1
INTRODUCTION
After fifteen years of debate, the European Union
1
in 1995 adopted a directive
designed to address data privacy concerns.
2
The stated goal of the directive was two fold.
First, data protection legislation at the EU level hoped to harmonize standards in order to
permit the free flow of information within the Union. Second, the directive called for a high
level of protection, signaling the EU’s commitment to individual data privacy rights.
3
To
reach these aims, all member states were required to pass comprehensive data protection
legislation for the public and private sectors, establish an independent control institution, and
regulate the transfer of personal data to third countries.
4
For four European nations
including Greece, Italy, Portugal, and Spain this meant the creation of a new branch of
regulatory authority, for others it required substantial reform of their data protection systems.
Though the directive succeeded in raising data protection standards across the
European Union, it has brought several unanticipated consequences. Most importantly,
rather than harmonizing implementation and enforcement efforts, Europe now confronts a
variety of national data protection systems. Companies across European member states face
different regulatory environments in which the specific application of rules governing
individual consent, notification, and the processing of sensitive information may vary. These
1
During the debate over the directive the political entity known as the European Community changed its
name to the European Union. I have attempted in the empirical narrative to parallel this change. I
apologize for any confusion.
2
Data privacy deals with an individual’s ability to control the use and exchange of personal information
held by organizations. A regulation that empowers an individuals to prevent banks from sharing financial
information with other companies is a typical data privacy rule.
3
The Directive on the protection of individuals with regard to the processing of personal data and on the
free movement of such data. Counter to standard harmonization arguments, the European Commission and
international business have often argued that the first goal should be prioritized while national data
protection officials stress the second. National data protection officials are almost exclusively independent
regulatory agencies that enjoy considerable regulatory authority. See Recital 8 and 9 of the directive.
Council of the European Union and the Parliament 95/46/EC, 1995 O.J. (L 281) 31.
4
Council of the European Union and the Parliament 95/46/EC, 1995 O.J. (L 281) 31. Personal data is
defined as any information relating to an identified or identifiable natural person ('data subject'); an
identifiable person is one who can be identified, directly or indirectly, in particular by reference to an
Convention