Determining applicable law pursuant to European data protection legislation

In this paper, an examination is made of rules determining applicable law pursuant to European data protection legislation. The main point of departure for analysis is Art. 4 of the 1995 EC Directive on data protection.2 The provisions of Art. 4 constitute the first and only set of rules in an international data protection instrument to deal specifically with the determination of applicable law. These rules will become the norm for the data protection legislation of countries within the EU and EEA, and possibly also for the equivalent laws of other States. Somewhat surprisingly, the provisions in Art. 4 have so far been subjected to little academic analysis. Yet, as shown in this paper, these provisions could have a significant impact on the activities of E-commerce operators, including those operators established outside the EU/EEA.