A large American multinational corporation wants to establish a telephone and email hotline for employees to report wrongdoing within the company. The company has offices in the European Union and wants to ensure that it avoids violations of E.U. data protection laws. What steps can the company take to increase the likelihood that its hotline reporting system remains in compliance?