If the US company does not comply with the safe harbor provisions, or if data protection provided by the US company is not adequate, it will be in violation of the provisions under the EU Directive and will be subject to the remedies available under the Directive. Return to Top 3. Failure to comply with the Act in some instances brings not only civil liability but also criminal liability. Directors and officers may also be held personally liable. The Act also requires that in processing the data, the business must put in place suitable policies and procedures to deal with data protection compliance and data security.
Personal data includes both facts and opinions about the individual.
The concerns expressed above regarding European Union offices and strategic partners are equally applicable to the UK because of this Act. Hence, if employee information is collected or processed in the UK, compliance with the more stringent requirements of the Act may be necessary, including obtaining explicit consent from the employee. Return to Top 4. Return to Top 5. This is the first federal law in the United States that governs privacy in cyberspace.