Singapore Joins Asia-Pacific Privacy System for Data Transfers (1)

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By George Lynch

The international business hub of Singapore has joined two Asia-Pacific regional certification systems that aim to harmonize data privacy rules across the region and allow certified companies to more easily transfer data, its privacy regulator announced March 6.

Companies in countries participating in the certification systems that verify their voluntary compliance with the Asia Pacific Economic Cooperation (APEC) Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) System can more easily transfer personal data to other certified companies in participating countries. Consumers can look to the systems to subject their information to data protection standards.

“Singapore’s joining of the APEC CBPR and PRP represents a significant boost to the CBPR system as a whole,” Markus Heyder, vice president and senior policy counseler for the Centre for Information Policy Leadership at Hunton Williams LLP in Washington, told Bloomberg Law. The decision of a global corporate hub with a progressive privacy regulator “to participate in a co-regulatory accountability framework and cross-border data transfer scheme like the CBPR and PRP surely will send a signal to other jurisdictions and encourage them to follow suit,” Heyder said.

The APEC CBPR system requires a country to adopt national data transfer procedures, including an independent public or private sector accountability agent and an enforcement agency. Businesses in Singapore that may want to participate in the system must then develop internal rules on cross-border data privacy procedures that comply with minimum requirements based on the APEC Privacy Framework. Singapore became the sixth country to participate, joining U.S., Mexico, Canada, Japan, and South Korea.

“As big data, artificial intelligence and other innovations translate into new business ventures, the need for seamless and secure data flows will only increase in importance,” Shannon Coe, chair of the APEC Electronic Commerce Steering Group, which administers CBPRs, said in a statement.

Wilbur Ross: Privacy Impacts One Third of Globe

Singapore also became the second country to join the APEC PRP System, which allows companies that gain the program’s certification to market their services more easily to multinationals doing business in APEC member countries, including the U.S. The U.S. was the first and only country to participate in the PRP System before Singapore joined.

The PRP program, finalized by APEC in September 2016, includes baseline security, privacy, and accountability standards that companies must comply with in order to obtain certification. The country’s accountability agent certifies that specific companies’ policies comply with APEC standards.

Data processors join PRP to demonstrate to data controllers that they have strong data privacy processes in place that have been vetted by a third party, which is an extremely useful recognition to receive, Josh Harris, director of international regulatory affairs at Trustarc Inc., a privacy compliance and risk management company, told Bloomberg Law. Trustarc serves as the U.S. accountability agent for CBPRs.

“We congratulate Singapore on participating in the CBPR and PRP systems,” U.S. Commerce Secretary Wilbur Ross told Bloomberg Law in an emailed statement. “When fully implemented, the CBPR system would raise privacy protections for more than one-third of the global population and protect data flows for 49 percent of global trade.”

Data processors are organizations that process data at the direction of a data controller, an organization that decides the purposes for which, and the way in which data is processed.

Singapore’s Personal Data Protection Commission (PDPC) is working to develop a CBPR- and PRP-compliant certification scheme by the end of 2018, according to its Ministry of Communications and Information.

APEC has 21 Pacific Rim country members, which account for approximately 54 percent of total global GDP and 44 percent of the total world trade, according to the Office of the U.S. Trade Representative.

To contact the reporter on this story: George Lynch in Washington at glynch@bloomberglaw.com

To contact the editor responsible for this story: Donald Aplin at daplin@bloomberglaw.com

Copyright © 2018 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law: Privacy & Data Security