Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 21
organisations or countries to which the personal data travels subsequently’. 54 The APEC
framework foresees that organisations (such as companies) may adopt Cross-Border
Privacy Rules (CBPRs) as a way to apply protections across the organisation no matter
where the data are processed. 55
Some APEC member economies have implemented the accountability approach in their
own data protection legislation. For example, accountability is used under the Canadian
Personal Information Protection and Electronic Documents Act (PIPEDA), and the
concept is also contained in the Australian Government’s draft Privacy Principles that
were released for consultation in June 2010. 56 Accountability does not specifically restrict
transborder data flows, but imposes compliance responsibilities on parties that transfer
personal data internationally. As the Office of the Privacy Commissioner of Canada has
explained, ‘PIPEDA does not prohibit organizations in Canada from transferring personal
information to an organization in another jurisdiction for processing. However under
PIPEDA, organizations are held accountable for the protection of personal information
transfers under each individual outsourcing arrangement’. 57 On a practical level,
accountability may require organisations to take steps such as implementing appropriate
privacy policies which are approved by senior management and implemented by a
sufficient number of staff; training employees to comply with these policies; adopting
internal oversight and external verification programs; providing transparency to
individuals as to the policies and compliance with them; and adopting mechanisms to
enforce compliance. 58
However, the APEC Privacy Framework is far from being a monolithic or uniform
approach. Because it is so new, there is little experience of how it will work in practice,
besides the experience in those countries that have already implemented a similar system
of privacy protection. Since the Framework is voluntary, it is also unclear how many
members will implement it; in fact, at present APEC members have their own approaches
to privacy protection, which cover a wide range of positions. Implementation of the
Framework may not necessarily require legislation, but can also be accomplished through
mechanisms such as industry self-regulation, 59 meaning that divergence is likely to
continue even between those countries that have implemented it. In addition, the APEC
Framework does not have binding legal effect as would result, for example, from
conclusion of an international treaty, and its provisions are subject to derogation by
54
Malcolm Crompton, Christine Cowper and Christopher Jefferis, ‘The Australian Dodo Case: An Insight
for Data Protection Regulation’ (26 January 2009) BNA Privacy & Security Law Report 180, at 181.
55
See APEC Data Privacy Pathfinder Projects Implementation Work Plan (Revised), APEC document
2009/SOM1/ECSG/SEM/027,
.
56
Australian Government, ‘Australian Privacy Principles, Exposure Draft’ (24 June 2010), at 15-17,
; and Australian
Government, ‘Australian Privacy Principles, Companion Guide’ (June 2010), at 13,
.
57
Office of the Privacy Commissioner of Canada, ‘Guidelines for Processing Personal Data across
Borders’ (2009), at 5, .
58
Galway Project and Centre for Information Policy Leadership, ‘Data Protection Accountability: The
Essential Elements, A Document for Discussion’ (2009),
, at 11-14.
59
APEC Privacy Framework (n 2), at 31.