Survey of National Data Protection Legislation

Abstract

Since 1973 eight countries have enacted and two formally proposed data protection legislation. The Council of Europe has begun the drafting of a convention. Scope. The draft convention refers to the automatic processing of personal data in both the public and the private sectors. Over half the Acts and Bills apply to manual as well as automatic systems; under half to data about legal as well as natural persons. Only the US and Canadian Acts do not apply to the private sector. Principles. The draft convention would require each state to implement the principles that data banks should be publicly known; accessible to data subjects; fairly collated; accurate up-to-date and relevant; exclusive of data relating to race, philosophy, religion, politics or trade union views; and secure against accidental or deliberate access, alteration or release. Most of the legislation embodies most of these principles, albeit enforced more strickly in some cases than others. Most of the legislation additionally regulates the communication of data to third parties. Methods of regulation. Data users are subjected to a licensing, regulatory or investigate authority. The US Act alone does not establish a data protection agency, but relies on the data subject to enforce legal rights by civil suit. Transborder data flows. Most of the countries regulate the flow of data across their borders; some provide for cooperation with foreign data protection authorities. Only the US and Canadian Acts exclude foreign data subjects from the scope of their protection.