GLOBAL COOPERATIONENFORCEMENT

1

ARRANGEMENTFOR

PRIVACYOBJECTIVES

1.1 The Global Cooperation Arrangement for Privacy Enforcement (“Global
CAPE”) is a key step in achieving the goals of the Global CBPR Forum(“Forum”).
1.2 The Global CBPR Framework calls on Members to have arrangements andprocedures to facilitate cross-border cooperation in the enforcement of Data
Protection and Privacy Laws. The Global CBPR Framework contemplates
bilateral or multilateral arrangements that include the following:•mechanisms for promptly, systematically and efficiently notifying
designated public authorities in other Members of investigations or dataprotection and privacy enforcement matters that target conduct that isinconsistent with the protections set forth in the Global CBPR
Framework and may affect individuals or personal information
controllers in those other Members;•mechanisms for effectively sharing information necessary for successful
cooperation in cross-border data protection and privacy investigationand enforcement cases;•

mechanisms for investigative assistance in data protection and privacy
enforcement cases;•

mechanisms to prioritize cases for cooperation with public authorities inother Members based on the severity of the unlawful infringements ofthe protection of personal information and privacy, the actual or potential
harm involved, as well as other relevant considerations; and•steps to maintain the appropriate level of confidentiality in respect of
information exchanged under the cooperative arrangements. 1

Part IV, Global CBPR Framework, available at https://www.globalcbpr.org/wpcontent/uploads/Global-CBPR-Framework-2023.pdf

11

1.3 The Forum hereby establishes the Global CAPE. The goals of the Global
CAPE are to:2•

facilitate information sharing among Participants;•

establish mechanisms to promote effective cross-border cooperation
between Participants on the enforcement of Data Protection andPrivacy Laws as well as the Global CBPR Framework, including throughreferrals of matters and through parallel or joint investigations orenforcement actions; and•encourage information sharing and cooperation on data protection andprivacy investigation and enforcement with Non-Participating
Authorities, including by ensuring that the Global CAPE can work
seamlessly with similar arrangements, frameworks and networks.

OUTLINE OF THE GLOBAL CAPE

2.1 The Global CAPE is a practical multilateral mechanism for Participants tocooperate in cross-border data protection and privacy enforcement. It does
this by creating a framework under which Participants may, on a voluntarybasis, share information and request and render assistance in certain ways.
2.2 A jurisdiction can have more than one Participant, provided each of themmeets the definition in paragraph 3.1(f).
2.3 The structure of this Cooperation Arrangement is set out as follows:•

objectives of the Global CAPE (paragraph 1)•

definitions and limitations (paragraphs 3, 5 and 6);•

designation and role of the Administrator (paragraph 4);•

participation, or cessation of participation, in the Global CAPE
(paragraph 7);•

cross-border cooperation (paragraph 8);•

confidentiality (paragraph 9);•

information sharing (paragraph 10); and2

•miscellaneous matters (staff exchanges, costs disputes and review)(paragraphs 11 to 14).

2.4 Annexed to this Cooperation Arrangement are:3•

Request for Assistance form (Annex A).

•

Participant Contact Point Designation Form (Annex B).

•

A template for a summary statement of Participant’s practices, policies
and activities (Annex C).

DEFINITIONS

3.1 In this Cooperation Arrangement:(a) ”Administrator” means the body or bodies designated underparagraph 4.1.
(b) “Data Protection and Privacy Laws” mean laws and regulationsof a Participant’s jurisdiction, the enforcement of which has theeffect of protecting personal information consistent with the Global
CBPR Framework.
(c) “Member” means a jurisdiction which meets the criteria formembership of the Forum as prescribed in Annex A of the Forum’s
Terms of Reference, and is admitted as a member of the Forum.
(d) “Non-Participating Authority” means a Privacy Enforcement
Authority not participating in the Global CAPE.
(e) “Participant” means a Privacy Enforcement Authority thatparticipates in the Global CAPE.
(f) “Privacy Enforcement Authority” means any public body that is
responsible for enforcing Data Protection and Privacy Laws, andthat has powers to conduct investigations and/or pursue
enforcement proceedings.
(g) “Receiving Authority” means a Participant that receives a“Request for Assistance” from another Participant.
(h) “Request for Assistance” includes, but is not limited to:(i) a referral of a matter related to the enforcement of Data
Protection and Privacy Laws;(ii) a request for cooperation on the enforcement of Data Protection
3

(i)

4

and Privacy Laws;(iii) a request for cooperation on the investigation of an alleged
breach of Data Protection and Privacy Laws; and(iv) a transfer of a data protection and privacy complaint.
“Requesting Authority” means a Participant that makes a Request
for Assistance of another Participant.

