Introduction to the APEC Cross Border Privacy Rules System: Data Privacy in Canada

Transcription

1 Introduction to the APEC Cross Border Privacy Rules System: Data Privacy in Canada The American Bar Association Section of Antitrust Law Privacy & Information Security Committee April 16, :00 2:00 pm (EST) Danièle Chatelois Industry Canada Chair APEC Data Privacy Subgroup Josh Harris U.S. Department of Commerce Vice Chair APEC Data Privacy Subgroup

2 The APEC Privacy Framework The Data Privacy Subgroup developed the APEC Privacy Framework in 2004 The Framework is a set of nine principles to assist APEC economies in developing privacy approaches that maximize privacy protection and the continuity of cross-border information flows 2

3 The APEC Privacy Principles 1) Preventing Harm 2) Notice 3) Use 4) Collection Limitation 5) Choice 6) Security Safeguards 7) Integrity 8) Access and Correction 9) Accountability

4 The Role of Cross Border Privacy Rules The Framework states that international implementation of these principles may be achieved through Cross Border Privacy Rules (CBPRs) CBPRs are a set of voluntary rules developed by an organization based upon the APEC Privacy Principles The organization then commits to apply these rules to its activities involving transfers of personal information across borders 4

5 Implementing the CBPR System Step 1: Join the Cross Border Privacy Enforcement Arrangement (CPEA) Step 2: Submit a letter of intent to participate in the CBPR System Step 3: Make use of at least one APEC-recognized Accountability Agent

6 Step 1: Join the CPEA Q: Why is CPEA Participation required in order to participate in the CBPR System? A: CPEA Participation establishes a voluntary A: CPEA Participation establishes a voluntary cooperation network between regulators. The ability to cooperate on privacy-related investigations and enforcement actions is key to effective international privacy protections

7 Who s In the CPEA? The Office of the Australian Information Commissioner (OAIC) The New Zealand Office of the Privacy Commissioner (NZOPC) The United States Federal Trade Commission (US FTC) The Office of the Privacy Commissioner for Personal Data, Hong Kong, China (PCPD) The Office of the Privacy Commissioner of Canada (OPCC) Ministry of Foreign Affairs of Japan Ministry of Economy, Trade and Industry of Japan y y, y p Ministry of Internal Affairs and Communications of Japan Ministry of Finance of Japan Ministry of Justice of Japan Ministry of Agriculture, Forestry and Fisheries of Japan Ministry of Land, Infrastructure, Transport and Tourism of Japan Ministry of Defense of Japan Ministry of Health, Labour and Welfare of Japan Ministry of Education, Culture, Sports, Science and Technology of Japan Ministry of Environment of Japan Cabinet Office of Japan Consumer Affairs Agency of Japan Financial Services Agency of Japan National Police Agency of Japan

8 Step 2: Submit a Letter of Intent Q: To Whom is the Letter Sent? A: The Electronic Commerce Steering Group, the Data Privacy Subgroup, and the Joint Oversight Panel Q: What Information Must the Letter Contain? A: Four elements: 1) Confirmation of participation in CPEA; 2) Statement of intent to use at least one APECrecognized Accountability Agent; 3) Description of laws which may apply to the CBPR certification activities of an Accountability Agent; 4) APEC Cross-Border Privacy Rules System Program Requirements Enforcement Map

9 What Happens Next? The Joint Oversight Panel will work with the Economy to make sure the information submitted meets the requirements of the CBPR System Once the Joint Oversight Panel submits a report to the ECSG Chair indicating that these requirements have been met, the Economy is considered a participant in the CBPR System

10 Step 3: Using An APEC-Recognized Accountability Agent Q: What is An Accountability Agent? A: An Accountability Agent is any APEC-Recognized entity that verifies that the privacy policies and practices of companies seeking CBPR certification meet the baseline requirements of the system

11 Getting APEC Recognition A CBPR-participating Economy can put forward an Accountability Agent for APEC recognition in one of two ways: 1) Nominate an Accountability Agent 2) Receive notification of an Accountability Agent application and forward application to Joint Oversight Panel Accountability Agents operating in a CBPR-participating Economy may apply for APEC recognition using the application endorsed in February 2012 in Russia

