OAIC international strategy 2021–22

Download the print version

Part one: Our environment

Global developments

Today, our world is more globally connected and data driven than ever before. By some estimates, cross-border data flows contribute around $USD 2.8 trillion to global economic activity, or 3.5% of global GDP.[1] This signals a shift in the underpinning role that data now plays in our economy.[2]

Our data no longer stops at national borders, technological change is fast-paced and data-sharing practices are constantly evolving and adapting to meet the needs of the global digital economy.

At the same time, there is evidence of public distrust in information handling practices, and growing uncertainty from individuals about how their personal information is being used.[3]

Governments around the world are responding by developing and strengthening privacy and information access frameworks to protect their citizens in the digital economy and promote open government. Some jurisdictions, such as India and Brazil, are introducing frameworks for the first time.[4] Others, such as the European Union (EU) and Canada, are strengthening already existing frameworks.[5]

The Australian Government has also announced legislative reform including a review of the Australian Privacy Act 1988.[6]

We are also seeing the emergence of global tools and standards that support the transfer of personal information including Binding Corporate Rules, Standard Contractual Clauses, codes of conduct, certification and privacy seals. Global approaches to accountability are also becoming more evident, such as programs introduced by multinational entities that enable them to meet their compliance obligations across multiple jurisdictions.[7]

Global solutions

The result is that Australian individuals, government and businesses are engaging in a globalised and rapidly evolving data driven environment, while also navigating a range of regulatory compliance frameworks.

Currently, there is no global standard to regulate cross-border data flows. International forums, such as the World Economic Forum and the Group of 20 (G20), are considering the need for harmonised frameworks to promote consistently high and predictable standards for privacy protection and enable the secure flow of personal information across borders.[8] Regulators across the globe have also recognised the importance of the global interoperability of privacy frameworks to allow for better regulatory cooperation and the important role that regulators play in ensuring public trust in the system of oversight.[9]

As different approaches are adopted around the world, it is important that Australia’s domestic frameworks remain interoperable, so that data can flow across borders whilst also protecting personal information. This will enable the OAIC to continue to co-operate with overseas privacy regulators to:

• promote a consistent regulatory approach
• minimise compliance burden
• help secure Australia’s place in the digital economy.

Globally connected regulator

The OAIC is committed to taking a contemporary approach to regulation. We are focused on protecting Australians privacy and information access rights while building public trust in information handling practices within an environment that enables digital innovation and allows Australia to compete in the global economy.

Our international activities complement and inform our domestic work, advance our strategic priorities and contribute to our purpose and vision.

International engagement allows us to regulate effectively by:

• cooperating with other international privacy regulators
• keeping us informed of global trends and developments
• allowing us to engage and lead on global issues that will shape the global regulatory environment for years to come.

The work of the OAIC is informed by the broader policy objectives of the Australian Government. In developing this international strategy we have considered policy papers such as    the Digital Economy Strategy 2030 [10] from the Department of Prime Minister and Cabinet,  the Australia’s Tech Future: Delivering a strong, safe and inclusive digital economy from the Department of Industry, Science, Energy and Resources[11] and Australia’s International Cyber and Critical Technology Engagement Strategy from the Department of Foreign Affairs and Trade. [12]

Part two: Addressing the challenges and opportunities

This international strategy provides a roadmap for how we will engage, cooperate and act within the domestic and international communities to ensure that the privacy and information access rights of the Australian community are promoted and protected both domestically and at the global level.

The OAIC has identified the following priority areas to focus our international efforts.

This international strategy is intended to guide our international activities. However, it is dynamic and will be updated in response to changes in our environment, as new challenges and opportunities arise. We will regularly review and evaluate our actions to achieve the outlined commitments.

1. Australians’ personal information is protected wherever it flows

Ensuring the protection of Australians’ personal information is a key focus of the OAIC. However, personal information data flows and technological developments do not recognise national borders. Australian’s personal information moves around the globe, so being globally connected is critical to ensuring that the OAIC is able to effectively regulate.

Privacy authorities cannot work in isolation and must work collaboratively and with agility to achieve regulatory objectives that are of mutual interest. We are committed to taking part in global networks and initiatives to ensure we are well placed to protect the personal information of Australians in a globalised data environment.

Priority Action 1.1 The OAIC will support mechanisms that facilitate international data flows while protecting personal information

Globally, privacy protection tools are being developed to support cross-border data flows. These tools provide a ‘bridge’ to connect the different privacy frameworks across the globe.

For example, the Asia-Pacific Economic Cooperation (APEC) Cross Border Privacy Rules were developed to build consumer, business and regulator trust in cross border data flows. Australia’s application to participate in the CBPR scheme was endorsed in late 2018, and the OAIC will be the Australian regulator for the scheme.

