Electronic data interchange: The perspectives of private international law and data protection

Abstract

The following considerations deal with the impact of private international law and data protection regulations on electronic data interchange (EDI). The article is based on the example of a German corporation which transfers personal data of employees to a British transferee. These transborder data flows lead to the difficult question of which law has to be applied. It is intended to show that the regulations of the German Data Protection Act (BDSG) have to be applied in this case. A contractual choice of law is invalid because of the mandatory nature of the BDSG. According to the German act, personal data can only be transferred to foreign states with an equivalent legislation on data protection. A comparison between the British and the German regulations shows that the British law is not likely to be equivalent to the German standard. Therefore, it is very doubtful whether personal data are allowed to be transferred from Germany to Great Britain. The transferor and transferee may, however, make some contractual arrangements on data protection (especially on the rights of the data subjects to access and rectification); if the contract has been carefully drafted with respect to this item, a transfer of data may be regarded as lawful. The difficult problems demonstrated in the article show that further developments in EDI may be restricted and prevented by data protection and private international law; the EEC authorities will have to deal with these problems quickly and more effectively before the establishment of the European Single Market in 1993.

Notes

[1] This article is based upon a paper presented at the Third National Conference on Law, Computers and Artificial Intelligence which took place in Aberystwyth (Wales) from 30 March to 1 April 1992.