Interoperability: The Foundation for Achieving Compliance with Global Privacy Laws

Jun 15, 2021 by Cobun Zweifel-Keegan, Deputy Director, Privacy Initiatives

Data privacy laws, not just in the U.S. but around the world, are proliferating at a breakneck pace. From Colorado to Colombia, emerging state and global rules for the handling of personal information are challenging business leaders.  

Despite what you may hear about global privacy laws, exceeding minimum standards with a unified privacy program is feasible for most businesses. Many turn to accountability markers like a privacy program certification delivered by independent organizations such as ours, BBB National Programs. These privacy certifications help make global privacy best practices achievable by businesses of any size, even if you are just getting started.  

While there is not one common global data privacy law, there are standard privacy practices common across jurisdictions. This idea can be summed up in one word: interoperability. Standard data privacy practices, when properly documented and certified, are recognized as a baseline around the world.  

Interoperability does not mean equivalency. Privacy laws around the world are often different in scope, operation, or enforcement. For example, though all data privacy or data protection laws cover “personal information” (information about individuals), the types of individuals covered differ from consumers to employees to general “data subjects.” 

Interoperability stands for the idea that baseline standards can be recognized among many different jurisdictions. If you achieve recognizable baseline standards—and demonstrate your achievement through mechanisms of transparency and accountability—you have taken many of the critical steps toward achieving global privacy compliance.  

Building on this foundation lets you focus on the gaps created by individual local laws, rather than starting from scratch for every market. 

 

How to Achieve Interoperability 

A certification such as BBB National Programs’ based on the Cross-Border Privacy Rules (CBPR) system—or, for vendors, the more streamlined Privacy Recognition for Processors (PRP)—not only provides an independent annual review of privacy practices, but also includes a formal report and public seal of approval, ongoing monitoring, and dispute resolution services, all of which help businesses keep up with global privacy norms. 

The eight guiding principles included in the CBPR framework are universally acknowledged as fundamental to good privacy practices: 

  • Notice. Individuals should be provided with notice of privacy practices at the time of collection. 
  • Collection Limitation. Collection of personal information should be relevant to the purposes disclosed at the time of collection.
  • Uses of Personal Information. Uses should be limited to fulfilling the purposes of collection and other compatible or related purposes.
  • Choice. Where appropriate, individuals should be provided with choice in relation to the collection, use, and disclosure of their personal information.
  • Integrity of Personal Information. Procedures should be in place to maintain the accuracy and completeness of personal information.
  • Security Safeguards. Reasonable security safeguards should be implemented to protect personal information from loss, unauthorized access or disclosure, or other misuses.
  • Access and Correction. Procedures should be in place to permit individuals to access and correct their personal information.
  • Accountability. Procedures are in place to ensure compliance and accountability, even when data shared with third parties. 

 

Though the privacy standards built into the CBPR and PRP system were first established by the group of economies known as the Asia-Pacific Economic Cooperation (APEC), many CBPR-certified companies extend the scope of their certification to include their entire global operations. These companies recognize the value of adopting recognized privacy standards as a firm foundation for their global operations, and others may want to consider doing the same. 

 

How do CBPRs relate to global privacy laws? 

This table provides an overview of the correspondence between CBPRs and a selection of global privacy laws. For each principle, the table indicates whether the law:  

  • Aligns with the requirements for CBPR certification, 
  • Adds some details to the CBPR requirements (+), or
  • Does not include corresponding requirements (-).  

Cross Border Privacy Rules Matrix

 

The CBPR framework provides a strong foundation on which to build a business that meets global privacy standards. Demonstrating that your program meets these interoperable requirements is a proactive step in preparing for global compliance. 

Our role at BBB National Programs as a third-party provider of privacy certifications, assessments, and independent dispute resolution is to help companies confidently demonstrate that their privacy practices are built upon the principles that form the building blocks for global privacy standards.  

We can help make privacy achievable and accountable for businesses of all sizes. Reach out to GlobalPrivacy@bbbnp.org to get started. 

Suggested Articles

Blog

The 2010s – the Digital Advertising Frontier

In the 2010s, the confluence of social media and digital advertising generated two new issues in advertising law: the use of influencers for marketing and the propriety of native advertising. Both the FTC and NAD provided guidance on these emerging issues during NAD’s fifth decade of work in ad law.
Read more
Blog

Self-Regulation Is a Tool to Mitigate Litigation

Independent industry self-regulation, when developed and implemented properly, is a powerful tool for enhancing consumer trust in business and protecting consumers. And as we emerge from the reduced trust in government wreaked by the COVID-19 pandemic, it is time for independent industry self-regulation to help solve vexing business problems. In-house counsel can play an important leadership role in those efforts.
Read more
Blog

Is Your Business Ready for Consumer Data Privacy Requests?

Businesses face many common pitfalls as they prepare to handle consumer privacy requests. They may be referred to as “data rights,” “data subject rights” (DSRs), or “data subject access rights” (DSARs). No matter what they are called, there are consistent themes in the best practices and pitfalls inherent in these essential elements of any privacy program.
Read more
Blog

Three Strategies for Making the Most of a Mediated Settlement

Over the years, we have learned that success in mediation comes as much from utilizing emotional intelligence as it does from knowing the nuts and bolts – and the legalities – of the mediation process. This blog outlines three strategies for making the most of a mediated settlement.
Read more