Other mechanisms such as EU adequacy decisions, Binding Corporate Rules, Standard Contractual Clauses and certification schemes also connect different frameworks and support the safe flow of personal information.

There is an opportunity to consider these mechanisms when developing Australia’s privacy frameworks to ensure that Australians’ personal information is protected no matter where it flows.

OAIC commitments

The OAIC will support the Australian Government to implement the APEC Cross Border Privacy Rules in Australia and act as the Australian regulator for the scheme.

The OAIC will provide expert advice to the Australian Government on privacy protection mechanisms that support international data flows.

Priority Action 1.2 The OAIC will support and engage in international regulatory compliance and enforcement

In our current environment, data breaches that occur in one jurisdiction often have the potential to affect individuals across the globe. Privacy authorities cannot act in isolation if they are to effectively protect personal information in the global digital economy. We are committed to connected, efficient and effective enforcement cooperation with overseas privacy regulators.

There are a number of existing networks and arrangements to promote and support international cooperation in investigation and the enforcement of privacy and data protection laws, including the Global Privacy Assembly’s[13] International Enforcement Working Group and Global Cross Border Enforcement Cooperation Arrangement (GCBECA), APEC Cross-border Privacy Enforcement Arrangement (CPEA) and the Global Privacy Enforcement Network (GPEN). The OAIC is a member of each of these enforcement networks.

OAIC commitments

The OAIC will strengthen its existing relationships and explore new relationships with other international privacy regulators. This could include agreeing to new or revised agreements with international regulators and oversight bodies in order to facilitate better information exchange and investigation and enforcement efforts across borders.

The OAIC will engage with the Global Privacy Assembly’s International Enforcement Cooperation Working Group.

Alignment with OAIC Corporate Plan

These international activities will help the OAIC to achieve the following strategic priorities identified in the 2021–22 Corporate Plan:

• Strategic priority 1 — Advance online privacy protections for Australians
• Strategic priority 2 — Influence and uphold privacy and information access rights frameworks
• Strategic priority 4 — Contemporary approach to regulation.

2. Australia’s privacy and information access rights frameworks are fit for purpose in the digital age

Australia’s privacy and information access rights frameworks have generally kept pace with international developments and, in some areas, provide a benchmark for high global standards – for example, in the areas of data breach notification[14] and consumer data portability.[15] As data flows across national borders, it is imperative that our frameworks are interoperable and continue to keep pace with international developments to ensure strong privacy protections and to increase public confidence, consumer trust and regulatory certainty for Australian businesses.

Interoperability does not mean uniformity with other frameworks. The OAIC will critically analyse international regulatory developments and consider whether these developments are appropriate for our domestic context. Where a different approach is appropriate, we will advise the Australian Government on other mechanisms to ensure our domestic laws are fit for purpose in the digital age and our frameworks are interoperable with our key trading partners.

On 25 March 2019, the Australian Government announced that amendments will be made to Australia’s privacy laws to strengthen online protections for all Australians. The Australian Government has also announced a broader review of the Privacy Act following the Australian Competition and Consumer Commission (ACCC) Final Report from the Digital Platforms Inquiry.[16] The OAIC will continue to provide expert advice to the Australian Government drawn from our regulatory experience to ensure that Australia’s privacy framework provides strong protections for Australians and is considered a benchmark globally.

The OAIC also promotes information access rights through its membership of the International Conference of Information Commissioners. The OAIC engages with this international forum to inform best practice in Government transparency initiatives, and to connect with other authorities to identify trends and strategic priorities.

Priority Action 2.1 The OAIC will provide advice to the Australian Government

The OAIC understands that global data flows are central to the digital economy and are important to the Australian Government’s priority to provide an enabling environment for digital innovation and trade.[17]

The OAIC undertakes guidance, monitoring and advice related functions in accordance with the Privacy Act.[18] Our expert advice to Government on Australia’s privacy and information access rights frameworks is also recognised as an important consideration when shaping global rules, policies and standards and as part of key international trade negotiation and agreement processes.

OAIC commitments

The OAIC will support the Australian Government in shaping global trade rules and international trade agreements to ensure high global standards for online privacy protection and information access rights.

The OAIC will provide advice to Australian Government agencies engaging in international forums that consider privacy and data protection matters, including APEC, G20 and the Organisation for Economic Cooperation and Development (OECD) Forums.

Priority Action 2.2 The OAIC will be at the forefront of key international regulatory developments

The OAIC’s International Policy team actively monitors and researches international developments related to privacy and information access rights, including law reform and new approaches to regulatory practice, enforcement, policy, guidance and education and awareness campaigns. For example, there has been a recent increase in the intersection of privacy and consumer protection regulatory spheres, which presents an opportunity for privacy and consumer protection regulators to collaborate in providing comprehensive protections. This collaboration is an area of significant focus for the OAIC, working with the ACCC on the implementation of the Consumer Data Right, and regulating online platforms.

