There are still some points left open:
- The concepts of “personal data” and “data processing” differ across US and EU law.
- The data retention period is broadly defined in relation to the purpose pursued.
- The restrictions on individuals’ access rights are too broad.
- Access could be improved by the establishment of an indirect access right mechanism.