The 1995 Data Protection Directive placed a very controversial requirement on the governments of European Union (EU) member states: to ban the transfer of personal data to any country outside the European Economic Area – the 15 EU member states, plus Iceland, Liechtenstein and Norway – unless that third country ensures an adequate level of privacy protection.
Implementing this provision, while promoting a truly borderless economy, has posed a real challenge for all EU governments. In the UK, the requirement was incorporated as Principle 8 of the Data Protection Act 1998 and similar provisions have been incorporated in most European data protection laws, prompting international concern about the future of global operations involving flows of personal data.
