In the past, new EU laws would have been of concern largely to businesses with European operations, and then only of relevance to the off-shore operations themselves. Things have changed. The new directive purports to apply its rules to any business that receives any personal information from any EU member state. What the Directive Does Most American businesses with an internet or web presence already have encountered privacy standards and regulations. For the most part, domestic electronic privacy laws rest on a mix of industry self-regulation and consumer protection laws, other than in industries such as banking that require special regulatory attention.
European governments see things differently.
The new directive calls for each EU member state to enact a comprehensive set of privacy requirements governing the receipt and use of personal information for any purpose other than purely personal or household activity. The controller shall be responsible for all data processing, and must register with government authorities and notify government authorities before processing data. Maintain data quality and legitimacy . Maintain data security . The directive requires businesses to undertake appropriate technical and organizational measures to protect data against destruction, loss, alteration or unauthorized disclosure or use.