ISO 27701 vs. APEC CBPR

International commissions and organizations have created standards that can be applied to data controllers who do business across borders, especially those who are required to follow GDPR.

One well-known option is provided by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), specifically ISO/IEC 27001, recently amended in 2019 with the ISO/IEC 27701 document.

Lesser-known in the U.S., but possibly more relevant to businesses that work between borders and certainly more unique in its controls, is the Cross Border Privacy Rules (CBPR) framework, provided by the Asia-Pacific Economic Cooperation (APEC). Both ISO/IEC 27701 and APEC CBPR are voluntary, available in the US, and internationally relevant; also, both at least somewhat overlap with GDPR requirements.

The APEC Cross-Border Privacy Rules (CBPR) System, endorsed by the Asia-Pacific Economic Cooperation in 2004, is a voluntary, enforceable, international, accountability-based system that facilitates privacy-respecting data flows among APEC economies. APEC CBPR provides a standard set of principles designed to enhance electronic performance, facilitate trade and economic growth, and strengthen consumer privacy protections.

What’s unique about APEC CBPR is that, while it is entirely voluntary, it also has an element of independent accountability oversight, complaint mitigation, and legal enforceability, making it the strongest candidate for demonstrating a commitment to privacy.

Commonly misconceived as a solely Asian-Pacific-based system, CBPR is active between the USA, Mexico, Japan, Canada, Singapore, the Republic of Korea, Australia, Chinese Taipei, and the Philippines, with more expected to join soon.

What Makes CBPR Legally Enforceable?

A central element of CBPR is it is legally enforceable in each of the APEC economies. Within the U.S., CBPR certification processes work in coordination with and under the enforcement authority of the Federal Trade Commission (FTC). The FTC enforces Section 5(a) (15 USC§45), which enforces “unfair or deceptive acts or practices in or affecting commerce.” The failure of organizations to abide by their own privacy policies can be enforced by the FTC under their Section 5 authority.

Accountability Agents: APEC’s Line of Defense Against Internal Abuse

CBPR’s Accountability provisions go above and beyond to ensure voluntary and continued accountability by instating recognized Accountability Agents (akin to assessors or auditors under other standards) instead of allowing internal or independent auditing. Accreditation by APEC to issue certifications requires rigorous review and acceptance by the Joint Oversight Panel. Recognition as an Accountability Agent must be re-applied every two years. This is not the case with third-party ISO auditors. Currently, there are only four Accountability Agents in the US (one of which is NCC Group) and a total of eight globally.

Accountability agents are responsible for reviewing CBPR applicants, recommending changes, and in many cases, helping them develop data privacy protocols before issuing the certification.

Accountability Agents must be able to demonstrate the following:

• The processes in place to ensure its independence
• The organization of the certification process
• The monitoring and compliance review processes
• The renewal process
• The dispute resolution process
• The mechanisms in place for enforcing the CBPR program requirements

Most notably, Accountability Agents also provide continued oversight of certified business practices for one calendar year. Because CBPR-certified companies are added to a public directory on the APEC website, anyone with concerns or complaints can find a listing and report violations of data privacy policy--this would then prompt the certifying Accountability Agent to launch an investigation and address the issue between both parties.

In other words, having a CBPR certification on a business’ website and materials implies that:

1. They have gone through rigorous assessments and created data control processes that meet high standards;

2. That they are committed to following their data policies with the possibility of legal ramifications should they fail;

3. They are committed to full transparency regarding how they handle personal data--they won’t misuse or abuse it.

What Are APEC CBPR’s Controls?

APEC CBPR has 50 flexible but ethically precise controls that fall under 9 privacy principles:

1. Accountability
2. Preventing Harm
3. Notice
4. Choice
5. Collection Limitations
6. Use of Personal Information
7. Integrity of Personal Information
8. Security Safeguards
9. Access and Correction

Unlike ISO/IEC 27701, all self-assessments and controls are transparent, free to access, and readily available online at their website. For more information, visit their documents page.

What’s the Process of Achieving an APEC CBPR Certification?

• The Accountability Agent performs an initial assessment based on the applicant’s self-evaluation and intake.
• The Accountability Agent then provides a comprehensive report to the applicant’s outlining findings regarding compliance requirements.
• The Accountability Agent verifies that any required changes, as outlined in the findings report, have been adequately implemented.
• Upon successful conclusion of the above steps, the Accountability Agent certifies that the applicant complies with their program requirements.
• The agent posts a CBPR-certified company on the APEC CBPR directory, and the applicant can use CBPR-related seals and add it to their materials.

How Much Does Achieving APEC CBPR Certification Cost?

According to APEC, costs are to be kept minimal under this standard to allow widespread use and a low financial bar to entry. The cost to certify is similar to the cost of a compliance assessment of HIPAA or PCI.

How Does APEC CBPR Measure Against GDPR?

According to a 2019 study conducted by the European Commission on Data Protection Certification Mechanisms, “Certification schemes focusing on international data transfer remains rare. CBPR offers an interesting and valuable insight into cross-border data flows and its certification.”

APEC CBPR was deemed likely to offer modules for the GDPR data protection certification as a means of transfer. The scheme arrangement of the standard is very similar to the mechanism suggested in Article 42 of GDPR, where authorities are entitled to draft requirements and then accredit private certification bodies to manage the scheme under their monitoring.

The choice made by the CBPR board to renew the certification and accreditation process every two years directly demonstrates a desire to address this very concern, ensuring close monitoring of both accountability agents and certified organizations.