Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 55
Annex: Data Protection and Privacy Law Instruments Regulating
Transborder Data Flows
Note: The following Annex covers only data protection and privacy law instruments that specifically deal
with transborder data flows (i.e., provisions dealing with data transfers in general are not included,
except in a few special cases). With the exception of those described in section D, only legally-binding
instruments that are currently in force (in most cases legislation), or influential non-binding instruments
promulgated by leading international institutions, have been included. While substantial effort has been
made regarding the accuracy of the citations and of the translations (most of which are taken verbatim
from official sources), no guarantees are made in this regard
A. International instruments (binding and non-binding)
Name Provisions Text or translation (excerpts; notes are given in italics)
APEC APEC Privacy
Framework
(can be voluntarily
implemented in the 21
APEC Member
Economies: Australia;
Brunei Darussalam;
Canada; Chile; the
People's Republic of
China; Hong Kong,
China; Indonesia; Japan;
Republic of Korea;
Malaysia; Mexico; New
Zealand; Papua New
Guinea; Peru; The
Philippines; Russia;
Singapore; Chinese
Taipei; Thailand; the
United States of America;
Council of
Europe
and Vietnam)
Convention for the
Protection of Individuals
with regard to Automatic
Processing of Personal
Data, January 28, 1981,
ETS 108 (1981)
Principle IX (Accountability)
A personal information controller should be accountable for complying
with measures that give effect to the Principles stated above. When
personal information is to be transferred to another person or
organization, whether domestically or internationally, the personal
information controller should obtain the consent of the individual or
exercise due diligence and take reasonable steps to ensure that the
recipient person or organization will protect the information
consistently with these Principles.
Article 12 – Transborder flows of personal data and domestic law
1. The following provisions shall apply to the transfer across
national borders, by whatever medium, of personal data
undergoing automatic processing or collected with a view to
their being automatically processed.
2. A Party shall not, for the sole purpose of the protection of
privacy, prohibit or subject to special authorisation
transborder flows of personal data going to the territory of
another Party.
3. Nevertheless, each Party shall be entitled to derogate from the
provisions of paragraph 2:
a. insofar as its legislation includes specific regulations
for certain categories of personal data or of