Australia and Chinese Taipei have become the latest economies to join the Asia-Pacific Economic Cooperation's Cross-Border Privacy Rules System. Both officially joined as of Nov. 23, when APEC's Electronic Commerce Steering Group Joint Oversight Panel put forward its final findings report.

The CBPR system is a voluntary, accountability-based framework that serves to facilitate data flows across the APEC region.

As members of the CBPR system, Australia and Chinese Taipei join the U.S., Mexico, Japan, Canada, Singapore and the Republic of Korea. Open to APEC's 21 member economies, APEC-CBPR certified companies must implement data privacy policies consistent with the APEC Privacy Framework and are approved by an independent third-party verifier, known as an Accountability Agent, of which there are two so far. To date, the APEC website lists 23 businesses that participate in its compliance directory, including Apple, Hewlett-Packard, IBM and Merck.

In a translated press release provided by Chinese Taipai's National Development Council, officials noted that participation in the system will enable small and mid-sized companies to capture overseas business opportunities by via engagement with the privacy framework — highlighting the priority of privacy protection, fostering cross-border collaboration and promoting cross-border digital trade. It also stated, "NDC will continuously work to coordinate among related ministries/commissions and to push forward related matters with the collaboration of them, so as to enhance the exchange of Chinese Taipei with other economies on the front of privacy protection and enhance its international visibility for participating in the international activities."

Australia has signified that over the next year, the Attorney General's Department will work with the Office of the Australian Information Commissioner and businesses to help implement CBPR system requirements in such a way to as to preserve the long term benefits for Australian businesses and consumers. 

A statement from Kerry Davis, senior legal officer with Australia’s Attorney General’s Department, said the department, along with the Department of Foreign Affairs and Trade and the Office of the Australian Information Commissioner, held an open consultation process regarding Australia’s proposed participation in the CBPR system in the summer of 2017. “It was decided in November 2017 that it was the right time for Australia to participate in the CBPR system,” he said.

Implementation of the CBPR system will be different for each country. Josh Harris, TrustArc's director of International Regulatory Affairs said, "CBPRs are voluntary. Once an APEC member economy chooses to join, they are able to define the regulatory benefits of participation within their jurisdiction.”  

Since it is up to Australia and Chinese Taipei themselves to determine how they implement the CBPR system in their own jurisdictions, Harris said the broader question will be: What does this mean practically? For instance, in the U.S., the system is seen as a best practice, and in Japan, it was incorporated into the country’s revised law and made a basis for transfer. How it will take shape in Australia and Chinese Taipei remains to be seen.

Though the announcement does not come as a surprise, it does signify a moment for the framework. Malcolm Crompton, CIPP/US, founder and lead privacy advisor at Information Integrity Solutions and former Australian Privacy Commissioner, said Australia's on-boarding is a milestone.

Crompton said, "The significance for Australia is almost uniquely different from anywhere else because of the leading role that Australia has played in all stages of developing the CBPR system over the last 10 to 15 years." He added that while industry has been slow to adapt, having Australia and Chinese Taipei sign on could encourage others to follow.

"All of us have been waiting for the wave to break," he said.

In order for the CBPR system to continue to add value to businesses around the world, Crompton said two things need to happen. First, more economies need to sign on, and secondly, more companies need to use it.

"It is a classic chicken-and-egg challenge," he said. 

The World Economic Forum found that APEC economies will lead the charge forward, providing for roughly 65 percent of the estimated global growth in real GDP between 2017 and 2019.

It remains to be seen whether this year will usher in new economies looking to move towards adopting the CBPR system and whether Australia and Chinese Taipei will serve as the nudge the framework has perhaps been waiting on. 

photo credit: Move The World via photopin (license)