This brings up the subject of consent. Every time that personal data is exported from the EU to a third country such as the U.S., the employee concerned has to give his or her consent to the transfer, having been informed as to the reason why that information is being transferred. The rules are especially strict concerning sensitive personal data. It should be recognized, for instance, that a photograph will almost certainly convey information about racial and ethnic background. The problems do not just arise with expertise databases.
Some intranets have an internal staff newsletter.
In the interests of good communication, there might be a news story about how a member of staff had been ill, but was now coming back to work for a few days a week. This is almost certainly sensitive personal data, as it relates to the health of the person, and this should not then be circulated electronically without the permission of the person concerned. Furthermore, many Web sites contain information about employees, especially in consulting companies, and since these sites can be accessed from virtually any country in the world, then the consent of the individual to the information being posted on the site needs to be obtained. The solution to the problems caused by the differences of approach between the EU and most other countries may be to create codes of conduct for industry sectors that are written and implemented in a consistent way, and subject to legal remedies for non-compliance. The responsibility within the EU for the implementation of the Directive is in the hands of Directorate General XV, and it has set out the basic principles of what such a code should contain.