Australia has announced that it will be joining the APEC Cross Border Privacy Rules (“CBPR”) system, a voluntary program that seeks to protect the transfer of information between APEC countries. 

This decision follows a consultation process begun in July 2017 whereby Australia “invited businesses and other interested stakeholders to comment on a discussion paper about the implications of Australia’s possible participation in the CBPR system.”  As a result of the response received through that process, Australia will be submitting an application to join CBPR.

CBPR was “developed by APEC economies with input and assistance from industry and civil society to build consumer, business and regulator trust in cross border flows of personal information.”  As we have reported, the CBPR system was established as a voluntary accountability-based system that breaks down barriers to information flow, facilitates secure data transfers, and ensures continued trade in the APEC region.  To participate in the system, countries must: (1) complete a self-assessment of their data privacy policies and practices, (2) submit themselves to a compliance review by an APEC-recognized Accountability Agent (a public or private entity authorized by APEC to review and certify participating organizations’ privacy policies and practices), (3) draft a directory of all organizations that have been certified as compliant with the CBPR system, and (4) establish a regulatory arrangement to ensure that the requirements of the CBPR system are enforced.

Australia now joins the United States, Mexico, Japan, Canada, the Republic of Korea, and Singapore in the CBPR initiative.  Singapore submitted its notice of intent to join in CBPR in July 2017.

In the coming months, the Australian Attorney-General’s Department “will work with Australia’s privacy regulator, the Office of the Australian Information Commissioner and businesses to implement the CBPR system requirements in a way that will ensure long term benefits for Australian businesses and consumers.”