EU: EC considers data protection

A DGXV working document entitled “Judging Self-Regulation: When does it make a meaningful contribution to the level of data protection in a third country” has been circulated to interested parties. The document proceeds from Article 25(2) of the data protection directive which requires the level of protection afforded by a third country to be assessed in the light of all the circumstances surrounding a data transfer operation or set of operations. Specific reference is made not only to statutory law but also to “professional rules and security measures which are complied with in that country”. This is precisely the context created by self-regulatory rules. The document makes a harsh assessment of what it considers to be the minimum conditions for effective self-regulation in this area. The UK Advertising Association considers that the document could easily be taken as a model for a similar assessment of self-regulation in other areas of commercial communications. The document is available from the Advertising Information Group.