• The Data Protection Directive is a European Union (EU) directive used as the basis for the data protection laws of all EU member states that prohibits the transfer of personal data to countries without “adequate” data protection. While the EU Commission has never officially stated that the United States does not provide “adequate” data protection, it has always been clear that the patchwork of privacy laws in the United States would not meet the Commission’s criteria for adequacy. As a result, the Commission and the US Department of Commerce, shortly after the passage of the Directive, began negotiations to create a program that would allow US companies to overcome the ban and transfer personal information from EU member states to the United States. The result of these negotiations was the Safe Harbor program, which provides a limited “compliance” conclusion to US member companies for the purposes of EU data protection law.