Explicit informed prior consent is clearly required according to this
http://ec.europa.eu/justice_home/fsj/privacy/thridcountries/background-info_en.htm#transfert---
"When can personal data be processed?"
Personal data can be processed (i.e. collected and further used) if:
The data subject has unambiguously given his or her consent (i.e. if he or she as agreed freely and specifically after being adequately informed), or
Data processing is necessary for the performance of a contract or in order to enter into a contract requested by the data subject (e.g. processing of data for billing purposes or processing of data relating to an applicant for a job or for a loan) or
Processing is required by law or
Processing of data is necessary to protect a vital interest of the data subject or
Processing is necessary in the performance of tasks carried out in the public interest or by official authorities (such as the government, the tax authorities, the police etc.) where this is necessary for the accomplishment of their tasks.
Finally data can be processed whenever the controller or a third party has a legitimate interest in doing so and this interest is not overridden by the interest of protecting the fundamental rights of the data subject, particularly the right to privacy. This provision basically establishes the need to strike a reasonable balance in practice between the business interest of the data controllers and the need for privacy of data subjects. This balance has to be struck in the first place by the data controllers under the control of the data protection authorities, although ultimately it will be for the courts to decide.
More stringent rules apply to processing of sensitive data relating to racial or ethnic origin, political opinions , religious or philosophical beliefs, trade union membership and the processing of data concerning health or sex life. Such data cannot be processed unless the data subject has given his or her explicit consent. Member States may prohibit altogether some forms of processing of these data. A number of derogations, however do apply which allow for the processing of these data in certain cases subject to particular safeguards. These cases include the processing of data mandated by employment law, the cases in which it is impossible for the data subject to consent (e.g. blood testing of the victim of a road accident), processing of data manifestly made public or processing of data about members by trade unions, political parties or churches).
---
clearly unencryped e-mail may routinely fall into the 'sensitive' category referred to in the last para.
