APEC CROSS-BORDER PRIVACY RULES SYSTEMPOLICIES, RULES AND GUIDELINES

Updated as of November 2019
The purpose of this document is to describe the APEC Cross Border Privacy Rules (CBPR)
System, its core elements, governance structure and the roles and responsibilities of participatingorganizations, Accountability Agents and Economies. This document is to be read consistently
with the 2015 APEC Privacy Framework. Nothing in this document is intended to create binding
international obligations, affect existing obligations under international or domestic law, or
create obligations under the laws and regulations of APEC Economies.

DEVELOPMENT OF THE CBPR SYSTEM ............................................................................................... 2
OPERATION OF THE CBPR SYSTEM ................................................................................................. 4
CBPR PROCESSES OVERVIEW ................................................................................................................. 8
THE CBPR SYSTEM AND DOMESTIC LAWS AND REGULATIONS ........................................... 11
GOVERNANCE OF THE CBPR SYSTEM ............................................................................................... 12
SUCCESS CRITERIA FOR THE CBPR SYSTEM .................................................................................. 14
ANNEX A – CHARTER OF THE APEC CROSS-BORDER PRIVACY RULES SYSTEM JOINTOVERSIGHT PANEL ................................................................................................................................. 15

Page | 1

DEVELOPMENT OF THE CBPR SYSTEM
1.
APEC plays a critical role in the Asia Pacific region by promoting a policy framework
designed to ensure the continued free flow of personal information across borders while
establishing meaningful protection for the privacy and security of personal information.
2.
In November 2004, Ministers for the twenty-one APEC Economies endorsed the
APEC Privacy Framework1. The Framework is comprised of a set of nine guiding principles
and guidance on implementation to assist APEC Economies in developing consistent domestic
approaches to personal information privacy protections. It also forms the basis for thedevelopment of a regional approach to promote accountable and responsible transfers of
personal information between APEC Economies. The APEC Privacy Framework was revisedand updated in 2015.
3.
The 2005 APEC Privacy Framework provides “a principles-based … framework as
an important tool in encouraging the development of appropriate information privacy
protections and ensuring the free flow of information in the Asia Pacific region.”2 Four of the
purposes of the framework are to3:•

develop appropriate privacy protections for personal information, particularly fromthe harmful consequences of unwanted intrusions and the misuse of personal
information;•

enable global organizations that collect, access, use or process data in APEC
Economies to develop and implement uniform approaches within their organizations
for global access to and use of personal information;•

assist enforcement agencies in fulfilling their mandate to protect information privacy;
and•advance international mechanisms to promote and enforce information privacy and tomaintain the continuity of information flows among APEC economies and with theirtrading partners.

4.
In addition, the Privacy Framework calls for the development of a system of voluntarycross-border privacy rules for the APEC region in its “Guidance for International
Implementation”.4
5.
These four purposes and the international implementation guidance formed the basis of
the APEC Data Privacy Pathfinder, which was endorsed by APEC Ministers in September
2007 in Sydney, Australia. An APEC Pathfinder is a cooperative project among participating
APEC Economies. The purpose of the Data Privacy Pathfinder was to develop a simple andtransparent system that can be used by organizations for the protection of personal informationthat moves across APEC Economies. It was determined that the system should:•

provide a practical mechanism for participating Economies to implement the APEC
Privacy Framework in an international, cross-border context; domestic laws,

1Part IV of the Framework dealing with (a) guidance for domestic implementation and (b) guidance forinternational implementation was completed and endorsed by Ministers in 2005.
2
APEC Privacy Framework, Part I, Preamble, para 4, 2005
3
APEC Privacy Framework, Part I, Preamble, para 8, 2005
4
APEC Privacy Framework, Part IV, Guidance on Int’l Implementation, Section III, paras 46-48.

Page | 2

regulations and guidelines would continue to cover the collection and management of
information within Economies;•

provide a means for organizations to transfer personal information across participating
APEC Economies in a manner in which individuals may trust that the privacy of theirpersonal information is protected; and•apply only to organizations (that is, businesses) – it is not intended to deal with thepersonal information handling practices of governments or individuals.

6.
In the development of the APEC Data Privacy Pathfinder, the following stakeholder
considerations were identified:•organizations should have trust and confidence that organizations with which they enter
into transactions that involve personal information have appropriate policies andprocedures in place that are consistent with the APEC principles and respect applicableprivacy and data security laws, as well as the privacy and security representations
made to the individual when the personal information was collected;•

consumers should have trust and confidence that their personal information istransmitted and secured across borders; and•governments should ensure that there are no unreasonable impediments to crossborder data transfers while at the same time protecting the privacy and security of
their citizens’ personal information domestically and, in cooperation with foreign
governments, internationally.

