The U.S. Department of Commerce Intends to Leave APEC for New Global CBPR Forum

May 2022

By Andrew Scott

On Thursday, April 21, 2022, the U.S. Department of Commerce released a statement by Commerce Secretary Raimondo on the Establishment of the Global Cross-Border Privacy Rules (CBPR) Forum.

The statement indicates that the The Department of Commerce intends to withdraw from the APEC Cross Border Privacy Rules (CBPR) System and join a newly formed Global CBPR forum.  The statement states “the Global CBPR Forum reflects the beginning of a new era of multilateral cooperation in promoting trusted global data flows.”

In addition to establishing a CBPR system, the forum intends to establish a Privacy Recognition for Processors (PRP) system as well as a “first-of-their-kind data privacy certifications that help companies demonstrate compliance with internationally recognized data privacy standards.”  The other countries involved in the new initiative are Canada, Japan, the Republic of Korea, the Philippines, Singapore, and Chinese Taipei (these companies are currently participating in the APEC CBPR system). 

The Global Forum and the current APEC CBPR and PRP Systems are not going to be related.  According to the CBPR Privacy Rules Declaration FAQ, the Forum “intends to establish an international certification system based on the APEC CBPR and PRP Systems, but the system will be independently administered and separate from the APEC Systems.”

According to a CBPR Privacy Rules Declaration FAQ, the objectives of the Global CBPR forum are the following:

• Establish an international certification system based on the APEC Cross Border Privacy Rules and Privacy Recognition for Processors Systems. It would be administered separately from the APEC system;
• Support the free flow of data and effective data protection and privacy through promotion of the global CBPR and PRP Systems;
• Provide a forum for information exchange and co-operation on matters related to the global CBPR and PRP Systems;
• Periodically review data protection and privacy standards of members to ensure Global CBPR and PRP program requirements align with best practices and
• Promote interoperability with other data protection and privacy frameworks.

Finally, all approved Accountability Agents and certified companies will automatically be recognized in the new Global CBPR Forum based on the same terms that they are recognized within the APEC CBPR and PRP Systems

While it has not been stated why the U.S. and the other countries have pulled out of the APEC CBPR and PRP systems, it could be reasonably assumed that the US (along with the other economies joining the initiative) sees the new forum as opportunity expand participation in the APEC framework globally (the CBPR Declaration FAQ indicates the forum will “pursue interoperability with other data protection and privacy frameworks”).

Benefits of the CBPR System

In short, The APEC CBPR system is a regional, multilateral cross-border data transfer mechanism.  The new CBPR System will continue to be a government-backed data privacy certification that companies can join to demonstrate compliance with internationally-recognized data privacy protections.  For controllers, the CBPR system provides a framework to ensure protection of Personal Information transferred among participating APEC economies.  CBPR enables controllers that collect, access, use or process data in APEC Economies to develop and implement uniform approaches within their organizations for global access to (and the use of) personal information.

The CBPR system is not just a benefit for big, multinational technology companies, but for companies across all sectors of the economy, and for micro, small- and medium-sized businesses, workers, and consumers as well.

For consumers, the CBPR provides them with trust and confidence that their personal information is transmitted and secured across borders (just as the same would be for clients that choose processors). 

For governments, the CBPR helps to assure there are no unreasonable impediments to cross border data transfers while at the same time protecting the privacy and security of their citizens’ personal information domestically and, in cooperation with foreign governments, internationally. The use of an Accountability Agent to demonstrate compliance by evaluating privacy policies and practices only helps legitimize the framework even more. 

Benefits of the PRP System

The APEC PRP system allows processors to demonstrate their ability to effectively implement a controller’s privacy obligations related to the processing of personal information. The PRP also enables information controllers to identify qualified and accountable processors, as well as to assist small- or medium-sized processors to gain visibility and credibility.

What to Expect for Companies Currently APEC PRP or CBPR Certified Companies

Companies certified to the CBPR system should continue to enjoy current data transfer benefits under the new Global system and are expected to see increased transfers benefits as economies outside of APEC recognize the new global system. 

If anything, the Global CBPR Forum should promote expansion of the CBPR and PRP Systems beyond APEC to increase the international data transfer benefit as well as facilitate data protection.

Hopes for the Future

As the new system further develops and considers its autonomy, perhaps the system could position itself in several ways that could leverage its participation with economies in ways that could benefit companies.  For example, it would be great to see the Global CBPR Forum capitalize on the potential for an interoperable system that makes it easier to move personal information across international borders.  Currently, some governments have embedded the CBPR in their legal systems, allowing for third-country companies to receive cross-border transfer data flows as adequate.

Additionally, it would be great to see a company’s Global CBPR certification as a mitigating factor by a DPA in the event that a fine must be imposed.

Finally,  Hopefully, this will attract more economies to participate in the forum.  The Global CBPR Forum is intended to be open, in principle, to those jurisdictions which accept the objectives and principles of the Global CBPR Forum as embodied in the Declaration.

it would be a coup for this new system if it brought in important economies, including the United Kingdom, India, and, of course, Europe.