DESIGNATION AND ROLE OF THE ADMINISTRATOR

4.1 The Forum will designate as Administrator one or more of the following:(a)

Privacy Enforcement Authorities (with their consent);(b)

entities other than Privacy Enforcement Authorities from Members.

4.2 The designation under paragraph 4.1 may be for a limited duration and may
be revoked or altered by the Forum at any time. In the event that theAdministrator ceases to be so designated and the Forum has notdesignated any Administrator (i.e., there is no Administrator), the Forum will
perform the core functions of the Administrator pending any new designation(and may perform any of the additional functions).
4.3 The Administrator will perform the following core functions:(a) receive:(i) notices of intent to participate in the Global CAPE underparagraph 7.1 or 7.2;(ii) notices of intent to cease participation in the Global CAPE underparagraph 7.3; and(iii) Participant Contact Point Designation Forms under paragraph
10.1;(b) upon receipt of written notices of intent to participate in the Global
CAPE under paragraph 7.1 or 7.2, verify that the interested
authorities meet the definition in paragraph 3.1(f);(c) notify all existing Participants of the received written notices of intent
to participate;(d) notify interested authorities of the outcome of verification underparagraph 4.3(b), and subject to this outcome, arrange for the
documents received under paragraph 4.3(a) to be made available
4

(e)

(f)

through the Forum’s website or other appropriate accessiblemeans;
acknowledge receipt of written notices of intent to cease
participation in the Global CAPE under paragraph 7.3, and notify
the other Participants of such notices;maintain and make available:(i) an up-to-date list of current Participants; and(g)(ii) a compilation of Participants’ contact points; andreview the operation of the Global CAPE three years after its
establishment as set out in paragraph 14.

4.4 The Administrator may also perform the following additional functions:(a) publicise the Global CAPE in conjunction with the Forum,
organisations certified under the Global Cross-Border Privacy Rules
and Global Privacy Recognition for Processors Systems,
Accountability Agents recognised by the Forum, and otherstakeholders;(b) promote initiatives to support cooperation amongst Participants
through, for instance, teleconferences, seminars, staff exchanges,
and cooperation with other enforcement networks or pursuant toother arrangements; and(c) facilitate exploring, recording and reviewing common enforcement
priorities.
4.5 If more than one entity listed in paragraph 4.1 have been designated as
Administrator, the Administrator will make decisions based on consultations
and consensus.

5

CHARACTER OF THIS COOPERATION ARRANGEMENT

5.1 This Cooperation Arrangement is to be read in a manner that is consistent
with the Global CBPR Framework.
5.2 Nothing in this Cooperation Arrangement is intended to:(a)create binding obligations, or affect existing obligations underinternational or domestic law, or create obligations under the laws5

of the Participants’ jurisdictions;6(b)prevent a Participant from seeking assistance from or providing
assistance to another Participant or a Non-Participating Authority,
pursuant to other agreements, treaties, arrangements, or practices;(c)affect any authority or right of a Participant or Non-Participating
Authority to seek information on a lawful basis, including in law
enforcement matters, from a person located in another Participant’s
jurisdiction, nor is it intended to preclude any such person fromvoluntarily providing information to a Participant or NonParticipating Authority;(d)

impede governmental activities authorized by law when taken toprotect security, public safety, sovereignty or other public policy ofa Participant’s jurisdiction;(e)create obligations or expectations of cooperation that would exceed
a Participant’s scope of authority and jurisdiction;(f)create obligations or expectations for other, non-participating
government agencies; or(g)affect any authority or right to use information pursuant to a mutual
legal assistance treaty (“MLAT”) or other applicable international
agreements between the Requesting and Receiving Authorities'
governments.

