Multi-national organizations doing business in Europe must know and understand not only their obligations to protect personally identifiable information (PII) under the European Union (EU) Data Protection Directive 95/45/EC, but they must also know and understand the data protection laws within each of the EU member countries.
Did you know that there are now 27 EU member countries? I was recently speaking with a couple of lawyers from some multi-national financial organizations and they did not.
Do not assume your lawyers have all the current information; this woud be a good conversation starter for information security and privacy leaders in communicating with their legal counsel.
In case you haven’t kept up with the countries that are a part of the EU, here is a very brief history of the member countries:
* 1957: 6 original members (initially called the European Economic Community) – France, Germany, Italy, Belgium, Netherlands, Luxembourg
* 1973: 9 members- France, Germany, Italy, Belgium, Netherlands, Luxembourg, Denmark, Ireland, United Kingdom
* 1981: 10 members – France, Germany, Italy, Belgium, Netherlands, Luxembourg, Denmark, Ireland, United Kingdom, Greece
* 1986: 12 members – France, Germany, Italy, Belgium, Netherlands, Luxembourg, Denmark, Ireland, United Kingdom, Greece, Portugal, Spain
* 1995: 15 members – France, Germany, Italy, Belgium, Netherlands, Luxembourg, Denmark, Ireland, United Kingdom, Greece, Portugal, Spain, Austria, Finland, Sweden
* 2004: 25 members – France, Germany, Italy, Belgium, Netherlands, Luxembourg, Denmark, Ireland, United Kingdom, Greece, Portugal, Spain, Austria, Finland, Sweden, Cyprus, Czech Republic Estonia, Hungary, Latvia, Lithuania, Malta, Poland, Slovakia, Slovenia
* 2007: 27 members – France, Germany, Italy, Belgium, Netherlands, Luxembourg, Denmark, Ireland, United Kingdom, Greece, Portugal, Spain, Austria, Finland, Sweden, Cyprus, Czech Republic Estonia, Hungary, Latvia, Lithuania, Malta, Poland, Slovakia, Slovenia, Bulgaria, Romania
Currently Croatia and Turkey are in accession negotiations.
A candidate country is the Former Yugoslav Republic of Macedonia.
Potential candidate countries are Albania, Bosnia-Herzegovina, Montenegro and Serbia.
If you are a multi-national organization with customers, consumers or offices in these countries be sure you know their data protection (privacy) laws and regulations.
Here is a good site for you to bookmark to keep up with the EU member status.
Tags: awareness and training, data protection law, EU Data Protection Directive, European Union, Information Security, IT compliance, policies and procedures, privacy, privacy law, risk management