The 1998 E.U. Data Protection Directive says that personal data can only be transferred to third countries that provide "adequate protection." The existence of a fairly aggressive privacy regime in the European Union creates problems for American multinational firms operating in both markets.

To avoid these potential problems, authorities in the U.S. and Europe have negotiated a "safe harbor" arrangement. Under the safe harbor, U.S. companies can voluntarily adhere to a set of data protection principles recognized by the E.U. as providing adequate protection and thus meeting the requirements of the Directive. Companies can self-certify, or join a privacy seal program like the BBB Online that has been certified as in compliance with the safe harbor agreement.

The U.S. Dept of Commerce manages the list of firms that have joined the "safe harbor." The list is publicly available, kept up to date, and includes firms that have lost safe harbor status.

On an interesting final note, despite more stringent E.U. laws, some studies have found that U.S. websites still provide better privacy protection than their European counterparts.

U.S. Dept. of Commerce Safe Harbor Site

Consumers International Privacy Study

European Commission Data Policy Site

Online Privacy Alliance White Paper on the Safe Harbor Agreement