5 December 2000

Managing director
Amazon.co.uk

Dear Mr Frazier

I received yesterday (Tuesday 4 December) a fax transmission of your letter dated 22 November, which had not previously reached me.

Even assuming that the letter was sent on this date, Amazon.co.uk far exceeded the time allowed to respond to my access request of 14 September, placing Amazon.co.uk in breach of UK law. I attach a copy of a letter to the UK Data Protection Commisioner noting this fact.

I do intend to proceed with my request, and plan to assemble the identifying information requested in your letter in the near future. Please confirm by email to me that if I respond with this identifying information, you will provide me with all the data held in databases controlled by Amazon in all countries, and further that upon my future request, all that information will be destroyed within a reasonable period of time. I am concerned by the statement made by Amazon spokeswoman Patty Smith to the Associated Press Monday that deletion is "impractical" because the company "needs records for auditing purposes." ( http://dailynews.yahoo.com/h/ap/20001204/tc/amazon_privacy_1.html ) Please state for the public record that you do not consider complying with this requirement of UK data protection law impractical and that you fully expect being able to comply within the allocated time. If deletion would cause Amazon to violate any accounting requirements, then the public, investors, and financial regulators should know this. If it does not, then I suggest an explanation of Ms Smith's remarks would be in order.

You will note in the attached letter that I have asked the UK Data Protection Commisioner whether her office is, as you indicated to me, "comfortable" with Amazon.co.uk's international transfers of personal data. I will write to you again on this topic after she has responded.

In your letter you repeatedly described the transfers as "limited." In what sense are they limited? Please circumscribe precisely what information is transfered outside the UK and what remains.

Sincerely

Simon Davies
Director
Privacy International