7.
The Pathfinder set out to develop a voluntary APEC Cross-Border Privacy Rules(CBPR) System, consistent with the above purposes, criteria and considerations, through thedevelopment of the following core documents:• a detailed self-assessment questionnaire based on the nine APEC Privacy Principles
for use by an applicant organization5;• a set of baseline program requirements based on the nine APEC Privacy Principles
against which an APEC-recognized Accountability Agent will assess anorganization’s completed questionnaire6;• recognition criteria to be used by APEC Economies when considering the recognitionof an Accountability Agent7;• the Cross Border Privacy Enforcement Arrangement8 (CPEA); and• the Charter of the Cross Border Privacy Rules Joint Oversight Panel9 (JOP).
7. a)
The Privacy Recognition for Processors system was endorsed in 2015, and included in thecurrent Charter of the APEC Cross-Border Privacy Rules and Privacy Recognition for Processors
system Joint Oversight Panel document. The APEC Privacy Framework was also updated in 2015.
5

See Project 1, CBPR Intake Questionnaire, 2011/SOM1/ECSG/DPS/020
See Project 3, CBPR Program Requirements for use by Accountability Agents7
See Project 2, Accountability Agent Recognition Criteria, 2010/SOM1/ECSG/DPS/011
8
See Projects 5/6/7, The Cross Border Privacy Enforcement Cooperation Arrangement,
2010/SOM1/ECSG/DPS/013
9
See 2005 Charter of the Cross Border Privacy Rules Joint Oversight Panel
6

Page | 3

OPERATION OF THE CBPR SYTEM
Overview of the CBPR System
8.
Organizations that choose to participate in the CBPR System should implement
privacy policies and practices consistently with the CBPR program requirements for all
personal information that they have collected or received that is subject to cross-bordertransfer to other participating APEC economies10. These privacy policies and practices shouldbe evaluated by an APEC-recognized Accountability Agent for compliance with the CBPR
program requirements. Once an organization has been certified for participation in the CBPR
System, these privacy policies and practices will become binding as to that participant and will
be enforceable by an appropriate authority, such as a regulator to ensure compliance with the
CBPR program requirements.
Elements of the CBPR System
9.
The CBPR System consists of four elements: (1) self-assessment; (2) compliancereview; (3) recognition/acceptance; and (4) dispute resolution and enforcement.
CBPR ELEMENT 1 – SELF-ASSESSMENT
Self-Assessment Questionnaire for Organizations
10.
The CBPR System relies on an organization’s self-assessment of their data privacy
policies and practices against the requirements of 2015 APEC Privacy Framework using an
APEC- recognized CBPR questionnaire (see para 21). This questionnaire will be provided by
the appropriate APEC-recognized Accountability Agent, in accordance with establishedselection requirements (see para 38).
Link to Compliance Review
11.
The completed questionnaire and any associated documentation will then be
submitted to the APEC-recognized Accountability Agent for confidential review against thebaseline standards established in the CBPR program requirements (see para 7).
12.
The submission of this questionnaire is the first step in an evaluative process that will
determine whether an organization’s privacy policies and practices are consistent with theprogram requirements of the CBPR System. This process can also be used by organizations to
help them develop privacy policies or revise existing privacy policies to meet the program
requirements of the CBPR System.
13.
This questionnaire may be supplemented by additional questions, documentation orrequests for clarification as part of the APEC-recognized Accountability Agent’s review
process.
Link to Compliance Directory
14.
An organization that is found to be compliant with the CBPR program requirements
by an APEC-recognized Accountability Agent will be certified as CBPR compliant and will
have relevant details of their certification published in an APEC-hosted website so that
10

While not required as part of the CBPR System, participating organizations are encouraged to apply the same
privacy policies and procedures to all personal information that they have collected or received even if it is not
subject to cross border transfer or if it is subject to such transfer only outside of participating APEC economies.

Page | 4

consumers and other stakeholders can be made aware that the organization is an active
participant in the CBPR System. The relevant details should include at least thefollowing: the name of the certified organization, a website for the certified organization
and a link to the organization’s privacy policy, contact information, the Accountability
Agent that certified the Participant and can handle consumer disputes, the relevant
Privacy Enforcement Authority, the scope of the certification, the organization’s original
certification date, and the date that the current certification expires.
CBPR ELEMENT 2 – COMPLIANCE REVIEW
Accountability Agent Recognition Criteria
15.
To become an APEC-recognized Accountability Agent, an Accountability Agentshould meet the established recognition criteria to the satisfaction of APEC Economies (seepara 33).
16.
These criteria provide for the evaluation of an Accountability Agent’s program
requirements, dispute resolution procedures, and policies and procedures for the avoidance of
conflicts of interest as well as process issues, including the certification and re-certification
processes, ongoing monitoring and compliance reviews and enforcement of program
requirements.
17.
As a condition of APEC recognition, Accountability Agents are required to release
anonymised case notes and complaint statistics. Complaint handling is an important elementof the CBPR System. These actions will:•

