List of overseas jurisdictions

31.206 The Privacy Act does not provide a definition of what constitutes a ‘substantially similar’ set of principles for the purposes of NPP 9(a).^[314] The OPC Review noted that stakeholders had expressed frustration at the lack of guidance regarding the countries whose laws provide adequate protection equivalent to the NPPs.

In this situation the onus is on the organisation to assess the regime of the country in which their trading partner resides. Many stakeholders, especially small businesses, have criticised the efficiency of this system arguing that they neither have the expertise or the resources to assess a foreign country’s privacy laws.^[315]

31.207 In the context of the OPC Review, it was suggested that the OPC could publish a list of countries with substantially similar privacy laws. The OPC rejected this proposal on the basis that it was a complex task that would require considerable resources. The OPC also suggested that such a task could affect its relationships with other countries and may be an inappropriate task for it to undertake.^[316]

31.208 In its submission to the House of Representatives Committee on Legal and Constitutional Affairs inquiry into the Privacy Amendment (Private Sector) Bill 2000 (Cth), the European Commission argued that ‘it is our experience that it is difficult for the average operator to have substantial knowledge of the level of protection of personal data in third countries’.^[317]

31.209 In IP 31, the ALRC asked what role, if any, the OPC should play in identifying countries that have protection for personal information equivalent to the Privacy Act.^[318] In DP 72, the ALRC acknowledged that such a role would have considerable resource implications. The ALRC proposed, therefore, that the Australian Government develop and publish a list of laws and binding schemes that effectively uphold principles for fair handling of personal information that are substantially similar to the UPPs.^[319]

Submissions and consultations

31.210 Most stakeholders who commented on this proposal expressed their support.^[320] Submissions noted that the list would assist individuals to make choices about the handling of personal information, and businesses to make decisions about when alternative arrangements are needed to protect personal information.^[321] The Association of Market and Social Research Organisations and the Australian Market and Social Research Society submitted that the difficulty in determining the equivalence of other countries’ privacy regimes with Australia’s has created additional unnecessary barriers for Australian organisations wishing to trade overseas. In their view, knowing which countries guarantee substantially similar privacy rights for individuals is essential, but can be difficult for organisations to ascertain. They submitted that the OPC should be involved.^[322]

31.211 In the OPC’s view, however, the task of interpreting and assessing a large number of different privacy laws and legal systems would not be an appropriate role for the OPC. The OPC submitted that these types of decisions were best left to governments, acting with the advice of privacy commissioners.^[323] PIAC agreed that the OPC should not have responsibility for developing the list, but submitted that, along with privacy advocates and consumer groups, it should have input.^[324]

31.212 Some support for the proposal was qualified. IBM Australia Ltd, while welcoming the proposal, submitted that‘the proposed list should not be the definitive requirement for determining whether an organisation is complying’ with the relevant privacy principle when transferring information overseas.^[325]

31.213 The Australasian Compliance Institute supported the proposal as an initial mechanism to determine ‘jurisdictional compatibility’ and submitted that the list should be updated and maintained on an ongoing basis.^[326] The National Australia Bank submitted that reliance on the list should constitute ‘reasonable belief’ for the purposes of the ‘Cross-border Data Flows’ principle.^[327]

31.214 The Australian Privacy Foundation and the Cyberspace Law and Policy Centre submitted that there should be a ‘whitelist’ of countries with equivalent laws, promulgated as a regulation or other legislative instrument made by the government, after receipt of published advice by the Privacy Commissioner.^[328] The Australian Privacy Foundation submitted that it is unrealistic to assume that, where an overseas scheme upholds privacy protections effectively, an individual can seek redress overseas. To address this concern, it suggested:

In order to qualify for the ‘whitelist’ for the purposes of UPP11(a), a foreign jurisdiction must have in place an agreement on cross border enforcement with the OPC.

Except where a transfer is to a jurisdiction included in a ‘whitelist’ legislative instrument, the agency or organisation should continue to be liable for any breaches of the UPPs …^[329]

31.215 The Cyberspace Law and Policy Centre submitted that there was little point in ‘pretending’ that such a whitelist would not automatically qualify as a basis for ‘reasonable belief’ under the ‘Cross-border Data Flows’ principle, so this should be made explicit in the relevant regulations.^[330]

ALRC’s view

31.216 The benefits of developing a list of laws and binding schemes that have equivalent Privacy Act protection for personal information far outweigh any disadvantages. Stakeholders have identified clearly the need for a list on a number of occasions, including in submissions to this Inquiry.^[331] Such a list would assist agencies and organisations to comply with the proposed ‘Cross-border Data Flows’ principle. Further, it would assist individuals to make choices based on where their personal information may be transferred, and how it will be handled.

31.217 The ALRC accepts that this task would have considerable resource implications for the OPC. The ALRC therefore recommends that the Australian Government should develop and publish a list of laws and binding schemes that effectively uphold principles for fair handling of personal information that are substantially similar to the model UPPs. This may be a suitable task for the Department of Prime Minister and Cabinet,^[332] in consultation with other Australian Government agencies, such as DFAT and the OPC.^[333]

31.218 While inclusion on the list is a good basis for ‘reasonable belief’ for the purposes of the ‘Cross-border Data Flows’ principle, the list should not be enacted as a legislative instrument. If the list is maintained more informally, it is able to be updated easily and frequently. The list will be more useful if current. Also, as discussed above, the question of whether the test in (a) of the ‘Cross-border Data Flows’ principle is satisfied should be resolved on a case-by-case basis.