The Evolving OECD Privacy Guidelines

By Christine Runnegar, Director, Public Policy , Internet Society

2013 marks the 33^rd anniversary of the OECD Privacy Guidelines. It is also the year that the OECD adopted the Revised Privacy Guidelines[1]. Much has changed in 33 years. Even the OECD has changed in that time. Since 1980, the OECD community has grown to include new members: Chile, Czech Republic, Estonia, Hungary, Israel, South Korea, Mexico, Poland, Slovakia, Slovenia; and two new advisory committees: CSISAC and ITAC.

In 2010, the OECD recognised that it was time to revisit the Guidelines, and after careful research and consideration as to how the privacy landscape has evolved[2], consultation with privacy experts, and thorough deliberation, the OECD adopted the Revised Privacy Guidelines in 2013.

How have the Guidelines evolved?

A new part has been added explaining how the “Accountability Principle” should be implemented. In particular, the Guidelines provide that data controllers should have in place a privacy management programme, be prepared to demonstrate that their respective privacy management programmes are appropriate, and provide notifications of significant data breaches.[3] Additionally, the guidelines make it clear that the data controller remains accountable without regard to the data’s location.[4]

Accountability-based approaches to legal compliance are likely to continue to gain popularity as they offer the potential of a more flexible approach, as well as a way to bridge diverse legal regimes and shift the resource burden from enforcement to compliance.

The changes to the principles governing transborder data flows seem subtle, but they are significant. Firstly, they now cover flows to non-OECD member countries. Secondly, although the text is still framed as “refrain from restricting transborder flows of personal data” the circumstances in which flows are not restricted are, arguably, narrower. Member countries now need to be satisfied that the recipient substantially observes the guidelines or that sufficient safeguards exist before they refrain from restricting transborder data flows.[5] However, the restrictions that may be imposed have been confined by the introduction of a requirement that they be proportionate to the risks presented[6]. How this works in practice remains to be seen.

The revisions regarding national implementation reflect the changing perspective on how best to achieve privacy protection. For example, they underline the importance of effective enforcement authorities. They also introduce the notion of a national privacy strategy and the idea of complementary measures such as the promotion of privacy-protecting technical measures.[7]

International cooperation has been expanded to specifically incorporate the concept of “interoperability”, strengthen cross-border enforcement cooperation, and encourage the development of internationally comparable metrics.[8]

One significant area that remains essentially untouched is “exceptions” (including, for national security). With different timing, this might not have been the case. However, as it presently stands, the guidance is minimal, i.e. that exceptions to the Guidelines should be: “as few as possible” and “made known to the public”[9]. It is abundantly clear that more work is needed to ensure that there are truly effective constraints and safeguards, plus a commitment to follow them. Here is a clear opportunity for the OECD to lead the way.