promote understanding and increase transparency about the CBPR System;•

aid consistent interpretation of the APEC Privacy Principles and the CBPR System;•

provide additional guidance to organizations on the application of the APEC Privacy
Principles and CBPR System; and•promote accountability of those involved in complaints handling and build
stakeholders’ trust in the process.

18.
As a further condition of APEC recognition, an Accountability Agent should consent
to respond to requests from relevant government entities in any APEC Economy thatreasonably relate both to that Economy and to the CBPR-related work of the Accountability
Agent, where possible.
19.
All APEC-recognized Accountability Agents should endeavour to cooperate whenappropriate and where possible in CBPR-related complaint handling matters with otherrecognized Accountability Agents.
Compliance Review Process of CBPRs
20.
When reviewing an organization’s privacy policies and practices as described in the
self-assessment questionnaire, an APEC-recognized Accountability Agent should assess themagainst the CBPR program requirements. These program requirements are designed to provide
the minimum standard that applicant organizations should meet in order to ensure that theassessment process is conducted in a consistent manner across participating Economies. An
APEC-recognized Accountability Agent’s assessment process may exceed this standard but
may not fall below it.
Page | 5

21.
Where an applicant Accountability Agent intends to make use of its own
questionnaire and/or program requirements in lieu of the APEC-recognized self-assessment
questionnaire and/or the APEC-recognized CBPR program requirements (see para 7), it
should establish its comparability to the satisfaction of APEC Economies as a condition of
APEC recognition (see para 54).
CBPR ELEMENT 3 – RECOGNITION
Compliance Directory and Contact Information
22.
APEC Economies will establish a publicly accessible directory of organizations thathave been certified by Accountability Agents as compliant with the CBPR System, which
will include relevant details of each certification (see para 14). The directory will include
contact point information that consumers can use to contact participating organizations. Eachorganization’s listing will include the contact point information for the APEC- recognizedAccountability Agent that certified the organization and the relevant Privacy Enforcement
Authority. Contact point information allows consumers or other interested parties to directquestions and complaints to the appropriate contact point in an organization or to the relevant
Accountability Agent, or if necessary, to contact the relevant Privacy Enforcement
Authority.
23.
The directory and contact lists will be hosted by the APEC Secretariat and maintainedby the Electronic Commerce Steering Group in accordance with the APEC website
Guidelines11. This website may be expanded to contain FAQs and additional information on
the CBPR System for potential applicant organizations and for consumers.
CBPR ELEMENT 4 – ENFORCEMENT
Cooperation Arrangement for Cross-Border Privacy Enforcement
24. The CBPR system should be enforceable by Accountability Agents and Privacy
Enforcement Authorities:•

Accountability Agents should be able to enforce the CBPR program requirements
through law or contract; and•The Privacy Enforcement Authorities should have the ability to take enforcement
actions under applicable domestic laws and regulations that have the effect ofprotecting personal information consistent with the CBPR program requirements.

25.
The CPEA, which was endorsed by APEC Ministers in November 2009 andcommenced on 16 July 2010, aims to:11•

facilitate information sharing among Privacy Enforcement Authorities (PEAuthorities) in APEC Economies (which may include Privacy Commissioners’
Offices, Data Protection Authorities or Consumer Protection Authorities that enforce
Privacy Laws);•

provide mechanisms to promote effective cross-border cooperation between
authorities in the enforcement of CBPR program requirements and privacy laws
generally, including through referrals of matters and through parallel or joint
investigations or enforcement actions; andhttp://webresources.apec.org/

Page | 6•encourage information sharing and cooperation on privacy investigation andenforcement with PE Authorities outside APEC (including by ensuring that the
CPEA can work seamlessly with similar arrangements in other regions at the
global level).

26.
The CPEA creates a framework for the voluntary sharing of information and provisionof assistance for information privacy enforcement related activities. Any PE Authority in an
APEC Economy may participate. Participating PE Authorities will contact each other forassistance or to make referrals regarding information privacy investigations and enforcement
matters that involve each other’s Economies. For example, during an investigation, a PE
Authority in Economy X may seek the assistance of a PE Authority in Economy Y, if certain
evidence of the alleged privacy violation (or the entity being investigated) is located in
Economy Y. In that case, the PE Authority in Economy X may send a Request for Assistanceto the point of contact in the PE Authority in Economy Y. The PE Authority in Economy Y
may then consider the matter and provide assistance on a discretionary basis.