LIMITATIONS ON ASSISTANCE

6.1 At its sole discretion, a Participant may at any time decline to accept orproceed with a Request for Assistance, or limit its cooperation under any of
the following circumstances:(a)the matter is inconsistent with domestic law or policy;(b)

the matter is not within the Participant’s scope of authority or
jurisdiction;(c)the matter is not an act or practice of a kind that both the Requesting6

Authority and Receiving Authority are authorized to investigate orenforce against under their Data Protection and Privacy Laws;(d)there are resource constraints;(e)the matter is inconsistent with other priorities;(f)there is an absence of mutual interest in the matter in question;(g)

the matter is outside the scope of the Global CAPE;(h)another body (including a private sector body, consistent withparagraph 8.4) is a more appropriate body to handle the matter; and(i)any other circumstances that render a Participant unable tocooperate.

6.2 The Receiving Authority may notify the Requesting Authority of the basis ofthese circumstances in writing.

7

PARTICIPATION IN THE GLOBAL CAPE

7.1 A Privacy Enforcement Authority interested in participating in the Global
CAPE may apply to participate in the Global CAPE by giving a written noticeto the Administrator. The written notice should include confirmation that theinterested Privacy Enforcement Authority meets the definition in paragraph3.1(f). The Administrator should notify all existing Participants of the written
notice. The interested Privacy Enforcement Authority’s participation in the
Global CAPE will take effect after the Administrator has formally accepted
the interested Privacy Enforcement Authority’s written notice, subject to theoutcome of paragraphs 4.3(b) and 4.3(c).
7.2 A jurisdiction can have more than one Privacy Enforcement Authority inaccordance with paragraph 2.2. Where there is more than one Privacy
Enforcement Authority interested in participating in the Global CAPE from asingle jurisdiction, a single written notice for joint application to participate
may be given to the Administrator on behalf of all the interested Privacy
Enforcement Authorities, by one of the interested Privacy Enforcement
Authorities or a government agency of that jurisdiction. The written notice
should include confirmation that all the interested Privacy Enforcement
7

Authorities meet the definition in paragraph 3.1(f).
7.3 A Participant may cease participation in the Global CAPE by giving twomonths’ written notice to the Administrator. The Administrator should notify
all other existing Participants of the written notice.
7.4 After its written notice to participate has been formally accepted by the
Administrator, or its written notice to cease participation has been
acknowledged by the Administrator, a Privacy Enforcement Authority shouldtake reasonable steps to make its participation or cessation of participation
known to other Participants and stakeholders as soon as practicable. Thisshould include posting information on the Privacy Enforcement Authority’s
participation or cessation of participation in the Global CAPE to the Privacy
Enforcement Authority’s website. In case of cessation of participation,
posting the information should continue during the period the Privacy
Enforcement Authority has participated in the Global CAPE and for areasonable period after ceasing to participate. 2
7.5 A Participant planning to cease participation in the Global CAPE that has
made or received, or is currently acting upon, a Request for Assistanceshould consider whether it will be able to fulfil what is expected of it under
the Global CAPE in relation to the request after it has ceased participation.
If the request will be affected, the Participant should make best efforts toprotect the interests of the other Participants and individuals concerned andensure that they are advised of, or consulted upon, any actions to be taken.
For greater certainty, making best efforts includes the honoring of existing
joint activities arising from the use of the Global CAPE.
7.6 The Administrator will inform the Forum when the Administrator has formally
accepted written notices of intent to participate or has acknowledged written
notices of intent to cease participation.

8

CROSS-BORDER COOPERATION
Cross-border cooperation on enforcement of Data Protection and2 This should include the date on which a Privacy Enforcement Authority starts or ceases
participation in Global CAPE.
8