12 What Does the Application for Recognition Include? 1) An explanation of how the Accountability Agent is subject to the jurisdiction of a privacy enforcement authority in a CBPRparticipating Economy; 2) A description of how each of the Accountability Agent Recognition Criteria have been met; 3) A demonstration of how the Accountability Agent s intake and review processes meet the baseline established in the CBPR system; 4) Accountability Agent Contact information

13 What are the Accountability Agent Recognition Criteria? 1) Conflicts of Interest Provide written policies on internal procedures to ensure no conflicts of interest 2) Program Requirements Indicate whether will use APECdeveloped organization intake form or map own requirements to APEC s 3) Certification Process Describe process to assess and verify organization s compliance with requirements and provide certification

14 Accountability Agent Recognition Criteria, con t 4) Ongoing Monitoring Describe written procedures on monitoring and review triggered if believe non-compliant 5) Re-Certification Describe recertification review process, including assessment of compliance and verification of self-assessment 6) Dispute Resolution Describe dispute resolution process, including complaint receipt, eligibility determination, investigation, resolution, notification, information sharing with enforcement authorities, statistics and case notes; indicate if supplied by third party

15 What are the Accountability Agent Recognition Criteria? 7) Enforcement Mechanisms Explain authority to enforce program requirements Describe policies/procedures to notify organization of noncompliance and ensure remedy Describe policies/procedures i regarding applicable penalties Describe policies/procedures for referring case to relevant authorities Describe policies/procedures to respond to requests from APEC enforcement authorities

16 How Does Applicant Demonstrate Their Program Meets APEC Criteria? Accountability Agent must: Indicate it will use 50-question APEC-developed self- assessment form, ensuring that responses meet requirements and verifying assertions; OR Map own program requirements to APEC-developed organization questions AND assessment criteria

17 Who Reviews the Application? The Joint Oversight Panel will review an Accountability Agent s application for APEC Recognition and issue a recommendation report This report will be circulated to APEC member economies for their consideration If no objections are raised, the Accountability Agent will be deemed APEC-Recognized for that year Annual recertification is required.

18 CBPR System and Domestic Laws CBPR system: multi-level, multi-stakeholder Private & Public sector voluntary initiatives (Accountability Agents (AAs) / Trustmarks) statutes/regulation (Regulators DPAs) Both aim to influence, shape or control organizational behaviour AAs: Power to influence rests in marketplace Governments: laws and regulations used to obtain desired behaviour

19 CBPR System and Domestic Laws CBPR System does not displace domestic laws or responsibilities of domestic regulators Participation in the CBPR System does not replace organizations domestic obligations: Organizations continue to be required to comply with legislative requirements

20 CBPR System and Regulatory Action Voluntary initiatives can and do exist within a legislative context Not an either/or proposition Government not retreating or abdicating responsibilities Non-Government actors able and willing to take on responsibilities The success of legislation/regulation can be enhanced by voluntary initiatives (and vice-versa) Both can work in a mutually supportive and positive manner Numerous examples: Consumer Protection Environment Bicycle Helmets

21 CBPR System: Potential Benefits Non-gov t accountability agents may not be subject to regulators jurisdictional barriers Regulators can encounter difficulties enforcing findings/orders against foreign organizations Supplements limited time and resources available to Regulators supports timely dispute resolution Review and monitoring of company practices by nongov t accountability agents can have a direct, operational influence over firm behaviour

22 Regulator-Accountability Agent Roles and Responsibilities Regulators/Privacy Commissioners generally only enforce in respect of laws they are mandated to enforce (not CBPRs/APEC Framework). PIPEDA No explicit provisions in PIPEDA allowing Privacy Commissioner to receive cases from Accountability Agents. As drafted, only individuals can complain to Commissioner. No provisions allowing Commissioner to transfer complaints to AAs without consent. Individuals would have to complain to trustmark directly. No provisions allowing collaboration with non-gov t AA in investigation or resolution of complaints. Only with domestic or international counterparts.

23 PIPEDA/ CBPR Program Requirements PIPEDA CBPR System Consent Openness, Purpose Challenging Compliance Reasonable Person Test Choice Notice Dispute Resolution Mechanism

24 Questions? Danièle Chatelois Josh Harris Danièle Chatelois Josh Harris