International Developments

Impacts on Latin & South America

Agenda

• Introductions

• North America Scott Taylor

• Europe D. José Luis Rodríguez ÁlvarezLaura Juanes

• China & Japan Josh Harris

• NZ & OECD Blair Stewart

• Discussion

North America

United States– Broader view of privacy emerging at FTC and Administration – similar to EU

Data Protection view that data protection enhances other fundamental rights

– Administration and FTC calling for new laws, inaction in Congress

– Snowden revelations beginning to have impact

– States a more likely legislative forum

Mexico– New Commission at IFAI; uncertainty if IFAI remains the home of Privacy

Canada– Potential for changes in PIPEDA; New Commissioner – Daniel Therrien

Europe

Commissioner José Luis Rodríguez Álvarez

Europe

Laura Juanes

Europe

Institutions: Who’s who? – European Commission

• DG Justice: Data Protection Directive/Regulation

– European Parliament

– European Council

– Data Protection Authorities (A29 WP)

Important Distinction– Directive vs. Regulation

Europe: Significant Developments • June 2013 – European Court of Justice’s Advocate General Opinion on RTBF (Google vs. AEPD)

(http://curia.europa.eu/jcms/upload/docs/application/pdf/2013-06/cp130077en.pdf)

• Fall 2013- European Parliament's LIBE Committee issues Inquiry on Electronic Mass Surveillance of EU Citizens

• October 2013 – 35th International Conference of Data Protection and Privacy Commissioners in Warsaw (https://privacyconference2013.org/)

• October 2013 – LIBE Committee’s vote of Draft Report on the proposed GDPR (http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/pr/922/922387/922387en.pdf)

• November 2013 – European Commission releases report on safe harbor (13 recommendations)

• March 2014 – European Parliament• EP’s Plenary vote on the proposed GDPR

• EP’s Resolution calling for

– Exercising parliament right to refusal to TTIP

– Suspension of safe harbor- non binding

• April 2014 – European Court of Justice’s decision on data retention directive(http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.pdf)

• April 2014 – A29WP opinions on legitimate interests and anonymization(http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf)

(http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf)

• May 2014 – European Court of Justice’s ruling on on RTBF (google vs. AEPD)(http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-05/cp140070en.pdf)

General Data Protection Regulation Highlights

– Legal grounds for processing personal data.

– Definition of personal data

– RTBF

– Data breach notification requirements

– Accountability provisions

– DPO

– One stop shop

– Penalties

– Delegated Acts

China & Japan: International Data Privacy Engagement Through APEC

Josh Harris

Japan: Recent Activities• 7 June 2013: Senior Officials from the Ministry of Foreign

Affairs and the Ministry of Economy, Trade and Industry (METI) submitted Japan’s Notice of Intent to join the APEC CBPR System

• 25 April 2014: Formally Approved by CBPR Joint Oversight Panel

• Japan’s Notice of Intent to Participate included a confirmation that it expects to make use of at least one APEC-recognized Accountability Agent (TBD)

Japan: Accountability AgentsCertification-Related Activities of Accountability Agents in Japan made enforceable through:

1. Act on the Protection of Personal Information, Article 46

2. Act on the Protection of Personal Information, Article 47

3. Act on the Protection of Personal Information, Article 48(1)

Japan: Enforceability 50 CBPR Program Requirements made enforceable through:

1) The Act on the Protection of Personal Information

2) The Cabinet Order for the Enforcement of the Act on the Protection of Personal Information

3) The Basic Policy on the Protection of Personal Information

Japan: CPEA Participants

1. The Cabinet Office

2. Consumer Affairs Agency

3. Financial Services Agency

4. The National Police Agency

5. Ministry of Internal Affairs and Communications

6. Ministry of Justice

7. Ministry of Foreign Affairs

8. Ministry of Finance

9. Ministry of Education, Culture, Sports, Science and Technology

10. Ministry of Health, Labor and Welfare

11. Ministry of Agriculture, Forestry and Fisheries

12. Ministry of Economy, Trade and Industry

13. Ministry of Land, Infrastructure, Transport and Tourism

14. Ministry of Environment

15. Ministry of Defense

China: Recent Activities

• February 2014: APEC Data Privacy Subgroup and Related Meetings held in Ningbo, China