Page | 7

CBPR PROCESS OVERVIEW
27.
The following provides an overview of the process for participation by APEC
Economies in the CBPR System, the process for the recognition of Accountability Agents by
APEC Economies, the process for the certification of an organization, and the role Privacy
Enforcement Authorities.
Process for Participation and Discontinuation of Participation by APEC Economies in the
CBPR System28.
To participate in the CBPR System, an Economy must first satisfy the conditions in
2.1 of the Charter of the Joint Oversight Panel. The Economy then nominates one or more
Accountability Agents for APEC recognition or notifies the ECSG Chair of receipt ofapplication(s) for such recognition. Once at least one Accountability Agent has beenrecognised in relation to that Economy, organisations will be able to commence participationin the CBPR system in the Economy. Where only one Accountability Agent operates in an
Economy and that Accountability Agent ceases to function in that capacity, that Economy
should provide the DPS an update at the next meeting on when the Economy anticipatesnominating a new Accountability Agent for APEC recognition or notifying the ECSG Chair ofreceipt of a new application for such recognition. The certification of those organizations
certified by that Accountability Agent will be terminated until such time as the Economy isable to again fulfil the requirement for participation in the CBPR System. Once a new
Accountability Agent is recognized, any previously-certified applicant organizations should
complete a new certification process.
29.
An Economy may cease participation in the CBPR System at any time by giving one
month’s written notice to the APEC ECSG Chair. In the event that a Participant discontinues
participation in the CBPR System, any APEC-recognized Accountability Agents in that
Economy should terminate participation in the CBPR System in that Economy. Thisrequirement should be incorporated into the agreements between the Accountability Agent andany organizations they certify as CBPR compliant.
Process for Recognition of Accountability Agents
30.
An Economy can nominate an Accountability Agent operating within its jurisdiction
for APEC recognition or, where appropriate, notify the Joint Oversight Panel that they havereceived a request for such recognition and submit the received application and associateddocumentation for consideration (see para 54). In either case, the Economy should describe
the relevant domestic laws and regulations which may apply to the activities of Accountability
Agents operating within their jurisdiction and the enforcement authority associated with theselaws and regulations. Where the Privacy Enforcement Authority of an Economy assumes therole of Accountability Agent, the nomination may be done by the Economy with aconfirmation that the Privacy Enforcement Authority is a participant of the CPEA as well as asummary of how that privacy enforcement authority may enforce the program requirements of
the CBPR system.
31.
In those instances where an Economy proposes to make use of an Accountability
Agent in another participating APEC Economy to certify an applicant organization principally
located within its borders, the proposing Economy should notify the Joint Oversight Panel ofthis proposal. The proposing Economy should describe to the Joint Oversight Panel the
relevant domestic laws and regulations which may apply to the activities
Page | 8

of Accountability Agents operating within their jurisdiction and the enforcement authority
associated with these laws and regulations.
32.
All applications for recognition will include a signed attestation by the Accountability
Agent and all necessary supporting documentation as stipulated in the Accountability Agent
recognition criteria.
33.
Upon receipt of a request for recognition pursuant to paragraphs 30 or 31, the Joint
Oversight Panel will commence a review of the required documentation and request any
additional information necessary to ensure the recognition criteria have been met. When the
Joint Oversight Panel has completed this review process they will issue a recommendation to
APEC Economies as to whether or not to recognize the Accountability Agent. Economies willconsider the Accountability Agent’s request for recognition, considering the recommendationof the Joint Oversight Panel. Economies may consult stakeholders, such as business or civilsociety representatives, when considering the Joint Oversight Panel recommendation, except
with regard to business proprietary information provided by the Accountability Agent. If noobjections are received from Economies within a set deadline, the request will be considered
to be approved by the ECSG.
34.
Any APEC Economy has the right to reject the request of an Accountability Agent forsuch recognition.
35.
The Joint Oversight Panel can receive complaints regarding the conduct of arecognized Accountability Agent by Economies, businesses, consumers or others at any time.
Where appropriate, the Joint Oversight Panel can request the relevant Privacy Enforcement
Authority or other relevant Authority in the Economy where the Accountability Agent islocated to investigate the compliance of that Accountability Agent with their obligations
established in the Recognition Criteria. The Privacy Enforcement Authority or other relevant
Authority may investigate and take remedial action as necessary at its discretion as authorizedunder their domestic law. The Joint Oversight Panel may consider and recommend suspensionof an Accountability Agent’s recognition at any time.
36.
The first APEC recognition for an Accountability Agent will be limited to one
year from the date of recognition. Recognition for the same Accountability Agent will be fortwo years thereafter. One month prior to the end of the recognition period, an Accountability
Agent should re-apply for APEC recognition, following the same process described above.
During this time the Accountability Agent’s recognition will continue.
37.
When considering their recommendation to APEC Economies, the Joint Oversight
Panel will consider any relevant information including complaints received regarding the
conduct of a recognized Accountability Agent by Economies, businesses, consumers or othersin the previous year as well as any investigation request by the Joint Oversight Panel to Privacy
Enforcement Authorities or other relevant Authorities.
Process for Certification of Organizations
38.
Applicant organizations should make use of Accountability Agents located within thejurisdiction in which the applicant organization is primarily located or an Accountability
Agent recognized pursuant to paragraph 31.
39.
Once an applicant organization selects and contacts an eligible APEC-recognizedAccountability Agent, the Accountability Agent will provide the self-assessment
questionnaire to the organization for completion and will review the answers and any
supporting documentation based on its assessment guidelines or make use of APECPage | 9

