EU Data Protection Directive: A Thorn in the Side of the US Domestic Online Retailer

Abstract

Companies outside the European Union are sometimes confronted with having to comply with European legislation around data protection. This is especially the case in the event they make use of a Europe-based service provider. This does not only raise concern for said companies, it also potentially damages the business of European service providers in acquiring new businesses outside the EU. This paper discusses the particular issues arising out of a US based retailer making use of a European payment service provider in particular for the execution of its online payments. The European data protection directive did not anticipate on the effects of its broad interpretation of ‘making use of equipment situated in the European Union’, which leads to applicability of the law. The principles behind the directive are challenged and a solution is proposed to prevent situations where a non-European based retailer processing payments from non-European consumers via a European PSP has to comply with European data protection requirements.