§ Mrs. DunwoodyTo ask the Parliamentary Secretary, Department for Constitutional Affairs what data protection safeguards are available to UK citizens whose detailed private information is made available to private companies in the US. [168250]
§ Mr. LammyThe general rule established by the Data Protection Act 1998 is that, subject to exemptions, personal data may only be transferred to countries outside the European Economic Area if they provide an adequate level of data protection. Adequacy of protection is determined on a case by case basis having regard to all the circumstances. The US Department of Commerce have established a set of data protection rules (generally known as the "safe harbour") to which certain organisations receiving personal data from the EU may subscribe. The European Commission have made a formal finding that the "safe harbour" provides adequate data protection for the purposes of the EC Data Protection Directive (95/46/EC) to which the Data Protection Act 1998 gives effect. About 450 organisations currently subscribe to the "safe harbour".