1 Council Directive 95/46 of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, art. 2(a), 1995 O.J. (L 281) 31 [hereinafter Directive].
2 See id.; Leslie A. Kurtz, The Invisible Becomes Manifest: Information Privacy in a Digital Age, 38 Washburn L.J. 151, 152–53 (1998).
3 See Directive, supra note 1, rec. 4.
4 See Craig Martin, Mailing Lists, Mailboxes, and the Invasion of Privacy: Finding a Contractual Solution to a Transnational Problem, 35 Hous. L. Rev. 801, 802 (1998).
5 See Patrick J. Murray, The Adequacy Standard Under Directive 95/46/EC: Does U.S. Data Protection Meet This Standard?, 21 Fordham Int’l L.J. 932, 933 (1998).
6 See Fred H. Cate, The EU Data Protection Directive, Information Privacy, and the Public Interest, 80 Iowa L. Rev. 431, 431 (1995).
7 See Murray, supra note 5, at 933–34.
8 See Directive, supra note 1, rec. 7.
9 See id. rec. 8.
10 See Murray, supra note 5, at 942.
11 See Directive, supra note 1, rec. 2.
12 See id. art. 12.
13 See id. art. 14.
14 See id. art. 6.
15 See id. art. 22.
16 See Directive, supra note 1, art. 25.
17 Id. art. 32.
18 Id. art. 28.
19 Ulrich U. Wuermeling, Harmonisation of European Union Privacy Law, 14 J. Marshall J. Computer & Info. L. 411, 414 (1996).
20 See Working Party on the Protection of Individuals with Regard to the Processing of Personal Data, Transfers of Personal Data to Third Countries: Applying Articles 25 and 26 of the EU Data Protection Directive, adopted on July 24, 1998, ch. 5, http://europa.eu.int/ comm/dg15/en/media/dataprot/wpdocs/wp12en.htm (last visited Nov. 17, 1999) [hereinafter Transfers].
21 See Directive, supra note 1, arts. 13, 26.
22 See Spiros Simitis, From the Market to the Polis: The EU Directive on the Protection of Personal Data, 80 Iowa L. Rev. 445, 451 (1995).
23 See Directive, supra note 1, rec. 9.
24 See Simitis, supra note 22, at 451 (arguing that political pressures for accommodating existing laws in the Member States pose a threat to a high level of protection).
25 See Directive, supra note 1, rec. 9 (“within the limits of this margin for manoeuvre . . . disparities could arise in the implementation of the Directive”).
26 Id. arts. 3(2), 13.
27 See id. art. 13(2).
28 See Cate, supra note 6, at 437.
29 See Directive, supra note 1, arts. 25, 26.
30 See id. art. 26.
31 Id. art. 3(2).
32 Id. arts. 3(2), 13.
33 See Simon Chalton, The Transposition into UK Law of EU Directive 95/46/EC (the Data Protection Directive), 11 Int’l Rev. of L. Computers & Tech. 25, 26 (1997).
34 See Directive, supra note 1, art. 13.
35 Simitis, supra note 22, at 459; see also Robert M. Gellman, Can Privacy be Regulated Effectively on a National Level? Thoughts on the Possible Need for International Privacy Rules, 41 Vill. L. Rev. 129, 148 (1996).
36 See Simitis, supra note 22, at 460.
37 See Jacqueline Klosek, The Development of International Police Cooperation Within the EU and Between the EU and Third Party States: A Discussion of the Legal Bases of Such Cooperation and the Problems and Promises Resulting Thereof, 14 Am. U. Int’l L. Rev. 599, 645 (1999) (arguing that the Directive provides little practical protection to individuals concerned about police use of personal data).
38 See Simitis, supra note 22, at 460.
39 Id.
40 See id.; Klosek, supra note 37, at 645.
41 See Data Protection Act 1998, 1998 ch. 29, § 29, http:// www.legislation.hmso.gov. uk/acts/acts1998/19980029.htm (Jul. 24, 1998) [hereinafter DPA]; Directive, supra note 1, art. 13(1).
42 DPA, supra note 41, § 29.
43 See id.
44 See id. (providing that personal data processed for the purposes of “preventi[ng] or detecti[ng] a crime” or “apprehen[ding] or prosecuti[ng] . . . offenders” are exempt from the first data protection principle, which provides that “personal data shall be processed fairly and lawfully.”).
45 See id.
46 See Gellman, supra note 35, at 167.
47 See Simitis, supra note 22, at 460.
48 Id.
49 See Directive, supra note 1, art. 13.
50 Alison Classe, Protection Racket, Computer Wkly., June 10, 1999.
51 See Simitis, supra note 22, at 460.
52 See id.
53 See id.
54 See Klosek, supra note 37, at 645.
55 See id.; Simitis, supra note 22, at 460.
56 Directive, supra note 1, art. 13(2).
57 See id.
58 Id.
59 Id.
60 Id.
61 See Simitis, supra note 22, at 457.
62 See id.
63 See id.
64 See Directive, supra note 1, art. 13(2) (emphasis added).
65 See Simitis, supra note 22, at 459.
66 Directive, supra note 1, art. 6(1)(b).
67 See Simitis, supra note 22, at 458.
68 Id.
69 Directive, supra note 1, art. 13(2).
70 See Simitis, supra note 22, at 459.
71 See id.
72 Id.
73 See id.
74 See id. at 457–58.
75 See Simitis, supra note 22, at 457–58.
76 See id. at 458.
77 See id. at 459.
78 Directive, supra note 1, art. 25(1).
79 See Gellman, supra note 35, at 158.
80 Directive, supra note 1, art. 25(2).
81 See id. art. 25(3).
82 Id. art. 25(4).
83 See id.
84 See Gellman, supra note 35, at 158; Paul M. Schwartz, European Data Protection Law and Restrictions on International Data Flows, 80 Iowa L. Rev. 471, 472 (1995).
85 See Murray, supra note 5, at 938.
86 Schwartz, supra note 84, at 471.
87 See Gellman, supra note 35, at 161.
88 Id. at 158.
89 See Directive, supra note 1, art. 26.
90 See Gellman, supra note 35, at 157.
91 Directive, supra note 1, art. 26(c) & (d).
92 Id.
93 See Transfers, supra note 20, ch. 5.
94 See Tim Phillips, Data Protection—A Question of Privacy, Computing, July 8, 1999.
95 See Transfers, supra note 20, ch. 5.
96 Id.
97 See id.
98 See Directive, supra note 1, art. 26(b) & (c).
99 See id. art. 26.
100 See Transfers, supra note 20, ch. 5.
101 See Directive, supra note 1, art. 26(c).
102 See id.
103 See id.
104 See Classe, supra note 50; Phillips, supra note 94.
105 See Tarlo Lyons, Don’t Ignore Data Protection on the Web, Warns Tarlo Lyons, M2 Presswire, July 29, 1999, available in LEXIS, Nexis Library, UK Wire Service Stories; Classe, supra note 50; Phillips, supra note 94.
106 See Transfers, supra note 20, ch. 5 (stating that Article 26(1) exemptions concern cases where public interests override the data subject’s right to privacy).
107 See Simitis, supra note 22, at 458–59.
108 See id. at 459.
109 See Directive, supra note 1, art. 26(2).
110 Id. art. 26(2) (emphasis added).
111 See Murray, supra note 5, at 997.
112 See Directive, supra note 1, art. 26(2).
113 See id.
114 See id.
115 See Murray, supra note 5, at 997.
116 See Classe, supra note 50. (Dr. Simon Murdoch of amazon.com.uk says, “The whole concept of a restriction on information about individuals going outside the EU bothers me.”).