• 10 April 2014: 5thAPEC e-Commerce Business Alliance Forum held in Yiwu, China

• 14 April 2014: National People’s Congress and State Council hold day long workshop to consider CBPR participation, Beijing China

China: Current Legal Landscape • No established personal information

protection act

• Legal sources of China's existing personal information protection system scattered through the Constitution, laws and sectoralregulations

• May be sufficient to join CBPR system in current form

CIECC Recommendations

• Develop Uniform Privacy Code

• Establishment of an independent regulatory agency attached to the National Office of Internet Information

• Establishment of a Privacy Data Protection Committee

China: Potential Accountability Agents

• China Software Testing Center• Ministry of Public Security: Classified Security

Protection Assessment Centre• Ministry of Public Security: Institute of

Information Security Products Testing and Certification Center

• Internet Society of China Credit Evaluation Center• Dalian Software Industry Association

New Zealand & OECD

Blair Stewart

International Developments that Impact Latin America: A New Zealand Perspective

orA view from a privacy enforcement authority in an OECD country APEC economy in the South Pacific (that has an

‘EU-adequate’ data protection law)

Blair Stewart, Assistant Privacy CommissionerNew Zealand

New Zealand Snapshot• 1976: NZ’s first privacy commissioner

• 1993: First country outside Europe with comprehensive data protection law covering public & private sectors

• Privacy Act 1993 based on OECD Privacy Guidelines (1980) -proposed European Directive hastened law

• NZ a member of APEC which adopted APEC Privacy Framework in 2005

• EC decision in 2012 that NZ law provides an “adequate level of data protection” to allow unrestricted transfers of personal data from EU to NZ

International Blocs Impacting NZ

OECD Developments

• OECD Privacy Guidelines (1980) the first international instrument on privacy

• Influential and enduring (30+ years)

• OECD active through Working Party on Privacy and Security in the Digital Economy (formerly WPISP)

• Supplementary instruments in security (1992), spam (2006), privacy enforcement cooperation (2007)

OECD Privacy Guidelines 30 Year Review

• Review resulted in:

– Privacy principles remaining unchanged – still relevant 30 years on

– Some changes and new material added

Review found that the OECD Privacy Guidelines had been a remarkable success

OECD Guidelines Review Other Main Points

• More extensive/innovative uses of data bringing economic/social benefits

• Evolving uses of technology and data raise challenges for determining appropriate scope for privacy protections

• Increasingly difficult for individuals to understand and make choices in data use

• Abundance and persistence of data , readily available globally, both brings benefits and increased privacy risk

• Advances in technology and changes in organisational practices have transformed occasional transborder transfers into a continuous multipoint global flow

Updated OECD Privacy Guidelines 2013

Two themes of changes:

1. Focus on practical implementation of privacy protection though an approach grounded in risk management

2. Efforts to address global dimension of privacy through interoperability

Risk Management - Interoperability

Updated OECD Privacy Guidelines 2013

Two themes of changes:

1. Practical implementation of privacy protection though risk management

e.g.:• Privacy management programmes (implementing accountability)

• Privacy breach notification

• Properly resourced and empowered privacy enforcement authorities

• Complementary measures (e.g. education, privacy by design)

Updated OECD Privacy Guidelines 2013

Two themes of changes:

1. Practical implementation of privacy protection though risk management

2. Global interoperability

e.g.:• Complementary national privacy strategies

• Cross-border privacy enforcement cooperation

• Improving the evidence base for privacy policy making (internationally comparable metrics)

Closing Comment

OECD is a case study in a policy response to a challenging and evolving environment, the directions it recommends are broadly similar to several other international organisations, emphasising:

• Risk management

• Organisational accountability

• Interoperability

• Cross-border cooperation

Discussion