to things or situations that no longer arise (such as the need to dismount and lead horses through the downtown area of a city!). It can hardly be expected, though, that the French and the Americans – always, it seems, looking for a way to embarrass the other – will simply turn a blind eye to current laws such as Sarbanes-Oxley and the French data protection statutes.
So while you’re beating on your vendors to converge technology standards (such as those from the Liberty Alliance and the Web Services Initiative) give a thought to beating on your legislatures to converge the laws covering technology. The Internet is no respecter of artificial international boundaries.
