Implications of the new EU Directive on data protection for multinational corporations

The 1995 EU Directive on data protection legislation (DPL) ensures free flow of data within the EU. However, the transfer to countries without adequate DPL is generally forbidden. The effect of this Directive on the business of MNCs is still unknown but a few authors foresee major problems for MNCs doing business in Europe. On the eve of the implementation of the new EU data protection directive this preliminary study investigated some of the effects the new DPL Directive might have on MNCs doing business in Europe as seen by representatives of European and US MNCs. The study found that especially those companies transferring customer data across national boundaries are most affected by strict DPL. However, the effects mentioned by interviewees were, in contrast with popular literature on this topic, not exclusively negative. Several positive effects of strict privacy guidelines for MNCs could also be identified. Introduction The concept of privacy is a central tenet of the democratic society. Individuals and organizations have long debated and are still debating the definition of privacy, and the potential use and abuse of personal, name-linked data. With the rapid computerization of our society and the impending onset of the information age, the debate about the access to personal information has taken on a hurried urgency (The Economist, 1993, 1996, 1999a). Over the last 20 years, governments, primarily European, have taken the lead in legislating on the use of personal data, issuing a variety of guidelines and directives. While there are many contributing factors, the main motivation for data protection legislation (DPL) is the socio-economic component of a society's culture (Walczuch et al., 1995). Since the cultural values vary with countries, no universal guidelines have been established for data protection. At this point the dual nature of this issue should be stressed. On the one hand, it is concerned with the right of privacy of individuals. On the other hand, data protection negatively affects companies in their right to full disclosure and free flow of information. In the age of expanding multinational corporations (MNCs) supported by global information systems, transborder data flow (TBDF) transfer has become ubiquitous. The lack of clear and internationally well accepted guidelines poses a real challenge to MNCs doing business in countries with strict DPL, for they often have to conform with a multitude of conflicting national DPL. Some The current issue and full text archive of this journal is available at http://www.emerald-library.com/ft The authors would like to thank the reviewers of this paper for their valuable comments. The paper has been much improved due to their suggestions. D ow nl oa de d by W E IZ M A N N I N ST IT U T E O F SC IE N C E A t 0 3: 59 3 0 Ju ne 2 01 6 (P T ) EU Directive on data protection 143 countries with a high level of DPL even interdict the transfer of protected data to countries with an inadequate level of protection. In 1995 the European Union (EU) passed a DPL Directive, which had to be implemented by all EU member states by October 1998 (EU, 1995). This Directive ensures the free flow of all data within the EU. However, the transfer to countries without adequate DPL is generally forbidden. The effect of this Directive on the business of MNCs is still unknown but a few authors foresee major problems for MNCs doing business in Europe. Most of the past research to address this issue has been based on analysis of the existing legislation. This research has lacked empirical rigor. An explaining argument could be the fact that the DPL are only in force for one year. However, data protection has been practiced in a very similar manner for about 20 years in a few of the EU countries. Therefore, this paper attempts to bring research on the issue of data protection one step further. It reports the findings of an exploratory investigation on the effect of the European DPL Directive on MNCs doing business in Europe. The report will first shortly discuss the contents of the EU Directive. Furthermore previous literature on the potential effect of the Directive on MNCs will be summarized and research questions are formulated. The core of this paper consists of the results of a field study on the effect of European DPL on 23 MNCs doing business in Europe and in the USA. A discussion of the implication of DPL for MNCs and policy makers will close the paper. Background DPL is a typically European phenomenon. Table I shows all countries, which had adopted or were planning to adopt DPL by 1998. Outside of Europe only a handful of countries have even considered DPL: Australia, Canada, Hong Kong, Israel, New Zealand, Singapore, South Korea and the USA. Many of these countries have a strong European heritage. In addition, a study of the European Commission reviews six of the above mentioned countries by means of five categories: human resource data, sensitive data in airline reservations, medical/epidemiological data, data in electronic commerce, and subcontracted data procession. The study concludes that the degree of data protection in these countries varies notably (Raab et al., 1998). However, among countries with DPL there exist large differences in the strictness and level of data protection. For example, `̀ privacy rights in the USA are anything but ordered, with some issues protected by federal statute, some covered by individual states, and some left to industry self-regulation'' (Kane, 1998a). So far in the USA privacy issues involving customer data have largely been left up to industry self-regulation (Schatz, 1998). On the other hand, the German DPL can be described as one of the strictest in the world with all aspects regulated and enforced by federal government. A possible explanation for these differences is major cultural differences between national cultures within Europe and worldwide (Walczuch et al., 1995). D ow nl oa de d by W E IZ M A N N I N ST IT U T E O F SC IE N C E A t 0 3: 59 3 0 Ju ne 2 01 6 (P T )