Privacy & Information Security Law Blog

On August 6-10, 2014, the APEC Data Privacy Subgroup (“DPS”) and its parent committee, the Electronic Commerce Steering Group (“ECSG”), met in Beijing, China, for another round of negotiations, meetings and workshops. The Centre for Information Policy Leadership at Hunton & Williams participated as part of the U.S. delegation. The principal focus of the meetings was again on the further implementation of the APEC Cross-Border Privacy Rules (“CBPR”) system and related work relevant to cross-border interoperability. The following is a summary of highlights and outcomes from the meetings:

Implementation of the CBPR System

The three APEC economies currently participating in the CBPR system, the United States, Mexico and Japan, will soon be joined by Canada, which has formally submitted its notice of intent to participate in the system.

The DPS received a positive outcomes report of a study on the compatibility of Australia’s privacy regime with participation in the CBPR system that may set the stage for Australia’s future participation in the system. Similar studies may be performed on other APEC economies that are considering joining the system.

The U.S. APEC Accountability Agent, TRUSTe, reported that within the past year it has certified five companies under the CBPRs and that 14 additional companies are in the process of being certified.

Participants in the meetings discussed ways to speed up CBPR uptake among APEC economies and businesses and formed a working group to develop a growth strategy. Particular focus will be on communicating the benefits of participating in the CBPR system both to APEC economies and businesses.

The co-administrators of the APEC Cross-Border Privacy Enforcement Arrangement (“CPEA”) reported that the CPEA now has 25 member authorities from 8 APEC economies – the U.S., Canada, Mexico, New Zealand, Australia, Japan, Singapore and South Korea. The CPEA was developed as the government backstop enforcement network for the CBPR system, but it functions as a general privacy enforcement cooperation mechanism for all privacy-related enforcement.

Participants also discussed potential administrative improvements to the CBPR system and its dedicated website http://www.cbprs.org/. (retired)

Cross-Border Privacy Rules for Processors

As the CBPR system applies only to “data controllers,” APEC has been engaged in developing a similar system for data processors that would complement the CBPR system. The participants made progress on a draft of substantive rules, guidelines or best practices for processors and continued to discuss issues pertaining to their scope and the precise nature of the processor system (e.g., whether it can or should be an enforceable “certification” or a less formal “validation” mechanism for processors). The work on these issues will proceed inter-sessionally in a working group.

APEC/EU Cooperation Toward Interoperability

In March this year, APEC and the Article 29 Working Party released the so-called Referential, a jointly developed mapping document comparing APEC CBPRs to the EU Binding Corporate Rules (“BCRs”). The document was intended to be a high-level guide for companies that are seeking approval and certification under both systems. During the Beijing meetings last week, DPS members and their European counterparts discussed next steps in connection with this effort. They agreed to pursue case studies concerning practical issues confronting companies that are seeking approval under both systems and the development of additional practical documents or “checklists” that can assist with the dual approval and certification. The DPS members noted the importance of involving the private sector in this work. Subject to approval by the Article 29 Working Party at its upcoming September meeting, this collaboration will continue inter-sessionally.

10-Year Stocktake of APEC Privacy Framework

The DPS considered next steps in connection with an ongoing 10-year stocktake exercise concerning the APEC Privacy Framework to ensure that the Framework remains relevant in light of technological and market place changes. A working group led by Australia will consider specific proposal for updates and adjustments to the Framework.

ECSG Workshop to Define Future Agenda

To help define its future agenda, the ECSG held a one-day workshop to discuss innovative technologies and business models that drive economic growth and societal advancements and the regulatory frameworks that can support them. Various organizations discussed the benefits of Big Data analytics. The Centre for Information Policy Leadership discussed its work on the risk-based approach to privacy and its potential for providing effective privacy protections in the context of Big Data and the modern information economy. Other topics of discussion included organizational accountability and implementing an organizational compliance framework.

Next Meeting

The next round of meetings will be held in the Philippines at the end of January 2015.