Privacy Laws
8.1 Subject to paragraphs 5 and 6, Participants should assist one another byconsidering other Participants’ Requests for Assistance, and share
information and cooperate on the investigation or enforcement of Data
Protection and Privacy Laws.
Prioritisation of matters for cross-border cooperation
8.2 Given that cross-border cooperation can be complex and resourceintensive, Participants may individually or collectively prioritize thosematters that are most serious in nature based upon the severity of theunlawful infringements of the protection of personal information or privacy,
the actual or potential harm involved, as well as other relevant
considerations. Participants requesting prioritisation of a particular Request
for Assistance should specify the reasons in the Request for Assistanceform.
8.3 Subject to paragraphs 6.1 and 8.2, Participants recognize the enforcementof the Global CBPR Framework as a priority for cooperation in the Global
CAPE.
Cooperation with other entities outside of the Global CAPE
8.4 Participants should make best efforts within the limits of their respective
authority to cooperate with private sector organizations, self-regulatory
bodies and Non-Participating Authorities, whose responsibilities include theresolution of individuals’ data protection and privacy complaints.
Participants are in particular encouraged to cooperate with Accountability
Agents involved in the enforcement of the Global CBPR Framework.
8.5 Participants should make best efforts within the limits of their respective
authority to cooperate with other public sector bodies including law
enforcement bodies, subject to paragraph 9.
Steps prior to requesting assistance
8.6 Before a Requesting Authority makes a Request for Assistance to a
Receiving Authority, the Requesting Authority should:(a)ascertain that the request is consistent with the Global CAPE and9the goals of the Global CBPR Framework;(b)seek consent, where appropriate and subject to any otherrequirements, policies or practices applicable to the Requesting
Authority, of individual complainants to provide information about
their complaint to the Receiving Authority;(c)check the accessible information on the Receiving Authority’s
practices, policies and activities (see paragraphs 10.2 and 10.3);(d)perform a preliminary enquiry, where appropriate and practicable,
to identify which entity in the Receiving Authority’s jurisdiction has
front-line responsibility with respect to the contemplated Request for
Assistance consistent with paragraphs 8.4 and 8.5; and(e)perform a preliminary enquiry, where appropriate, with the
Receiving Authority (through its contact point as designated underparagraph 10.1 or other appropriate entity in its jurisdiction, if any,
which was identified through the preliminary enquiry made inaccordance with Paragraph 8.6(d)) and provide information asnecessary, to ascertain if the Receiving Authority will have andaccept jurisdiction over the contemplated Request for Assistance.

Requesting assistance
8.7 A Requesting Authority should:(a)use the ‘Request for Assistance’ form (attached at Annex A) to
communicate key information about the matter in question;(b)

provide sufficient additional information (if any) for the Receiving
Authority to take action, such as identifying any special precautions
that should be taken in the course of fulfilling the request;(c)specify the purpose for which any information requested from theReceiving Authority will be used and the persons to whom theinformation may be transferred; and(d)provide information, or other assistance, requested by the
Receiving Authority to assist with the handling of the referred matter.

8.8 A Receiving Authority should:
10

(a)

acknowledge the Request for Assistance as soon as reasonably
practicable after receiving it;(b)at the time of acknowledgement, or as soon as reasonably
practicable thereafter, indicate whether it accepts or declines therequest in whole or in part;(c)

promptly inform the Requesting Authority if more information isneeded to enable a decision on accepting or declining the request;(d)

if declining the Request for Assistance, provide the reason(s) forsuch a decision, in accordance with Paragraph 6.1, and refer theRequesting Authority, where feasible and appropriate, to a bodywhich may be able to handle the request (consistent withparagraphs 8.4 and 8.5);(e)

if limiting the extent of cooperation, provide the reason(s) for suchdecision and advise any condition(s) to be imposed for rendering
assistance; and(f)

if accepting the Request for Assistance:(i) process that request according to its usual policy and practice;(ii) where feasible and appropriate, communicate with theRequesting Authority about matters that may assist with theprocessing of the matter in question; and(iii) where feasible and appropriate, keep the Requesting Authority
informed of the progress and outcome of the referred matter.

Communication to assist ongoing investigations
8.9 Participants should communicate with each other, as appropriate, about
matters that may assist ongoing investigations.
Use of information obtained during cross-border cooperation
8.10 The Requesting Authority and the Receiving Authority will, on a bilateralbasis, determine permissible uses of shared information consistent withapplicable laws and policies.
Notice of possible breaches in another Participant’s jurisdiction11

8.11 A Participant may, if it considers appropriate, provide another Participant
with notice of a possible breach of the Data Protection and Privacy Laws ofthat other Participant’s jurisdiction.
8.12 Where appropriate and feasible, Participants should coordinate theirinvestigations and enforcement activity with that of other Participants topromote more effective investigations and enforcement.

