In the EU, reverse engineering is allowed, but only for the purpose of making something that interoperates with the product you're reverse engineering, and does not compete with that product.
Do you have a reference for this? It would really help me settle a recent argument with a work colleague who thinks that reverse engineering a SAP HTTP API is not OK
Article 5 and Article 6 are the most interesting when it comes to reverse engineering, with 5 allowing to study an application while using it legally and breaking some protected rights for bug fixes and 6 allowing decompilation for some purposes.
This case of SAS vs. World Learning first went to court in the UK and from there to the CJEU which had a few substantial clarifications. These are quoted here in Wikipedia:
