The APEC Cross-Border Privacy Rules: Advancing Privacy and Digital Trade in Asia

November 29, 2016
By Andrew Flavin, Policy Advisor, Office of Digital Services Industries

Over the last year, just about everyone in the trade community heard about Privacy Shield, a mechanism for transferring personal information between the United States and Europe. But you might ask, “what about the rest of the world?”

Part of the answer lies in the APEC Cross-Border Privacy Rules system (CBPRs), a mechanism to raise standards for the protection of personal information while ensuring that data can flow freely between the 21 members of APEC (Asia Pacific Economic Cooperation), which together represent 54 percent of the world economy.

Increasing the number of countries and companies that participate in the system has been a top priority for Acting Assistant Secretary of Commerce for Industry & Analysis Ted Dean. “The APEC Cross-Border Privacy Rules system builds consumer, business and regulator trust in the data flows that businesses in the United States and across the Asia-Pacific region rely on by providing voluntary but enforceable standards for privacy protection,” said Assistant Secretary Dean.

The CBPRs are based on a set of principles that certified companies in the APEC region apply when they collect, process and transfer personal data such as birthdates and Social Security Numbers. Participation in the CBPR system is voluntary, but once an organization joins and certifies that it is following the APEC principles, its commitments are legally enforceable. Consumers and businesses in participating countries doing business with certified companies can be assured that these organizations are handling their data in compliance with the Rules’ high standards for privacy and security. For example, all CBPR-certified companies agree to notify consumers when their personal information is being collected and how it is being used, and of the choices consumers have to limit the use and sharing of that information.

In 2016, industry support for CBPRs has grown as companies look for ways to build global compliance systems and meet increasing demands for high-standard privacy protections from consumers and business partners. A recent joint statement from eight major business and information technology associations in the United States, Japan, and Latin America highlighted the importance of the system for businesses:

“By creating a certification system that bridges the privacy regimes of each participating economy in a cost effective and scalable way, the CBPRs allow participating companies to focus their time and resources on innovating, serving customers, and pursuing their business objectives.”

Since APEC Leaders first endorsed CBPRs in 2011, Canada, Mexico, the United States, and Japan have joined the system, representing over 460 million Internet users. Further signaling confidence in the system as a tool to promote consumer privacy while ensuring that the digital economy can continue to flourish, Japan’s Personal Information Protection Commission announced that CBPR-certified companies will be able to transfer data in and out of Japan under new regulations expected to enter into force next year.

Support for CBPRs continued to build in November, when Chinese Taipei announced that it intends to conclude an internal review process to join the system in 2017. At the APEC Economic Leaders Meeting in Lima on November 20, the Leaders of all 21 member countries recognized the importance of the CBPR system in the APEC Leaders Declaration, and in his press conference, President Obama highlighted this important accomplishment, saying, “With regard to the digital economy, we endorsed rules to protect the privacy of personal information as it crosses borders.”

Shannon Coe, Chair of the APEC Electronic Commerce Steering Group, which oversees CBPRs, committed to building on this year’s accomplishments in 2017 and beyond. “We are encouraged by the advances the system has made in 2016 and will continue to work with our APEC partners to build on this progress in the future by raising awareness of the system’s benefits for countries, businesses and consumers.”

To learn more about the system, please visit http://www.cbprs.org.