Know Before Your Data Goes
Organizations need to understand their privacy and security compliance obligations prior to sending data across borders. In today's global operating environment, that is no simple task. Consider that nearly 50 countries have some form of data protection law and many of them conflict or require specific security measures. Other countries have no privacy laws at all.
In the U.S., more than 30 states have enacted security breach notification laws, and several similar laws are pending at the federal level. The European Union's (EU) Data Protection Directive (DP Directive) governs the privacy of personally identifiable information (PII) in its 27 member countries, and it has influenced the development of similar legislation in other countries. In addition, the DP Directive restricts cross-border data flows, requires the registration of databases, and establishes privacy supervisory authorities in every member country.
Looking broadly across the various privacy laws around the globe, there are essentially three types of legal frameworks at play: the EU's regulatory model, the U.S.'s self-regulatory approach, and a hybrid approach set forth in the Asia-Pacific Economic Cooperation (APEC) forum's Privacy Framework.