9

CONFIDENTIALITY

9.1 Subject to paragraphs 8 and 9.3, and in accordance with any laws
applicable to the Requesting and Receiving Authorities, consultations, othercommunications or information shared between Participants pursuant to the
Global CAPE, are confidential and will not be disclosed.
9.2 Each Participant should, to the fullest extent possible and consistent with its
jurisdiction’s laws, use best efforts to maintain the confidentiality of any
information communicated to it in confidence by another Participant andrespect any safeguards sought by the other Participant.
9.3 Nothing in this Cooperation Arrangement prevents disclosure of confidential
information to third parties, such as other law enforcement agencies, if suchdisclosure is required by the law of the jurisdiction of a Participant thatreceived confidential information. Participants should state clearly all likely
requirements for disclosure in their statements of practices, policies andactivities (see paragraphs 10.2 and 10.3) and an updated statement ofpractices, policies and activities should accompany a Request for
Assistance when seeking confidential information from another Participant.
Where a Participant that received confidential information 3 is subject to alegal requirement to disclose, it should make best efforts to notify the otherParticipant from which it received the information at least ten days inadvance of any such proposed disclosure or, if such notice cannot be given,
then as promptly as possible.
9.4 Confidential information disclosed under paragraph 9.3 should be subject to
A Participant that received confidential information can be either a Requesting Authority
or Receiving Authority.
3

12

appropriate confidentiality assurances.
9.5 Upon ceasing participation in the Global CAPE, a Privacy Enforcement
Authority should maintain the confidentiality of any information provided to
it in confidence by another Participant. Any information provided through the
Global CAPE should be held securely and confidentially, returned orotherwise handled in accordance with the consent of the Participant thatprovided it.
9.6 Subject to paragraphs 8.10 and 9.3, Participants should reject, to the fullest
extent possible consistent with their jurisdiction’s laws, any application by athird party for disclosure of confidential information or materials received
from other Participants, subject to consultation with the Participants thatprovided the information.
9.7 Each Participant should endeavour to safeguard the security of any
information received through the Global CAPE. To this effect, a Participant
should have in place appropriate measures to prevent loss, unauthorized or
accidental access, processing, use or disclosure of any information received
through the Global CAPE. Any information received through the Global
CAPE should not be retained for longer than required by domestic law or
than is necessary for the fulfillment of the purpose for which the information
is to be used.

10 INFORMATION SHARING
Contact point designation
10.1 Each Participant should designate a contact point for the purposes
addressed in the Global CAPE and as the main, but not exclusive, point ofcontact for other Participants. The Participant Contact Point Designation
Form (or an updated version provided for this purpose by the Administrator)
attached at Annex B of this Cooperation Arrangement may be used.
Participants’ statement of practices, policies and activities
10.2 Participants should prepare a statement of information related to theirenforcement practices and policies and other relevant activities.
Participants should take steps to make this statement accessible to other13Participants, for example, by posting it on their website. Availability of thesestatements will improve Participants’ collective understanding of how
enforcement is conducted within respective jurisdictions as well as assistingin the facilitation of particular Requests for Assistance.
10.3 The Administrator may request Participants to file summary statements ofenforcement practices to be available to Participants in a central repository.
If doing so, the Administrator will use the template attached at Annex C ofthis Cooperation Arrangement or an updated version of that template.
Participants should provide the Administrator with an updated summary
within a reasonable time frame if their policies or practices change.
Sharing of experiences
10.4 Each Participant is encouraged, where feasible and appropriate, to provide
information in their possession to other Participants in respect of importantdevelopments in relation to matters within the scope of the Global CAPE,
including:(a)surveys of public attitudes bearing upon enforcement matters;(b)details of research projects having an enforcement or cross-bordercooperation dimension;(c)enforcement training programmes;(d)changes in relevant legislation;(e)experiences with various techniques in investigating data protection
and privacy violations and with regulatory strategies, including selfregulatory strategies, involving such violations;(f)information about trends and developments in the types andnumbers of complaints and disputes they handle; and(g)opportunities for data protection and privacy enforcement staff
training and employment.

11 STAFF EXCHANGES
11.1 Participants may explore bilateral opportunities to arrange secondments of14

staff or staff exchanges or enable specialist staff to assist other Participantsin particular matters.
11.2 Participants may also, where appropriate, consider the feasibility of:(a)enabling staff to participate in training programmes that anotherParticipant is conducting;(b)developing joint training programmes; and(c)sharing specialist training resources.

