APEC Privacy Framework and Cross-Border Data Transfer Mechanisms
The APEC Privacy Framework (2004, revised 2015) is voluntary, non-binding guidance. It sets nine principles: Preventing Harm, Notice, Collection Limitation, Uses of Personal Information, Choice, Integrity of Personal Information, Security Safeguards, Access and Correction, and Accountability.
CBPR and PRP
The Cross-Border Privacy Rules system (endorsed 2011, updated 2015) lets an organization certify its privacy practices through an Accountability Agent in a participating economy. CBPR covers controllers; the Privacy Recognition for Processors (PRP) covers processors. Enforcement runs through the participating economy's law or enforceable self-regulation, and the Cross-border Privacy Enforcement Arrangement (CPEA) supports cooperation among enforcement authorities. The Global CBPR Forum (2022) extends the model beyond APEC.
Worked example
A US cloud provider certified under CBPR processes a Singapore bank's customer data. The bank's PDPA transfer limitation can be met by relying on the certification plus a contract; the provider's CBPR certification evidences comparable protection. Certification does not make the provider directly subject to Singapore law.
Traps
- Calling CBPR a treaty or a mutual adequacy finding.
- Assuming PRP certification satisfies controller obligations.
- Forgetting that the Framework is non-binding, so domestic law still controls.