The international community are continuing to take further steps toward data free flow with trust (DFFT) in 2023, building on recent developments such as the draft EU-US Data Privacy Framework and the expansion of the Global Cross Border Privacy Rules system beyond the APEC region (as demonstrated by the UK's Associate Membership application).

The OECD Declaration on Government Access to Data held by the Private Sector was also agreed late in 2022. All of these developments can play a role in stabilising the international system for flows of personal data and also create progress towards convergence and interoperability between different data protection and privacy regimes, whilst recognising the need to maintain high standards and trust.

G7 Declaration and proposed Institutional Arrangement for Partnership

The G7 Presidency is held by Japan in 2023 and Japan has made DFFT a priority for discussion at the various summit meetings. The Ministerial Declaration from the G7 Digital and Tech Ministers’ Meeting (30 April 2023) sets out some important new plans: "To deliver on the goal of operationalising DFFT, we endorse the establishment of the Institutional Arrangement for Partnership (IAP) to bring governments and stakeholders together to operationalise DFFT through principles-based, solutions-oriented, evidence based, multi-stakeholder and cross-sectoral cooperation."

The Declaration also includes an annex covering the G7 Vision for Operationalising DFFT and its Priorities. This provides more detail on what we can expect the IAP to cover, for example:

• development of compatible policies, tools, and practices for enabling data flows in full compliance with existing regulatory requirements regarding data
• key impediments and challenges to DFFT
• technological developments that relate to DFFT such as privacy enhancing technologies (PETs)
• legal practices enabling DFFT such as model contractual clauses and certification mechanisms such as international privacy frameworks

The Declaration indicates the IAP should be up and running within months. This will be important, as it can create a practical and ongoing process to exchange information and look to formalise steps forward. Whilst data protection practitioners will be realistic and pragmatic on what can be achieved within the IAP, this offers long term potential for a global solution (within democratic nations) to enable data flows, alongside the protections people expect, as both consumers and citizens. The G7 declaration also highlights a key role for OECD in delivering this vision.

OECD publishes evidence paper on business experience of data transfers

On 27 April 2023, the OECD published an important discussion paper, to feed into this work: Moving forward on data free flow with trust: New evidence and analysis of business experiences. I was able to contribute to the paper as a consultant to OECD. Helpfully, this provides practical experiences and insights from business on current compliance practices for international data transfers. Businesses have indicated the need for coherent principles and rules that are transparent and predictable, cross-sectoral and consistent, to facilitate more effective compliance strategies and protection for individuals. The OCED paper notes that businesses see a greater need for the following:

• a set of cohesive principles and rules for cross-border transfers of personal data and associated means to ensure safeguards are implemented to realise effective data protection globally
• policies, regulations and regulatory interpretations that provide a practical balance between certainty and flexibility and focus on effective protection (rather than mere formal compliance) to build trust
• solutions that match business realities and support companies’ data governance strategies broadly
• more inclusive dialogue to achieve a shared understanding of technological developments and how they can support privacy in the context of DFFT.

This OECD paper is the start of a process in developing an effective evidence base for DFFT policy - further insights and perspectives will be needed to maintain trust in the process of operationalising DFFT and maintaining high standards. There will opportunities for business and other stakeholders to continue to engage with this process over the coming months.

The World Economic Forum makes the case for global co-ordination on international flows

The World Economic Forum has also set out its case for a joined up global approach to data transfers in a new paper From Fragmentation to Coordination: The Case for an Institutional Mechanism for Cross-Border Data Flows.

The paper sets out economic evidence to support the case for operationalising DFFT, highlighting that data access and sharing across borders may generate social and economic benefits of up to 2.5% of gross domestic product (GDP). It also builds the case for an institutional mechanism and the G7 Declaration mentioned above is a step towards achieving this. The paper sets out a similar evidence picture to the OECD on the challenges posed by different national and regional frameworks for data protection and privacy, how this creates fragmentation and regulatory uncertainty.

Looking ahead

These initiatives look like a promising development, though will require a broad community of international support to deliver practical and tangible outputs that genuinely reduce the friction in international personal data flows. Businesses should continue to monitor these developments and look for opportunities to provide input and evidence to the ongoing policy process. This could include input via trade and industry bodies, who are also represented by the advocacy group Business@OECD.