As more businesses operate globally than ever before, they increasingly must meet external demands for data from foreign business units and offices as part of investigations or legal actions. Many of these organizations have discovered that complying with such requests can be quite challenging. The cause: a growing array of stringent data-privacy regulations in other countries, especially in the European Union.
For instance, to comply with a U.S. Department of Justice request for e-mail correspondence or documents originating in certain E.U. countries, a company cannot simply gather those documents and bring them to the United States for review and production. Because individual employees’ privacy rights in the European Union are very strong (and quite different from those in the United States), the E.U.-to-U.S. transfer of an employee’s personal data requires a permissible basis.