recognized documentation and review procedures.
40.
The proposed application process would be iterative and allow for back and forthdiscussions between the applicant organization and the Accountability Agent.
41.
The Accountability Agent Recognition Criteria describe the role of Accountability
Agents as follows:• The Accountability Agent is responsible for the self-assessment and compliancereview phases of the CBPR System accreditation process. Applicant organizations
will be responsible for developing their privacy policies and practices and may only
participate in the CBPR System if these policies and practices are certified by therelevant Accountability Agent to be compliant with the requirements of the CBPR
System. It is the responsibility of the Accountability Agent to certify anorganization’s compliance with these requirements.
• The self-assessment questionnaire and assessment guidelines are publicly-available
documents and prospective applicant organizations will have access to the guidelines
so that they can see how their responses to the self-assessment questionnaire will beassessed. In considering how best to assist prospective applicant organizations, a
recognized Accountability Agent may wish to develop additional documentation
outlining their review process.
Role of the Privacy Enforcement Authority
42.
The CPEA defines ‘Privacy Enforcement Authority’ as any public body that is
responsible for enforcing Privacy Law, and that has powers to conduct investigations or pursue
enforcement proceedings. ‘Privacy Law’ is then defined as laws and regulations of an APEC
Economy, the enforcement of which have the effect of protecting personal informationconsistent with the APEC Privacy Framework.
•

The Privacy Enforcement Authority must be able to review a CBPR complaint/issue if
it cannot be resolved by the participating organization in the first instance or by the
Accountability Agent and when appropriate, investigate and take enforcement action.
The Privacy Enforcement Authority has the discretion to decide whether or not to deal
with a Request for Assistance made by another Privacy Enforcement Authority.

•

CPEA participation is the predicate step to any Economies’ involvement in the CBPR
System as the CPEA establishes that the Economy has a law in place “the enforcementof which, has the effect of implementing the APEC Privacy Framework.”

Page | 10

THE CBPR SYSTEM AND DOMESTIC LAWS AND REGULATIONS43.
The CBPR System does not displace or change an Economy’s domestic laws andregulations. Where there are no applicable domestic privacy protection requirements in an
Economy, the CBPR System is intended to provide a minimum level of protection.
44.
Participation in the CBPR System does not replace a participating organization’s
domestic legal obligations. The commitments which an organization carries out in order toparticipate in the CBPR System are separate from any domestic legal requirements that may
be applicable. Where domestic legal requirements exceed what is expected in the CBPR
System, the full extent of such domestic law and regulation will continue to apply. Where
requirements of the CBPR System exceed the requirements of domestic law and regulation,an organization will need to voluntarily carry out such additional requirements in order toparticipate. Nonetheless, Privacy Enforcement Authorities in that Economy should have theability to take enforcement actions under applicable domestic laws and regulations that havethe effect of protecting personal information consistent with the CBPR program requirements.
45.
For the purposes of participation in the CBPR System, an Accountability Agent's
verification will only apply to an organization's compliance with its CBPR commitments, notits compliance with applicable domestic legal requirements.
46.
Where an Economy’s domestic laws and regulations preclude or restrict that
Economy’s ability to participate in the CBPR System, it is a matter for the Economy toconsider whether and how to modify the applicable domestic laws to facilitate participation.
47.
It is not the purpose of the CBPR System to direct Economies on whether and how tomodify domestic laws and regulations. This is a matter to be addressed through capacity
building activities and other guidance run through the Data Privacy Sub-Group.
48.
However, when considering whether to participate in the CBPR System, Economies
may need to make changes to domestic laws and regulations to ensure the necessary elementsof the CBPR System are in place – for example, Economies are to identify an appropriate
regulatory authority as defined in the Cross Border Privacy Enforcement Arrangement(CPEA) to act as the privacy enforcement authority in the CBPR System.

