29 have critical implications for non-EC countries, including Botswana. The first principle of Article 25 states: “The Member State shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection”. 4.3.8 The second principle states: “The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surround a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures that are complied with in that country”. 4.3.9 To date, the Commission has determined that personal data can flow from the EU Member Countries (and Norway, Liechtenstein and Iceland) to the following recognised “third” countries: Switzerland; Canada; Argentina; Guernsey, Isle of Man; and in the United States, companies following the U.S. Safe Harbor Rules and Air Passenger Name Records to the U.S. Bureau of Customs and Border Protection. 4.3.10 The EC Directive, coupled with the Principles outlined in the OECD Guidelines have informed most of the legislation and practice in privacy protection in developed and developing countries. The legislative and institutional form of privacy protection may vary significantly, however. The primary differences are not in the underlying principles but in the degree to which industry takes responsibility for implementation and the degree to which coverage applies across commercial and government sectors. The consideration of these factors and the institutional and legislative design decisions will be very important to Botswana and to the successful implementation of a privacy regime that will be both effective and meet international standards while not being unduly burdensome in terms of resources, including expertise.16 16 A specific role identified for the Hong Kong Privacy Commissioner is to ensure “all other jurisdictions with data protection laws are aware of the robustness of the protection of the privacy of the individual with respect to personal data so as to prevent interference with the free flow of personal data to Hong Kong.” www.pco.org.hk/english/about/role.html