International Data Protection Legislation -
United States Department of Commerce

Requires express consent for sensitive information.

Data subjects have right to access, correct, block, or update data.

Law enforced by national data protection commissioner (http://www.jus.gov.ar/minjus/DPDP/).

Complaints may be brought before judicial system.

Provides "adequacy" standards for data flows outside of Argentina.

The European Union has determined that Argentina’s law meets the EU’s "adequacy" standard.

Establishes "co-regulatory" scheme which allows the use of business-generated codes of conduct that have been approved by national Privacy Commissioner (http://privacy.gov.au).

Complaints may be brought to/by Privacy Commissioner.

Law operates extra-territorially, covering organizations outside Australia in situations where data is moved overseas for use or processing.

Handling of sensitive data would be prohibited in most circumstances.

Personal information is defined as data relating to natural persons, legal entities, and even government personnel and agencies.

Opt-in consent required for sensitive data.

Received "Royal Assent" in April 2000.

Businesses must obtain minimum of opt-out consent from data subjects in order to collect, use or disclose personal information.

Privacy Commissioner’s Office (http://www.privcom.gc.ca) has broad powers to ensure compliance.

Law will apply to all inter-provincial and international transactions by January 2004.

Establishes rights to access, correction and judicial control of personal data.

Addresses financial, commercial and banking data.

Only databases in the country must be registered.

Law does not establish a data protection enforcement body.

Political parties, churches and some civic organizations exempted from law.

Supplemental "Databases Act" passed in April 1997.

Several subsequent amendments to these acts.

Processors must register the processing of sensitive data.

Sets out general principles for maintenance of databases and requirements for data processing.

Laws enforced by Data Protection Inspectorate (http://www.dp.gov.ee/?lang=en)

Directive effective/implementation begun in 1998.

Supplemented by Directive for Protection of Privacy in Telecommunications Sector (1997); regulations for data processing (2000); and Directive on Privacy and Electronic Communications (2002).

The scope of the Directive is very broad. It applies to all processing of data, on-line and off-line, manual as well as automatic, and all organizations holding personal data. It excludes from its reach only data used "in the course of purely personal or household activity".

Establishes requirements for notice, consent, accuracy, security and access.

Establishes strict guidelines for the processing of personal information. "Processing" includes any operations involving personal information, except perhaps its mere transmission.

"Sensitive" data, such as that pertaining to racial or ethnic origins, political or religious beliefs, or health or sex life, may not be processed at all unless such processing comes within limited exceptions, for example if the individual gives explicit consent.

Mandates a government authority to oversee data processing activities. Each Member State must establish an independent public authority to supervise the protection of personal data.

Implements the EU Directive on Data Protection.

All "Länder" (except Sachsen and Bremen) have adopted laws to implement the Directive. These acts apply to the public sector of the respective "Länder".

Law enforced by the Federal Data Protection Commissioner (http://www.bfd.bund.de/information/engl_corner.html)

Data subjects provided right to access, correct or erase personal information.

Establishes complaint procedures and allows compensation for damages suffered.

Applies to both the public and private sectors.

The law expressly prohibits the use of all purpose identification numbers or codes.

Enforcement occurs via the Parliamentary Commissioner for Data Protection and Freedom of Information (http://www.obh.hu/adatved/indexek/index.htm)

Law covers both automated and manual processing of personal information.

Restricts use of national identification numbers, video surveillance technology.

Enforcement occurs via the Privacy & Data Protection Authority (http://www.personuvernd.is/tolvunefnd.nsf/pages/english)

Data Protection Amendment Bill (pursuant to EU Data Protection Directive) (Bill summarized at http://www.dataprivacy.ie/3bii.htm)

Certain regulations to implement EU Data Protection Directive passed in December 2001.

Data Protection Amendment Bill passed by Irish Senate in 2001 and passed by House of Representatives in 2003.

Law enforced by the Data Protection Commissioner (http://www.dataprivacy.ie/)

Imposes limitations on data controllers/processors concerning use of information (11 activities prohibited by law).

Data subjects have right to inspect, correct and erase information.

Enforcement occurs via the Italian Data Protection Commission (http://astra.garanteprivacy.it/garante/frontdoor/1,1003,,00.html?LANG=2)

News organizations, research institutions, religious groups, political organizations and "writers" are exempt from the law.

