Privacy & Information Security Law Blog

At the International Association of Privacy Professionals’ (“IAPP’s”) recent Europe Data Protection Congress in Brussels, the Centre for Information Policy Leadership at Hunton & Williams (the “Centre”) led two panels on the risk-based approach to privacy as a tool for implementing existing privacy principles more effectively and on codes of conduct as a means for creating interoperability between different privacy regimes.

Risk

Bojana Bellamy, the Centre’s President, led a panel entitled Privacy Risk Framework and Risk-based Approach: Delivering Effective Data Protection in Practice. Together with Mikko Niva of Nokia Corporation and JoAnn Stonier of MasterCard, the panelists discussed the emergence of a new way of implementing effective privacy protections and calibrating privacy programs based on understanding the actual risks to individuals and benefits that are associated with processing personal data.

The “risk-based approach” to privacy, which currently is the focus of a Centre project to develop a widely accepted and coherent methodology for understanding risk, is already reflected in various forms in certain existing laws (e.g., EU Data Protection Directive, FTC Act), international privacy principles and guidelines (e.g., APEC and OECD), and privacy impact assessment guidance. Indeed, according to the panelists, risk assessments are not only required by various laws, they are an integral component of organizational accountability regardless of any legal requirements. Thus, the panelists discussed how their organizations currently employ risk assessments to implement such accountability and to ensure both compliance with the law and effective privacy protections. They also discussed how the risk-based approach focuses not only on the risk to organizations, but also on the risk to individuals. Finally, the panelist gave an overview of how the Council of the European Union that is working on the proposed EU General Data Protection Regulation has incorporated the risk-based approach as a general obligation and in specific provisions.

To avoid any misconception, the panelists stressed that the risk-based approach does not change or replace any applicable legal requirements and does not alter the rights of individuals under data protection laws. It simply is an additional tool that improves privacy compliance programs by linking privacy controls and mitigations to the likelihood and severity of the harms associated with processing personal data.

Interoperability

Markus Heyder, the Centre’s Vice President and Senior Policy Counselor, moderated a panel on EU BCRs and APEC CBPRs: Cornerstones of Future Interoperability. He and his co-panelists Florence Raynal of the French Data Protection Authority (“CNIL”), Christina Peters of IBM Corporation, Hilary Wandell of Merck & Co. and Daniel Pradelles of Hewlett-Packard, introduced the basics of the APEC Cross-Border Privacy Rules (“CBPRs”) to a mainly European audience. They also discussed the work that is currently being done by a joint working group of the Article 29 Working Party and the APEC Data Privacy Subgroup on the development of tools that help companies become certified and approved under both the EU Binding Corporate Rules (“BCRs”) and the CBPRs.

Florence Raynal explained the joint working group’s “Referential” from last March, which mapped the respective substantive requirements of the two systems to each other, identifying substantial overlap as well as some differences. She also explained the ongoing follow-up work to the Referential, whereby the working group is conducting case studies with the help of several companies that have or are seeking dual certification/approval under the CBPR and BCRs. The purpose of this exercise is to test the usefulness of the Referential and to consider what additional practical tools might be developed to enable companies to leverage compliance with one system into more efficient approval under the other.

The three company representatives told the audience how certification to one code of conduct such as the CBPRs or BCRs have helped facilitate effective internal accountability and compliance programs and positioned them well for achieving compliance and approval under the other system. The case studies are ongoing and will be formally discussed by the joint working group at the upcoming APEC Data Privacy Subgroup meetings in the Philippines in late January 2015.