Huge amounts of personal data are circulating daily around the
world. The European data protection rules provide specific
requirements for the transfer of personal data outside of the EU
and notably to the U.S. Therefore, U.S. companies importing
personal data from Europe need to identify and carefully analyze
the personal data flows involved and, where necessary, put in place
the safeguards or obtain the authorizations allowing them to
transfer personal data out of Europe in compliance.
I. WHAT ARE THE CATEGORIES OF DATA
COVERED?
Under the Data Protection Directive 95/46/EC (DPD), personal
data is a broad concept. It includes not only sensitive data (data
revealing notably ethnic origin, philosophical beliefs, health
status, sex orientation) but also any information relating to an
identified or identifiable natural person. This may include email
addresses, Social Security numbers, bank accounts, professional
assessments, fingerprints, etc.