Page | 11

GOVERNANCE OF THE CBPR SYSTEM
Objective
49.
The CBPR System requires governance mechanisms that will perform essential
operations in the administration and maintenance of the System. In the development of thegovernance model, a number of basic principles were identified:•

Simplicity;•

Transparency;•

Low cost; and•Accountability to APEC Economies.

50.
As the APEC representative body established to deal with data privacy issues, the Data
Privacy Sub-Group is responsible for the governance of the CBPR System. Governancemechanisms should enable the day-to-day running of the CBPR System without the continuous
involvement of the Sub-Group, which only meets twice a year.
51.
As APEC is a non-treaty organization with a small full-time staff, governance of the
CBPR System cannot impose onerous duties on either the Secretariat or Economies.
Functions of the Governance Model
52.
Regardless of these limitations, the governance model should nonetheless deal withthe essential administrative functions required for the CBPR System to effectively operate.
These essential functions include:•

Developing and maintaining a staffing and revenue structure to support the CBPR
System;•Managing the APEC-hosted compliance directory (see para 14);•

Facilitating participation in the CBPR System by APEC Economies, including
through capacity-building activities;•

Assessing and monitoring the compliance of recognized Accountability Agentsagainst the Recognition Criteria;•

Managing the Cross Border Privacy Enforcement Arrangement and associateddocuments and procedures; and•Developing education materials to facilitate a region-wide understanding of theelements of the CBPR System and its program requirements.

Joint Oversight Panel53.
In recognition of these requirements, Economies are to establish a Joint Oversight
Panel made up of nominated Economies approved by, and operating on behalf of, the Data
Privacy Sub-Group. This model provides a clear line of authority for the operation of the
CBPR System from the ECSG through the Data Privacy Sub-Group, in which all APEC
Economies can participate.

Page | 12

54.
The core functions of the Joint Oversight Panel are set out in 7.2 of Charter of the
APEC Cross-Border Privacy Rules and Privacy Recognition for Processors Systems Joint
Oversight Panel (Annex A)
55.
To assist the Joint Oversight Panel with the identified core functions, working groups
on certification and enforcement should be established. The working groups are to provide
representative oversight and leadership for the certification, operations, and enforcement of the
CBPR System. The Joint Oversight Panel may establish more working groups as needed.
56.
In addition to the foregoing, it is necessary to establish a process through which theData Privacy Sub-Group can monitor, evaluate and review the entirety of the CBPR System.
This process should allow Economies to develop and revise the CBPR System in response topractical experience and the changing needs of Economies.

Page | 13

SUCCESS CRITERIA FOR THE CBPR SYSTEM
57.
The CBPR System implements the Data Privacy Pathfinder. The CBPR Systemshould recognise and incorporate the core APEC principles of voluntarism,
comprehensiveness, consensus-based decision making, flexibility, transparency, open
regionalism and differentiated implementation timetables for developed and developing
Economies.
58.
In recognition of these core APEC principles, the CBPR System should satisfy theobjectives set out in the Data Privacy Pathfinder:•

promote a conceptual framework of principles of how cross-border privacy rules
should work across APEC Economies;•

develop and support consultative processes between regulators, responsible agencies,
lawmaking bodies, industry, third party solution providers, consumer and privacy
representatives;•

produce practical documents and procedures that underpin cross-border privacy rules;•

explore ways in which various documents and procedures can be implemented inpractice; and•promote education and outreach on how an accountable CBPR System works.

59.
There are three key specific criterion for judging success of both the individual
projects and the Pathfinder as a whole:•the effective protection of consumer personal information privacy in a system trusted
by consumers;•that implementation can be flexible enough to be adapted to the particular domestic
legal environment of APEC Economies, while providing certainty for system
participants; and•the regulatory burden on business is minimised while allowing business to develop
and comply with effective and coherent rules for cross-border flows of personal
information.

Page | 14

ANNEX A
CHARTER OF THE APEC CROSS-BORDER PRIVACY RULES A ND
P RIVACY R ECOGNITION F OR P ROCESSORS SYSTEMSJOINT OVERSIGHT PANEL
1. CHARACTER OF THIS DOCUMENT
1.1

This Charter is to be read consistently with the 2015 APEC Privacy Framework.
Nothing in this Charter is intended to:i.

Create any binding obligations on APEC Economies and/or their government
agencies, or affect their existing rights and obligations under international ordomestic law;ii.

