Since all EU states will have equivalent laws there is, of course, no difficulty about processing information in any EU country. To find out which countries are approved, you will have to check with the data protection commissioner in the country from which you wish to export information. If the country is not on the approved list, the controller can apply for a specific approval for the receiving organization. That organization will have to be able to convince the commissioner that their security provisions and controls are equivalent to those required in the EU and that they accept the same liabilities as if they were domiciled in an EU member state. If a non-EU organization wishes to offer processing of EU personal data, it will have to provide an EU branch with a declared controller.
European Directives come into force three years after they are published.
That means all the requirements listed above take effect in October 1998 for computerized records. Equivalent controls over paper records come in three years later and must be fully implemented three years after that. It also means that from October 1998 it will not be possible to export personal data outside the EU without complying with the Directive. At the time of writing, the US has not been recognized as offering an equivalent level of protection. The short-term impact of that change is that medical groups processing European information outside the EU may find they are unable to do so, and if they do so may be faced with litigation both from the EU commissioners and individual EU citizens.