While the EU General Data Protection Regulation (GDPR) enforcement deadline is less than a year away and it’s “all systems go” to get ready, privacy – like all other fundamental human rights – is not just a European issue. The specific rules and requirements might differ between jurisdictions, but the principles of protecting and respecting personal data and being transparent, fair, and accountable, apply worldwide.
With 21 member economies, APEC (Asia Pacific Economic Cooperation) is an important region for Cisco. Over 60 percent of our revenue is generated from an APEC economy, which includes the United States.
The APEC member economies have adopted the APEC Privacy Framework with its nine privacy principles:
- Preventing Harm
- Notice
- Collection Limitation
- Uses of Personal Information
- Choice
- Integrity of Personal Information
- Security Safeguards
- Access and Correction
- Accountability
These principles align to internationally recognized privacy guidelines, frameworks, and laws such as the OECD Guidelines, EU/Swiss-US Privacy Shield, EU Binding Corporate Rules, GDPR, Japan’s Act on the Protection of Personal Information, Singapore’s Personal Data Protection Act, Korea’s Personal Information Protection Act, and others. To ensure a consistent baseline of privacy protection when data processing crosses borders, APEC created the Cross-Border Privacy Rules system (CBPRs). Like the EU’s BCRs and Privacy Shield, companies can certify under the CBPRs and publicly commit to honoring the CBPRs principles no matter where data processing takes place. An APEC-approved, independent third party, called an Accountability Agent, reviews the company’s policies and practices to verify compliance and issues the certification. A CBPRs-certified company is permitted to transfer and receive personal data collected in an APEC member economy across borders (i.e., the certification satisfies Japan’s new cross-border restrictions).
The CBPRs is a relatively new certification that is beginning to gain traction. Japan and South Korea recently joined the system, and Canada, Mexico, and the United States are full participating economies. Singapore submitted its formal “notice of intent to participate” in July of this year and we are seeing strong interest from other APEC economies, including Australia, Chinese Taipei, Hong Kong, the Philippines, and Vietnam. Cisco was an early adopter and has been CBPRs certified since 2016. We are actively working with APEC in “capacity-building” efforts to expand the adoption of the framework among member economies and companies doing business in Asia. As more economies and countries join the CBPRs, we will see a strong network effect and greater benefits of participation.
For more information about Cisco data protection and privacy, visit trust.cisco.com.
Very informative article. Security not just one country’s issue it should be taken seriously by all. It’s sad to know that there are so many entities out there who believe that security breaches cannot happen to them. Adopting a solid plan of attack and remaining accountable is key.