12 COSTS12.1 Each Participant bears its own costs of providing information or assistancethrough the Global CAPE and in otherwise cooperating as contemplated bythis Cooperation Arrangement.
12.2 Participants may negotiate to share or transfer costs of responding to a
specific Request for Assistance, offer of training, or other cooperation.

13 DISPUTES
13.1 Any dispute between Participants in relation to the Global CAPE is to beresolved by discussions between them through their designated contact
points and, failing resolution in a reasonably timely manner, by discussion
between the heads of the Participants.

14 REVIEW OF THIS COOPERATION ARRANGEMENT
14.1 Through a consultative process, Participants are to review this Cooperation
Arrangement and operation of the Global CAPE three years after its
establishment.
14.2 Upon completion of the review, the Administrator is to submit a report to theForum giving an account of the review and offering recommendations of any
necessary or desirable changes to this Cooperation Arrangement for theForum’s consensus decision.
15

14.3 The Administrator is to communicate the Forum’s decision on the report to
the Participants.

16

Annex A

Request for Assistance Form
Please see the instructions below
Date of the request:
1. Case name

2. Authority contact details
From:
Requesting Authority,
Jurisdiction
Contact Person,
Title
Telephone

Email Address
Postal address

17Annex A

To:
Receiving Authority,
Jurisdiction
Contact Person,
Title
Telephone

Email Address
Postal address

3. Confidentiality requirements

4. Assistance requested

5. Time and manner of response18Annex A

6. Organization(s) involved

Name

Address/URL
Contact Person,
Title
Telephone,
Email Address
Principal Activities
Any additional background information:

7. Individual(s) involved

Name

Address/URL
Telephone,
Email Address
Any additional background information:

19

Annex A

8. Background and status of the investigation

9. Type of Privacy Principles at Issue
You may add explanation under each principle if necessary.
YES

NO

Preventing harm (Global CBPR Privacy Principle 1)[e.g. risk of harm that may result from the misuse of
personal information]
Notice (Global CBPR Privacy Principle 2)[e.g. notification of, and information on, the existence ofdata processing]
Collection Limitation (Global CBPR Privacy Principle
3)[e.g. personal information collected is limited to
information that is relevant to the stated purposes ofcollection; has been obtained by lawful and fair means;
and, where appropriate, with notice to, or consent of, theindividual concerned]
Uses of Personal Information (Global CBPR Privacy
Principle 4)[e.g. personal information only used to fulfill the20Annex A

purposes of collection and/or related purposes except:
with the consent of the individual whose personal
information is collected; when necessary to provide aservice/product requested by the individual; or, by theauthority of law and other legal instruments,
proclamations and pronouncements of legal effect.]
Choice (Global CBPR Privacy Principle 5)[e.g. the provision of clear, accessible and affordable
mechanisms to exercise choice in relation to thecollection, use and disclosure of an individual’s personal
information, where appropriate].
Integrity of Personal Information (Global CBPR
Privacy Principle 6)[e.g. personal information is accurate, complete andkept up-to-date to the extent necessary for the purposes
of use.]Security Safeguards (Global CBPR Privacy Principle
7)[e.g. personal information controllers have used theappropriate administrative, technical or procedural
mechanisms for insuring the confidentiality, integrity,and protection of data.]
Access and Correction (Global CBPR Privacy
Principle 8)[e.g. individuals are able to: obtain confirmation ofwhether or not the personal information controller holds
personal information about them; challenge theaccuracy and, if possible have the information rectified,21

Annex A

completed, amended or deleted, where possible.]
Accountability (Global CBPR Privacy Principle 9)[e.g. personal information controller is accountable forcomplying with measures that give effect to the Global
CBPR Privacy Principles, including when transferring
personal information domestically or internationally.]

10. Possible law violations, potential sanctions, on-going proceedings andcontemplated proceedings

11. Other Relevant Information

22Annex A

Instructions
1.

Case name

Provide a name, number or other indication that can be used to refer to the request.

2.

