The EC Proposed Data Protection Act

I. Introduction Technological advances have allowed modern society to store, process, and manipulate greater volumes of information than ever before. However, this new ability has also created troublesome social side effects. One such problem is the privacy intrusion on the individual when personal data is used and transmitted by organizations without the permission or knowledge of that individual. Although many countries have passed laws protecting the rights of the individual to private information,(1) if that data is sent to another country that does not possess equivalent protective laws, individuals could nonetheless be subject to potential privacy problems. As a result, many countries have passed laws restricting the flow of personal data across national boundaries.(2) The European Community has found that divergent standards of data protection and transborder data flow restrictions can seriously impede trade in a common unified market.(3) Several of the EC countries have extremely strong data protection laws, while others provide little or no protection at all.(4) This has caused the placement of barriers to the free flow of information among the European countries.(5) In 1992, realizing that harmonization of the various data protection laws would be necessary to create a truly unified market, the European Commission released a proposed EC directive that sought to address this problem.(6) This Note examines the proposed EC directive. Part II reviews the history of European data protection law. Part III discusses the provisions of the proposed directive. Part IV examines its potential effects on United States companies seeking to do business in the EC. Part V proposes a course of action that frames this issue within the international arena. The Note concludes by stressing that an international accord on data protection must be reached, and attempts to allay fears that the proposed directive will unduly impede business transactions for U.S. multinational corporations. II. Background of European Data Protection Laws The origins of the present European data protection laws lie in the efforts of two organizations: the Organization for Economic Cooperation and Development (OECD) and the Council of Europe.(7) Both established influential guidelines for data protection and basic rules on transborder data flow.(8) As early as 1970, the OECD has been concerned about potential effects of privacy protection legislation on transborder data flow.(9) The OECD is an organization of industrialized states spanning several continents, dedicated to promoting the economic development of its member countries.(10) In 1978, the OECD established an intergovernmental group to investigate legal and economic problems that could arise from restricting transborder data flow, and to establish guidelines for the basic rules of data protection legislation.(11) In 1980, the OECD issued voluntary guidelines for the protection of personal data and transborder data flows.(12) It was hoped that these guidelines would influence the member countries to harmonize their national legislation.(13) The OECD Guidelines stressed the importance of the free flow of information to economic development, and encouraged the removal of unjustified obstacles to international data movement.(14) The document suggested certain principles to be used in creating these laws, including the collection limitation principles, the data quality principle, the purpose specification principle, the use limitation principle, the security safeguards principles, the openness principle, the individual participation principle, and the accountability principle.(15) As early as 1968, the Council of Europe had also started a program to study potential courses for data protection legislation.(16) The Council consists of European countries whose aim is to promote European unity and cooperation, with a special emphasis on human rights. …