22 tailored according to the sensitivity of the information and safeguards implemented based on a privacy risk assessment.

The Privacy Guidelines specify two ways in which data can be transferred across borders. One of these reflects the accountability approach where the data controller remains accountable for personal data under its control without regard to the location of the data. The other approach allows data flows to another country that “substantially observes the Guidelines” or where “sufficient safeguards exist”, that would include mechanisms that ensure ongoing protection consistent with the Guidelines. According to the Supplementary explanatory memorandum to the Privacy Guidelines, these two principles on cross‐ border data transfer exist independently of each other (OECD 2013). These two approaches reflect the differing approaches among OECD members to cross‐border transfers ‐ the EU Directive and GDPR approaches, which limit transfers to countries providing adequate protection, and the APEC approach that allows data transfers and makes the data controller liable for any breaches of that data that arise for its use by third parties in other countries.

As outlined above, the OECD Privacy Guidelines also encourage “the development of international arrangement that promote interoperability among privacy frameworks that give practice effect to these Guidelines” (OECD 2013). How this might be accomplished is discussed below.

_The Council of Europe Data Protection Convention and Additional Protocol_ The European Council Data Protection Convention was adopted in 1980 (Council of Europe 1981) and its Additional Protocol in 2001 (Council of Europe 2001). Forty‐three Council of Europe Member States have ratified the Data Convention and 42 Member States have signed the Additional Protocol (though only 31 have ratified the Protocol). The Convention and Additional Protocol are open to accession by non‐EU states (The Convention, Article 23). The Council of Europe is also updating the Convention.

The key elements of the Convention are a set of privacy principles similar to those found in the 1980 OECD Guidelines, such as requiring personal data processing to be lawful, for specific and legitimate purposes and that it be adequate and not excessive in relation to the purposes for which the data are collected.

The Data Convention does not prohibit exports of personal data. This was changed following adoption of the Additional Protocol, which reflects the approach of the Data Directive and prohibits cross‐border data flows unless the receiving country provides an adequate level of privacy protection.

_Asia Pacific Economic Cooperation (APEC)_ The APEC Privacy Framework endorsed by APEC economies in 2004 is a set of principles to guide members and businesses on privacy issues. The Framework is a guide for APEC economies on the development of their privacy laws, thus providing a baseline set of principles. APEC does not require or expect countries to adopt top‐down privacy laws. Instead, the emphasis is on flexibility in implementation, which could include industry self‐regulation in addition to legislation.

The APEC Framework is explicit about the need to “balance and promote both effective information privacy protection and the free flow of information in the Asia Pacific region" (APEC Privacy Framework 2004). The APEC Framework outlines the economic and social benefits of access to and storage of