Authority contact details

Provide the contact details specified in the form for the Requesting Authority and the Receiving Authority.
Where appropriate, provide contact information for any other Authorities (domestic or foreign) that have been
involved in the investigation or whose assistance has been requested, to help ensure effective co-ordination.

The Administrator maintains a directory of Participants. The directory may assist in the identification ofParticipants in another jurisdiction. To access this directory conditions apply. Please contact theAdministrator designated in accordance with paragraph 4 of this Cooperation Arrangement.

3.

Confidentiality requirements

Indicate what confidentiality requirements are requested of the Receiving Authority. For some requests,
assurances regarding confidentiality may be needed prior to transmitting this Request for Assistance (which
will likely contain the information for which confidential treatment is required). Requesting Authorities cancontact the Receiving Authority in advance to specify and obtain agreement on the confidentiality
requirements. In addition, indicate any special instructions as to how the information provided should be
handled (e.g. whether the individuals or organizations concerned can be contacted).

4.

Assistance requested

Describe the type of information needed or other type of assistance sought and indicate why the information
will be of assistance.

5.

Time and manner of response

Indicate the preferred manner in which the response/information is to be transmitted (e.g. telephone, email,courier, computer disk) as well as any deadlines by which the information is needed. If there are any special
evidentiary or procedural requirements that should be observed by the Receiving Authority these could be
noted as well. Describe reasons for why the Request for Assistance should be given priority.

6.

Organization(s) involved

Identify the organization involved in the request, including its contact details and information about its
principal activities. As needed, copy and complete the table for other organizations or agents involved.

23

Annex A

7.

Individual(s) involved

Identify or describe the individual(s) whose personal information is at issue. As needed, copy and complete
the table for other individuals whose personal data is at issue.

8.

Background and status of the investigation

Provide a short summary of the background and current status of the investigation. This summary should
include relevant background facts underlying the investigation. Possible issues to mention could include,e.g., the date and description of key activities, investigative avenues already pursued, whether there has
been any attempt by the individual to seek redress from the organisation or an Accountability Agent and key
facts that give rise to the cross- border dimension.

9.

Type of Privacy Principles at Issue

Indicate whether the subject matter of the Request relates to any of the privacy principles described in thetable. You may add an explanation under each principle if necessary.

10. Possible law violations, potential sanctions, on-going proceedings and contemplated
proceedings
Where appropriate, indicate the possible laws or regulations that may have been violated, the possible
sanctions that could be applied, as well as information on any on-going and contemplated proceedings. Notethat links to the full texts of national laws should be available elsewhere, but that some description or citation
to the relevant provisions may be useful to the Receiving Authority in determining how to respond to theRequest.

11. Other Relevant Information
Provide any additional information that may be helpful in responding the Request.

24

Annex B

Participant Contact Point Designation Form
Name of Participant:Date:

Contact Point
Please provide information for each category. This information will be maintainedin a non-public list.
Jurisdiction
Name
Title/Position
Address
Telephone
Fax
E-mailWebsite address(Optional)
Other
Privacy
Enforcement
Authorities based inyourjurisdiction
and their website
addresses25Annex C

Summary statement of Participant’s enforcement
practices, policies and activities
This form seeks to capture in summary form the enforcement jurisdiction andpolicies of each Participant in the Global Cooperation Arrangement for Privacy
Enforcement (Global CAPE). The information will usually be posted on therelevant Participant’s website and, when available, at a central reference point
maintained by the Administrator.
Participant name:
Jurisdiction:
Website address:
Key law(s) enforced by Participant:(Consider including a link to the relevant legislation)

General sectors/jurisdictions regulated by Participant:(Public sector, private sector, a particular industry sector? Do you operate in aparticular geographical jurisdiction such as a state or province?)

26

Annex C

Approach to investigation / resolution of enforcement matters:(What are your key enforcement activities or roles? For example, do you
receive complaints, grant approvals, investigate, mediate or makedeterminations on matters? Broadly speaking, what are your investigation
processes? What are your enforcement powers?)

Prioritization policies:(Do you have a policy on the prioritization of enforcement matters it is willing tohandle? If so, please provide a link to your current policy)

Other relevant information:(Are there any restrictions on how you can cooperate on enforcement? Are
there any circumstances in which you may be required by law to provide
information obtained through the Global CAPE to a third party?)27