This monitoring and research work ensures that our advice provided to the Australian Government on any proposed reform to the Privacy Act incorporates consideration and analysis of international models and their possible application in an Australian context. This work also enhances OAIC internal capability by informing our teams of international developments, and tools to ensure best practices are adopted.

In relation to information access rights, the International Conference of Information Commissioners provides a platform to share knowledge and best practices with other information access regulators, and to act as a collective voice on information access rights and accountability. The OAIC also supports the Australian Government in its membership to the Open Government Partnership. The Open Government Partnership is an international initiative to increase transparency and strengthen democratic governance. As part of Australia’s commitment to the Open Government Partnership, Australia has established the Open Government Forum to monitor and drive the implementation of the second Open Government National Action Plan and raise awareness about open government.[19]

OAIC commitments

The OAIC will monitor and research international developments relating to privacy and information access rights and consider international best practice when advising the Australian Government and businesses, taking regulatory action and developing policy guidance, education and awareness campaigns and regulatory practice.

The OAIC will provide leadership and actively collaborate with regulators in other jurisdictions in relation to the intersection of data protection and consumer protection regulation. This collaboration between data protection authorities and consumer protection authorities is an essential part of protecting consumers in the digital economy.

The OAIC will engage with the International Conference of Information Commissioners and Australia’s Open Government Forum to promote best practice in Government transparency initiatives.

Alignment with OAIC Corporate Plan

These international activities will help the OAIC to achieve the following strategic priorities identified in the 2021–22 Corporate Plan:

• Strategic priority 1 — Advance online privacy protections for Australians
• Strategic priority 2 — Influence and uphold privacy and information access rights frameworks.

3. The OAIC is a leader in the global privacy community to strengthen protection of Australian’s personal information

Privacy regulators around the world are facing unprecedented challenges in the form of technological advances and the legal, technical and ethical questions that those advancements present to our society.

Current debates about these technologies and their impact on the privacy of individuals and privacy frameworks are shaping our global regulatory environment. We will actively seek to influence these global debates to strengthen protections for Australians’ personal information so that they may confidently participate in today’s digital world.

Priority Action 3.1 The OAIC will actively engage in key international forums

The OAIC recognises that global and regional forums present a unique opportunity for Australia to be a leader in the privacy community and influence the global debate on privacy issues.

The OAIC is a member of the Global Privacy Assembly, which provides leadership at an international level by connecting the efforts of over 120 privacy and data protection authorities from across the globe. The Global Privacy Assembly is governed by the Executive Committee and receives strategy advice from the Executive Committee’s Strategic Direction Sub-Committee. The Global Privacy Assembly has a number of Working Groups which are tasked with delivering actions in relation to the most significant initiatives identified by the Assembly’s membership. The OAIC is an active member of a number of the Global Privacy Assembly’s Working Groups. The OAIC seeks to influence consistency and cooperation in the global regulation of privacy in an effort to ensure that Australian’s personal information is protected wherever it flows.

We are also a founding member of the Asia Pacific Privacy Authorities Forum, which provides leadership and support for the privacy regulator community in the Asia Pacific region.

These forums allow us to collaborate when developing policy, guidance and education campaigns; influence the development of global policy and standards; and co-operate on investigations and enforcement. Through these forums we work towards the interoperability of Australia’s privacy framework with other data protection frameworks around the world; exchange information to make the best use of our resources; and help ensure consistency in the system of regulatory oversight.

OAIC commitments

The OAIC will provide leadership in the Global Privacy Assembly by serving on the Executive Committee and chairing the Strategic Direction Sub-Committee of the Executive Committee.

The OAIC will actively engage in the Global Privacy Assembly annual meeting and two Asia Pacific Privacy Authorities meetings each year.

Priority Action 3.2 The OAIC will continue to develop global relationships

The OAIC engages with a broad range of international stakeholders to promote and uphold privacy, including civil society organisations, the international business community and overseas government organisations.

Many nations and regions that are adopting new privacy laws, or that are in the process of creating privacy regulatory regimes, are seeking assistance and information about best practice regulatory approaches from jurisdictions with established laws and frameworks. From time to time, we are also contacted by regulators from jurisdictions with established laws and frameworks seeking our views on specific issues.

OAIC commitments

The OAIC will strengthen existing partnerships and explore new relationships with international privacy regulators and international stakeholders with privacy expertise.

The OAIC will share our experiences and provide support when other international regulators seek our views.

Alignment with OAIC Corporate Plan

These international activities will help the OAIC to achieve the following strategic priorities identified in the 2021–2022 Corporate Plan:

• Strategic priority 1 — Advance online privacy protections for Australians
• Strategic priority 2 — Influence and uphold privacy and information access rights frameworks
• Strategic priority 4 — Contemporary approach to regulation.

Summary of key international networks