KEY ISSUES FOR DIGITAL TRANSFORMATION IN THE G20

The G8 Deauville Declaration outlined that we still “face considerable challenges in promoting interoperability
and convergence among our public policies on issues such as the protection of personal data” (G8, 2011).
Likewise, the OECD Council Recommendation on Principles for Internet Policy Making calls for strengthening
the consistency and effectiveness of privacy protection at a global level. The Communiqué which is annexed to
it further recognised the objective of governments to pursue global interoperability in this area. The OECD
Recommendation of the Council concerning Guidelines governing the Protection of Privacy and Transborder
Flows of Personal Data (amended in 2013) similarly recognises the value of globally interoperable privacy
frameworks that ensure effective protection of privacy and support the free flow of personal information
around the world.
There exist a range of approaches to interoperability among privacy frameworks. The US-EU Safe Harbour
Framework, which was adopted under the EU adequacy regime and implemented in 2000, was an early
example. Since then, this agreement was invalidated and a new agreement was developed to address privacy
protection for data transferred between the US and the European Union – the US-EU Privacy Shield. Other
initiatives have been undertaken to bring together different approaches and systems of protection, including
work by the privacy enforcement authorities within the framework of the EU Binding Corporate Rules and the
APEC Cross-Border Privacy Rules System within the Asia-Pacific region. The Council of Europe updated
Convention 108 on the Automated Processing of Personal Data in 2012. Further work is needed at the policy
level towards a more seamless approach to global privacy governance.
Robust strategies to manage digital security and privacy risks are essential to establish the trust needed for
economic and social activities to fully benefit from digital innovation. Some productive areas for policy actions
by the G20 are outlined below.
G20 economies could develop strategies, supported at the highest level of government, to create the
conditions for all stakeholders to manage digital security risk to economic and social activities and to foster
trust and confidence in the digital environment. Such strategies should incorporate a whole-of-society
perspective while providing the flexibility needed to take advantage of digital technologies for the benefit of
all. G20 economies could also initiate international arrangements that promote effective privacy and data
protection across jurisdictions, including through the development of national privacy strategies that would
foster interoperability among frameworks (OECD, 2016j). Improving the global interoperability of privacy
frameworks raises challenges but has benefits beyond facilitating transborder data flows. Global
interoperability can help simplify compliance by organisations and ensure that privacy requirements are
maintained. It can also enhance individuals’ awareness and understanding of their rights in a global
environment.
In order to optimise the economic and social benefits expected from the digital environment, leaders and
decision makers could encourage a shift towards the adoption of a risk management approach so that digital
security risk management becomes an integral part of an organisation’s overall risk management and decisionmaking
processes, and the resulting choice of security measures take into account the interests of others, is
appropriate to and commensurate with the risks faced, and does not undermine the economic and social
activity they aim to protect.