APEC Privacy Framework

Why does it matter?

The Framework aims at consistent rather than identical privacy protection, so organizations that move data across APEC economies can plan one privacy program that fits many national laws.

Key benefits include:

• A common baseline

Nine principles give multinational teams one structure to compare against the differing privacy laws of APEC economies.

• Proportionate duties

Safeguards and remedies scale to the likelihood and severity of harm, the sensitivity of the information, and the context in which it is held (paragraphs 20 and 28).

• Accountability for transfers

Before transferring personal information, a controller should obtain consent or exercise due diligence so the recipient protects it consistently with the principles (paragraph 32).

• A route to certification

The Framework refers to the CBPR system as an implementing measure, so principle-level work carries over to CBPR certification.

• A program model

Paragraph 44 describes a privacy management program: tailored to scale and sensitivity, risk-based, with internal oversight, trained accountable personnel, and regular monitoring and updates.

How does it work?

The Framework has four parts: the Preamble, Scope, the Information Privacy Principles (Part III), and Implementation (Part IV). The nine principles are Preventing Harm, Notice, Collection Limitation, Uses of Personal Information, Choice, Integrity of Personal Information, Security Safeguards, Access and Correction, and Accountability. They are to be read as a whole, not in isolation (paragraph 19).

Part IV guides member economies: remove unnecessary barriers to information flows, choose how to give effect to the Framework, consider establishing Privacy Enforcement Authorities, and promote privacy management programs and technical measures. For an organization the practical path is to map each principle to a policy, a control, and an owner, and to keep evidence of its privacy management program.

In SmartSuite, Privacy Management holds data inventories, privacy assessments, and requests, and Compliance Management links each principle to controls, testing, and evidence.

Key Elements

• Preventing Harm (paragraph 20)

Protections should prevent misuse of personal information, and obligations and remedies should be proportionate to the likelihood and severity of harm. After a significant security breach, notice to Privacy Enforcement Authorities or affected individuals may help reduce harm.

• Notice (paragraphs 21 to 23)

Controllers should give clear and easily accessible statements covering the fact of collection, the purposes, the types of recipients, the controller's identity and contact details, and the choices offered for limiting use and disclosure and for access and correction.

• Collection Limitation and Uses (paragraphs 24 and 25)

Collection should be limited to relevant information obtained by lawful and fair means. Use should be limited to the purposes of collection and compatible or related purposes, except with consent, when needed to provide a requested service, or by authority of law.

• Choice (paragraph 26)

Where appropriate, individuals should have clear, prominent, easily understandable, accessible, and affordable mechanisms to exercise choice over collection, use, and disclosure.

• Integrity and Security Safeguards (paragraphs 27 and 28)

Personal information should be accurate, complete, and up to date for its purposes. Safeguards against loss, unauthorized access, destruction, use, modification, or disclosure should be proportional to harm and sensitivity and subject to periodic review.

• Access and Correction (paragraphs 29 to 31)

Individuals should be able to confirm whether a controller holds their information, receive it within a reasonable time, at a charge that is not excessive, in an understandable form, and challenge its accuracy. Access may be refused where the burden is disproportionate or disclosure is barred for legal or security reasons.

• Accountability (paragraph 32)

A controller is accountable for complying with the measures that give effect to the principles, including when it transfers information, domestically or internationally, to another person or organization.

What does it cover?

The Framework applies to information about natural living persons, not legal persons, including information that would identify an individual when combined with other information, such as aggregated metadata. It applies to controllers in the public and private sectors. A person who processes information as instructed by another is not a controller for this purpose.

What are its objectives?

The Preamble states the purposes the Framework was developed and updated to serve (paragraph 8).

Implement appropriate privacy protections, particularly against harm from intrusions and misuse of personal information.

Keep information flowing, because the free flow of information supports trade and economic and social growth.

Let global companies adopt uniform approaches within their organizations for access to and use of personal information.

Empower Privacy Enforcement Authorities to fulfill their mandate to protect individual privacy.

Promote interoperability with the CBPR system, the CPEA, and privacy arrangements in other regions.

Framework in Context

The Framework is consistent with the core values of the OECD Guidelines, and the CBPR system (endorsed by APEC Leaders in 2011) and the CPEA are its implementing measures. Organizations commonly map it to the OECD Guidelines, Convention 108, GDPR, ISO/IEC 27701, ISO/IEC 29100, and the NIST Privacy Framework.

Common Framework Mappings

The Framework sits beside several international privacy instruments; the frameworks below overlap with its nine principles.

Mapped frameworks include:

APEC CBPR System

APEC Privacy Recognition for Processors (PRP)

Convention 108+

GDPR

ISO 27701

ISO 29100

NIST Privacy Framework v1.0

OECD Privacy Guidelines