Galexia

Benchmarks for Global Privacy Standards (November 2009)

4.7. Benchmark 7 – International Cooperation

Protection of privacy rights should be international, with support and collaboration amongst nations.

A Global Privacy Standard should promote privacy protection that meets the following criteria:

1. Privacy protection should include provisions that protect information when it is transferred to another jurisdiction.

2. Privacy protection should include guidance on those jurisdictions that meet a test of ‘adequate’ privacy protection. These lists can be maintained at the international, regional and national level. These lists can improve on the current EU model by allowing partial adequacy (for example, finding that a jurisdiction provides adequate protection for a particular type of data, such as human resources data).

3. Privacy protection should include international guidance on terms that can be included in contracts in order to protect information that is transferred between jurisdictions.[13]

4. Privacy protection should include international cooperation regarding complaints handling and enforcement.[14]

5. Privacy protection should include support for countries that are developing privacy laws and regulations, including the exchange of skills and information and the provision of training and mentoring.


[13] See, for example, European Commission, Commission Decision of 27 December 2001 on standard contractual clauses for the transfer of personal data to processors established in third countries, under Directive 95/46/EC, Official Journal L 6/52, 10 January 2002,
<http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2002:006:0052:0062:EN:PDF>; see also Office of the Victorian Privacy Commissioner, Model Terms for Transborder Data Flows of Personal Information, June 2006, <http://www.privacy.vic.gov.au/privacy/web.nsf/content/guidelines>.

[14] Organisation for Economic Cooperation and Development, OECD Recommendation on Cross-border Co-operation in the Enforcement of Laws Protecting Privacy, 2007, <http://www.oecd.org/dataoecd/43/28/38770483.pdf>.