Data Privacy Laws: US vs. EC Differences In the US There are strict laws on the collection and sharing of data about individuals by the government But the laws for corporate data collection and sharing are much looser, except in special cases (e. g., HIPAA) In the European Community (EC), the opposite is true: Governments are freer (but not completely free) to collect data about individuals Corporations must disclose what data they are collecting and what it will be used for. Other uses of that data and most sharing of that data are prohibited This has had an impact on international operations of US companies, which must distinguish between US and EC citizens or take the more stringent EC approach.

Example: Crypto Laws Until recently, the US closely controlled the export of crypto with key length greater than 40 bit except for specified uses (e. g., international banking) Some foreign countries ban or limit the use of crypto. http://www2.epic.org/reports/crypto2000/ provides a dated summary Until 1999, France required all crypto devices and keys used in France to be registered with the government Crypto is so widely used now (e. g., VPNs, SSL), that it is increasingly difficult to regulate. Many people do not even know they are using crypto when they are at a secure web site. Check laws in any country you plan to use crypto in (including crypto devices on laptops)