For the musically inclined, think of the new EU General Data
Protection Regulation (GDPR) as "theme and variations." The
principles and terminology are standard across Europe, but there
are many instances where the application will vary to some extent
from country to country. An example of non-standardization is the
varying national age limit, from 13 to 16, beyond which parental
consent is required to collect information about children. Another
is the entire field of HR privacy (!), as each EU country is
largely free to specify how the general principles of the GDPR will
be applied in the employment context.
Such diversity has historically been a challenge for
multinationals and online businesses operating in European markets.
The GDPR should indeed produce more "harmonization,"
compared to the 1995 EU Data Protection Directive, but there will
still be variations after GDPR enforcement begins in May. This
article highlights areas where national differences matter, as
