3.1: Introduction

Learning Objectives

• Understand which countries are in the EU.
• Understand which countries are in the European Economic Area (EEA).

Scope/Applicability

At a high level, this Regulation applies to companies doing business with people in the EU, including organizations that collect information about, or processes data about, people within the EU as well as the European Economic Area (EEA).

It is important to note that the constituency of the member states of the EU changes. From the time the GDPR case study was first used for CIS 79 in the fall of 2020, the United Kingdom (UK) exited from the EU (Brexit). After exiting the EU, the UK did put in place an equivalent UK GDPR, which has its own, separate compliance rules and regulatory authority, the Information Commisioner's Office (the UK ICO).

The 27 countries in the EU as of the writing of this textbook include (according to EU countries | European Union):

1. Austria
2. Belgium
3. Bulgaria
4. Croatia
5. Cyprus
6. Czechia (Czech Republic)
7. Denmark
8. Estonia
9. Finland
10. France
11. Germany
12. Greece
13. Hungary
14. Ireland
15. Italy
16. Latvia
17. Lithuania
18. Luxembourg
19. Malta
20. Netherlands
21. Poland
22. Portugal
23. Romania
24. Slovakia
25. Slovenia
26. Spain
27. Sweden

Additionally, other countries are trying to join the EU. As of the writing of this textbook, current candidates include: Albania, Bosnia and Herzegovina, Georgia, Moldova, Montenegro, North Macedonia, Serbia, Turkey, and Ukraine. Any implementation of the GDPR would need to track developments in the entry or exit of member states.

What is the European Economic Area (EEA)?

The EEA essentially extends the EU single market and ensures that all members are abiding by EU laws. The EEA includes all of the EU countries mentioned above plus the following three countries:

1. Iceland
2. Liechtenstein
3. Norway

Short History of EU Privacy Initiatives

We will briefly look at the following data protection initiatives:

• EU Data Protection Directive (95/46/EC)
• General Data Protection Regulation (2016/679).

EU Data Protection Directive (DPD)

The EU Data Protection Directive (DPD) was enacted on October 24, 1995 and went into force on December 13, 1995. It was a major initial step in regulating the processing of personal data associated with an identifiable person (the legal term used is "data subject"). The responsibility for ensuring compliance is with the "controller", the entity that determines how the data will be processed. As with the GDPR which later replaced the DPD, if a controller was outside the EU but processed data in the EU, they were subject to the DPD.

Three key principles applied:

1. Transparency (the user must be told when the user's data is going to be processed). This assumed that the user provided consent or that the data needed to be processed due to legal obligation or for the public good.
2. Legitimate Purpose (the user's data could be processed for specific legitimate purposes).
3. Proportionality (deals with concepts such as data retention for only as long as needed to process the data that was collected for a specific purpose).

These principles persisted into later EU data protection law.

GDPR

GDPR was adopted on April 14, 2016 and went into effect (binding, enforceable) on May 25, 2018. As an EU Regulation, the GDPR is consistently applied in EU member countries. By its enactment, it essentially superseded/repealed the Data Protection Directive. It is a Regulation on data protection and privacy in the European Union and European Economic Area. The GDPR is a law, not a “minimum requirement”. An EU regulation has more force than a directive (which is why the GDPR is stronger than its predecessor, the DPD).

The GDPR applies to any entity processing personal information of “data subjects” inside the EU/EEA (regardless of a company’s location or data subject’s citizenship/residence). One of its objectives is to provide users (e.g, Internet users) more input and control over how their data is used. The GDPR lays down binding guidelines upon companies regarding how user data is collected, stored, transferred, and used. The GDPR applies both to “data controllers” (such as organizations that collect information for various purposes) and “processors” of that data. The GDPR's scope includes international companies and organizations with data processing centers in the EU.

EU Data Act

The EU Data Act is a relatively new EU regulation that went into effect September 12, 2025. It requires that users be granted access to their data, and by September 12, 2026, it requires that products in the EU need to provide direct access to a user's data. This will not be discussed any further in this case study.

Note

In the US, there have been similar privacy initiatives such as the 2018 California Consumer Privacy Act (CCPA, as amended by the California Privacy Rights Act of 2020), but these US state information privacy laws are not the subject of this case study. As of this writing, there is no single comprehensive federal privacy law in the United States comparable to the GDPR, requiring organizations to track carefully what is happening in the states in which they operate and do business and the way that legal requirements can vary from state to state.

Without looking at the textbook, name the three member states in the EEA.

Answer

Norway, Iceland, and Liechtenstein.

Exercise \(\PageIndex{1}\)

Which of the following countries is not in the European Union?

1. Slovenia
2. United Kingdom
3. Greece
4. Cyprus

Answer

United Kingdom