Employers With International Operations Must Take Care To Protect Employee Data

When is the last time your company reviewed its data protection policies? If your company employs any international employees, it may have obligations under foreign laws to have specific safeguards in place. Failure to observe a jurisdiction's data protection laws can result in staff penalties and unwelcome press coverage. Although the European Union is leading the way with a proposed comprehensive new data protection law, other countries from China to the United Kingdom, South Africa, Qatar, Dubai, and several Latin American countries are developing, or have already enacted, their own data protection laws, with many based on the European model. The European Union On May 31, the European Union released proposed regulations to strengthen data protection in the EU, which propose to strengthen the 1995 Data Protection Directive. Among other recommendations, the Proposal for Regulation of the European Parliament and the Council on the Protection of Individuals with Regard to Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation) provides for the right of individuals to be "forgotten" and not be profiled based on their personal data and also governs the transfer of information regarding EU citizens outside of the EU. The pending bill also proposed the creation of a data protection authority to assist with enforcement of the new regulations. Although the regulations have not yet been enacted, it is expected the final version will be ambitious in scope and among the most comprehensive in the world. It would be prudent for any multinational employer with European operations, customers or employees to consider the proposed regulations when drafting data protection policies. South Africa, Qatar and Dubai are considering adopting similar measures, using the EU proposal as a template for their own regulations. China An American multinational company made news earlier this year when its offices in The People's Republic of China were raided and the company was criminally charged for improperly collecting personal data from individuals and selling or disclosing that data to third parties. Although there is no single, unified data protection law in the PRC, there are a number of national and provincial laws covering data protection. In 2008, the Regulation on Employment Service and Management was implemented nationally, and requires employers to keep personal employee data confidential, and specifically...