From Regional to Global: The CBPR System Goes Global

Oct 25, 2022 by Rebecca Knight, CIPP/E, CIPP/US, Counsel, Policy Privacy Initiatives, BBB National Programs

Last month, we covered the objectives of the Global Forum, APEC, the APEC Framework, and the APEC CBPR System. This month, we will discuss the transition from the APEC CBPR System to the Global CBPR System under the Global Forum. 

At IAPP’s Privacy. Security. Risk. 2021 conference, Christopher Hoff, then Deputy Assistant Secretary for Services at the U.S. Department of Commerce, listed three privacy policy priorities: (1) combating data localization (paywall), (2) prioritizing bilateral negotiations with jurisdictions globally, and (3) supporting the globalization and expansion of the APEC CBPR System. Emphasizing the third priority, Hoff declared in a rather pithy statement that “CBPR is going global.” Six months later, the Global Forum was announced, paving the way for a “first-of-[its]-kind data privacy certification” that permits cross-border data transfers regardless of geographic borders under the Global CBPR System.  


The Global CBPR System  

The Global Forum was founded to “promote interoperability and help bridge different regulatory approaches to data protection and privacy.” As an international cooperative, the Global Forum’s primary objective is the global expansion of the CBPR system to promote the free flow of data while maintaining robust data protections for consumers regardless of jurisdiction. Through this globalized system, the Global Forum will be able to promote consumer trust in the digital economy, drive economic growth, and increase competitiveness for participating businesses and countries.  

The Global CBPR System will be based on the APEC CBPR System. However, the Global CBPR System will be independently administered and separate from the APEC CBPR System. The founders of the Global Forum will work with Accountability Agents and certified businesses in the APEC System to seamlessly transition operations from APEC to the Global Forum with at least 30 days’ notice. At this time, the date of transition has not been established, but significant forward movement is expected soon. Government officials, regulators, and other privacy experts will be meeting in South Korea at the start of November to discuss their shared vision for the Global Forum.  


Unique Benefits 

Participation in the Global CBPR System presents unique benefits to participants that include:  

  1. Consumer Trust: In a recent study, Cisco found that 90% of respondents in its global survey would not purchase from an organization that doesn’t properly protect its data. Additionally, 91% of respondents indicated that external privacy certifications are important when considering which organizations to purchase from. As such, demonstrating compliance with internationally recognized privacy standards through an independent certification system is key to fostering consumer trust. 
  2. Multilateral Approach: Like the invalidated Privacy Shield Framework (unilateral approach), the Global CBPR System will create a legal basis for cross-border data transfers. However, unlike the Privacy Shield Framework (soon to be the EU-U.S. Data Privacy Framework), the Global CBPR System is multilateral. This means certified businesses will be able to transfer data from Point A to Point B, then continue transferring the data to Points C, D, and E, if necessary, while still maintaining robust data privacy standards and protections. As such, participants in the Global CBPR System will benefit from cross-border transfers to countries such as Australia, Brunei Darussalam, Canada, Indonesia, Japan, Korea, Malaysia, New Zealand, the Philippines, Singapore, Thailand, and the United States. And more jurisdictions, such as the United Kingdom, have expressed interest in joining the Global Forum. As membership expands, so will the data transfer capabilities. Additionally, this multilateral approach ensures that the Global CBPR System cannot be invalidated by one jurisdiction’s government because it’s an international cooperative that is accountability-based and voluntary by design. As such, no one jurisdiction can invalidate the system.
  3. Cost Effectiveness: The privacy regulatory landscape is becoming increasingly fragmented with many jurisdictions adopting their own nuanced privacy laws. This fractured environment is costly for businesses as they try to navigate these systems, which both overlap and conflict. Through the Global CBPR System, businesses will be able to certify to one common set of privacy standards that permit cross-border transfers around the globe. This will be a cost-effective mechanism that will lead to greater accessibility and participation by businesses of all sizes. 
  4. Complementary to GDPR: As stated by Shannon Coe, Global Data Policy Director for the U.S. International Trade Administration at the Department of Commerce, “Companies that took part in the now-defunct EU-US Privacy Shield data-transfer mechanism already meet most requirements of a soon-to-be-expanded multilateral pact originating in the Asia-Pacific region…There is substantial overlap with APEC's Cross-Border Privacy Rules, or CBPR.” This substantial overlap will be discussed, in depth, in the next installment of this series.  


Industry Support for the Global Forum  

On July 18, 2022, Keith Enright, Chief Privacy Officer for Google, announced in a public policy blog that Google is “commit[ed] to certifying under the future Global Forum system.” Consistent with the Global Forum, Google believes the Global CBPR System is a viable solution to the increasingly fragmented privacy regulatory landscape. As such, Google, along with its partners and fellow industry leaders, will be providing input on the practical realities faced by companies of all sizes in the hopes of building a system that is scalable and accessible around the world. 

UP NEXT . . . we’ll be detailing how the Global CBPR System will complement the EU – U.S. Data Privacy Framework (Privacy Shield 2.0). Stay tuned.  

Suggested Articles


What All Businesses Can Learn From Recent Missteps In Crypto

While the crypto market itself is quite revolutionary, its challenges in introducing a new concept to consumers are not new. In every emerging market, business leaders should take steps to generate excitement while being careful to avoid pitfalls by making advertising claims that they can support with evidence.
Read more

Expanding SWIFT: What’s New for 2023

NAD is expanding Fast-Track SWIFT so that all single-issue claims, express and implied, that do not require review of complex evidence or substantiation are eligible. In SWIFT, challenges are limited to issues that do not require review of complex evidence or substantiation, such as clinical or technical testing or consumer perception evidence, and cases are resolved within 20 business days or less.
Read more

FTC’s New Health Claims Guidance: What You Need to Know

Health-related claims remain a priority for the Federal Trade Commission (FTC), signaled by the release of important new guidance at the end of 2022: Health Products Compliance Guidance, replacing the Dietary Supplements: An Advertising Guide for Industry. Get to know these changes for health-related claims.
Read more

2023 Trends: Big Game Ad Claims

What makes the Super Bowl “super”? The commercials. In recent years the explosion of increased marketing channels has led marketers to flock to targeted advertising, but the big game stage provides an important opportunity to reach millions of consumers at the same time. This article takes a look at some of the trends from this year’s big game.
Read more