Proposed Amendment To EU Privacy Regulations May Force Choice Between Violating US And EU Law

On Monday, October 21, 2013, the European Parliament's Committee on Civil Liberties, Justice and Home Affairs (LIBE) voted to approve an amended version of the proposed EU General Data Protection Regulations.  Included in the compromise package is Article 43a, a provision that restricts controllers or processors of EU data from disclosing that data to third-country administrative or judicial authorities. Under proposed Article 43a, if a third-country authority asks a company to disclose EU data, that company must seek permission from the relevant European national data protection authority and inform the data subject of the disclosure.

If ultimately enacted, this requirement could leave many U.S. businesses, which hold data of EU nationals, facing a very difficult choice: (1) violate U.S. law by not complying with a demand from US law enforcement authorities; or (2) violate EU law and face stiff penalties (increased under Article 79 of the most recent proposed