Impede any governmental activities authorized by domestic or international law;iii.

Create any obligations or expectations of cooperation that would exceed a CBPR
or PRP Participant’s scope of authority and jurisdiction; oriv.

Create obligations or expectations for non-participating government agencies.

1.2 This Charter, and any amendments thereto, will take effect upon endorsement by theElectronic Commerce Steering Group (ECSG).
2. COMMENCEMENT OF PARTICIPATION IN THE CROSS BORDER PRIVACYRULES SYSTEM
2.1

An APEC Member Economy is considered a Participant in the Cross Border Privacy
Rules (CBPR) System (CBPR Participant), after the Chair of the Electronic Commerce
Steering Group (ECSG Chair) has notified the Economy that the following conditions
have been met:(i)

The Economy’s ECSG delegation, or appropriate governmental
representative, submits to the ECSG Chair a letter indicating its
intention to participate in the CBPR System and confirming that atleast one Privacy Enforcement Authority in that Economy is aparticipant in the APEC Cross Border Privacy Enforcement
Arrangement (CPEA);(ii)

The Economy indicates its intention to make use of at least one APECrecognized Accountability Agent subject to the procedures outlined inparagraph 7.2;

(iii)

The Economy’s ECSG delegation, or appropriate governmental
representative, after consulting with the Joint Oversight Panel, submits
Page |

to the Chair of the ECSG an explanation of how the CBPR System
program requirements may be enforced in that Economy; and(iv)

The Joint Oversight Panel submits to the Chair of the ECSG a report asto how the conditions in (i)-(iii) above have been satisfied.

3. COMMENCEMENT OF PARTICIPATION IN THE PRIVACY RECOGNITION
FOR PROCESSORS SYSTEM
3.1
An APEC Member Economy is considered a Participant in the Privacy
Recognition for Processors (PRP) System (PRP Participant), after the ECSG Chair has
notified the Economy that the following conditions have been met:(i)

The Economy’s ECSG delegation, or appropriate governmental
representative, submits to the ECSG Chair a letter indicating its
intention to participate in the PRP System and where under (iii), theoversight of processors recognized under the PRP includes directgovernment backstop enforcement through a Privacy Enforcement
Authority, confirming that the relevant Privacy Enforcement
Authority or Authorities in that Economy are participants in the
APEC CPEA;(ii)

The Economy indicates its intention to make use of at least one APECrecognized Accountability Agent subject to the procedures outlined inparagraph 7.2;

(iii)

The Economy’s ECSG delegation, or appropriate governmental
representative, after consulting with the Joint Oversight Panel, submits
to the Chair of the ECSG an explanation of oversight and enforcement
mechanisms available to ensure the effective oversight of processors
recognized under the PRP in that Economy, even if direct government
backstop enforcement is not applicable; and(iv)

The Joint Oversight Panel submits to the Chair of the ECSG a report asto how the conditions in (i)-(iii) above have been satisfied.

4. TRANSPARENCY
4.1

A CBPR and/or PRP Participant will provide notice to the APEC ECSG Chair of any
new laws or regulations and any amendments to existing laws or regulations as well as
all other developments that may affect the operation and enforcement of either system.

4.2

The APEC ECSG Chair will promptly notify APEC Economies of any notification
received pursuant to paragraph 4.1.

Page |

5. TERMINATION OF PARTICIPATION
5.1

A CBPR Participant may cease participation in the CBPR System by giving one
month’s written notice to the APEC ECSG Chair. A PRP Participant may cease
participation in the PRP System by giving three months’ written notice to the
APEC ECSG Chair.

5.2

The APEC ECSG Chair will promptly notify APEC Economies of any notification
received pursuant to paragraph 5.1.

5.3

In the event that a CBPR and/or PRP Participant terminates participation in either
system, or is suspended or terminated from either system, recognition of any
previously recognized Accountability Agent to operate in that Participant’s Economy
will automatically be suspended or terminated from the applicable system andthe certification of those organizations certified by that Accountability Agent will beterminated from the applicable system until such time as the Economy is able toagain fulfil the requirement for participation in the CBPR and/or PRP System, atwhich time any previously-certified applicant organizations should complete a newcertification process.

6. CAUSE FOR SUSPENSION OR TERMINATION
6.1

6.2

Participation by an APEC Economy in the CBPR and/or PRP Systems may besuspended or terminated by a consensus determination by the other APEC
Economies that one or more of the following conditions have been met:i.

Revocation, repeal or amendment of any domestic laws and/or regulations having
the effect of making participation in the APEC CBPR and/or PRP Systems
impossible;

ii.