It is unclear how enforcement of the law will be handled, may be clarified in the implementation guidelines.

Personal data can only be disclosed to a third party under an approved personal contract.

Enforcement occurs via Commission nationale pour
la protection des données (http://www.cnpd.lu/)

Early drafts of the bill had a trans-border provision that would require other regimes to be "substantially similar"; or "serve the same purpose"; or provide an "adequate" level of protection.

Data Protection Commissioner would enforce the law.

Passed by Mexican Senate and forwarded to House of Representatives in April 2002.

Bill currently under review at the committee level in the House of Representatives.

Most recent (September 2002) draft of bill narrows the scope of the legislation to data involving natural persons.

"[A]ll gathering and processing of data require the prior consent of each person involved."

Defines "sensitive data" to include "all data that reveal the racial or ethnic origin; political opinions; religious, philosophical or moral beliefs; labor union membership; health or sex life of a person".

Requires all data to be stored "so as to enable the right of access to be exercised by each interested person involved".

Trans-border data provision imposes an "equivalency" standard for data protection regimes in other countries; would presumably prohibit transfers to nations that do not exactly match the requirements set forth by the draft bill.

Sets forth broad registration and reporting requirements.

Law would be enforced by the Federal Institute for the Protection of Personal Data.

Entered into force in September 2001.

Establishes 12 privacy principles roughly equivalent to those set forth in the EU Directive on Data Protection.

Approved industry codes of conduct may be adhered to in lieu of legislation.

Applies to both public and private sectors.

Trans-border provision prohibits transfer of personal data to another country without the permission of The Data Inspectorate (http://www.datatilsynet.no/), the agency that enforces the law.

Personal data cannot be transferred to another country that has less protection than that provided by the EU Directive on Data Protection..

Entered into force in April 1998.

Regulations passed in 1998.

Applies to both public and private sectors.

Regulations establish standards for the security of information systems.

Data subjects have substantial rights to access, amend, correct and/or delete data.

Enforcement of law handled by the Inspector General for the Protection of Personal Data (http://www.giodo.gov.pl/English/english.htm)

Establishes requirements for the processing of personal information.

Prohibits misuse of personal information; prohibits use of sensitive information.

No agencies have been established to enforce the law.

The public consultation has since closed in May 2002.

In December 2002, the NTC launched an enhanced version of the Model Data Protection Code.

Draft provisions apply to "the processing of personal data wholly or partly by automatic means".

Companies would be required to provide a list of organizations "to which it may have disclosed data about the individual".

Processing of certain sensitive information is prohibited.

Imposes an "adequacy" standard for transfers of data to other countries.

Enforcement of law handled by the Inspection Unit for the Protection of Personal Data (http://www.dataprotection.gov.sk/buxus/generate_page.php3?page_id=1)

Enforcement occurs via Human Rights Ombudsman (http://www.varuh-rs.si/cgi/teksti-eng.cgi/Index?vsebina)

Applies only to electronic data transmissions.

A data controller may "voluntarily " subscribe to the principles by recording the principles in a written agreement.

Requires opt-in consent from data subject prior to collecting/transferring any personal data.

It is not clear how the requirements of the law are to be enforced.

Issue paper favors approach taken by EU Data Directive. The issue paper will be followed by a discussion paper containing draft legislation and a report with the Commission’s final recommendations and proposed legislative proposals.

Law applies to "providers of information and communications services" and certain offline services, namely travel services.

In most cases, opt-out consent from data subject required. However, exceptions apply. Opt-in consent required for certain sensitive information.

Enforcement is complaint-driven and occurs via judicial system and Personal Information Mediation Committee.

Strengthens the protection of private information related to the use of Internet and tightens regulatory control with respect to unwanted electronic mail on a nationwide basis. Includes consumer consent requirement to transfer individual information overseas.

Entered into force in 2000.

In 1999, the Swiss law received "adequacy" from the EU.

Trans-border data provision requires data controllers to register transfers of data to other countries. Requires that other countries have equivalent laws.

Regulates the "computerized processing of personal data",

In order to collect or process personal information, a data controller must either obtain written consent from the data subject; have a contractual relationship with the data subject; determine that the data is already within the public domain; or determine that the data is for academic research.

Entered into force in 2000.