The Participant’s Privacy Enforcement Authority as defined in paragraph
4.1 of the CPEA ceases participation pursuant to paragraph 8.2 of the CPEA; oriii

the oversight and enforcement mechanisms available to ensure the effective oversightof processors recognized under the PRP in that Economy cease to be available.

A request for a consensus determination that any condition identified in paragraph 6.1
has been met may be made by any CBPR or PRP Participant at any time.

7. JOINT OVERSIGHT PANEL
7.1

The ECSG hereby establishes a Joint Oversight Panel, consisting of representatives
from three APEC Economies, for a two-year appointment, subject to ECSG
endorsement and the terms set out in paragraph 8.2. The ECSG will endorse a
Chairperson for a two-year appointment from these three Economies. The Joint
Oversight Panel will meet at the request of the ECSG, or more frequently as decided
by CBPR and PRP Participants to assist in the effective implementation of the
Page | 3

CBPR and/or PRP Systems. The ECSG may appoint succeeding panels as it may
deem appropriate.
7.2

The Joint Oversight Panel will perform the following functions:i.

Engage in consultations with those Economies that have indicated an intention
to participate in the CBPR and/or PRP Systems and issue a report as to how theconditions set out in paragraph 2.1 and/or 3.1 respectively have been met;

ii.

Make recommendations to the APEC Economies whether to recognize an
applicant Accountability Agent as compliant with the requirements of the
CBPR and/or PRP Systems. In making such recommendations, the Joint
Oversight Panel should be satisfied of the following:a) The applicant Accountability Agent has a location in an Economy
participating in the relevant system or is otherwise subject to theenforcement and oversight identified by the economy for the
relevant system, andb) The applicant Accountability Agent meets the Recognition Criteria
established under the system in which it is seeking recognition andhas provided all necessary documentation as requested by the Joint
Oversight Panel;iii.

Consider and recommend suspension of the recognition of an Accountability
Agent at any time;iv.

Collect all case notes received by recognized Accountability Agents as
required under the Accountability Agent Recognition Criteria and circulate to
APEC Economies;v.

Collect complaint statistics from recognized Accountability Agents as required
under the Accountability Agent Recognition Criteria and circulate to APEC
Economies;

vi.

Advise recognized Accountability Agents whether or not to withdraw fromparticular engagements if a potential conflict is alleged, considering any
evidence provided by the recognized Accountability Agents as to internal
structure and procedural safeguards that are in place to address any potential
and actual conflicts of interest;vii.

Verify that each recognized Accountability Agent complies with the recertification process as required under the Accountability Agent Recognition
Criteria;

viii.

Review any reported material change by the recognized Accountability Agent(e.g. ownership, structure or policies) as required under the Accountability
Agent Recognition Criteria and report to APEC Economies its
recommendation as to whether such change impacts the appropriateness ofPage | 3

recognizing the Accountability Agent as compliant with the requirements of the
CBPR and/or PRP Systems;ix.

Facilitate the review and edit of primary documentation associated with the CBPR
and PRP Systems when necessary in conjunction with APEC Economies; andx.

Perform all other functions as identified and decided by APEC Economies asnecessary to the operation of the CBPR and PRP Systems.

7.3

All recommendations of the Joint Oversight Panel will be made by simple majority. A
dissenting member of the Joint Oversight Panel may circulate its dissent from the
majority’s recommendation on any matter to APEC Economies.

7.4

In no circumstance should a member of the Joint Oversight Panel participate in any of theactivities under 7.2 when the Accountability Agent is a public (or governmental) entity inthe member’s Economy or any of the activities under 2.1 and/or 3.1 where the interested
Economy is a member of the Joint Oversight Panel. In such instances, the Data Privacy
Subgroup Chair will designate another APEC Economy to temporarily function as amember of the Joint Oversight Panel.

7.5

The Joint Oversight Panel may establish working teams to address each of the above
functions and request assistance from the APEC Secretariat or APEC Economies asnecessary.

7.6

Recommendations by the Joint Oversight Panel will take effect upon endorsement by the
ECSG.

78. ADMINISTRATIVE MATTERS
8.1

The Chairperson of the Joint Oversight Panel will provide a summary report detailing all
activities carried out by the Joint Oversight Panel under paragraph 7 to the Data Privacy
Subgroup Chair no later than one month in advance of each Data Privacy Subgroupmeeting.

8.2

The initial terms of membership for the initial Joint Oversight Panel are as follows:

8.3

i.

One Chair to be appointed for a two-year term;ii.

One member to be appointed for an 18 month-term, and;iii.

One member to be appointed for a one-year term.

Upon expiration of the initial term, each appointment will have a two-year term
subject to re-appointment at the discretion of the ECSG based on 7.1.

Page | 3