Upholding Standards and Safeguards? A Landmark Agreement for Improving Trust in Cross-Border Data Flows

Editor’s Note: The Organisation for Economic Co-operation and Development (OECD) is a global organization that aims to improve policies for a better world. Its mission is to create policies that promote prosperity, equality, opportunity, and well-being for all people. With 60 years of experience and expertise, it is well-equipped to address various social, economic, and environmental challenges. As a knowledge hub and forum for data analysis, best-practice sharing, and policy advice, the OECD works closely with governments, policymakers, and citizens to establish evidence-based international standards and find solutions to various issues.

One of the most recent initiatives undertaken by the OECD is the landmark agreement known as the OECD Declaration on Government Access to Personal Data Held by Private Sector Entities. This agreement aims to improve trust in cross-border data flows by clarifying how national security and law enforcement agencies can access personal data under existing legal frameworks. This declaration may be of interest to cybersecurity, information governance, and legal discovery professionals who are working to safeguard privacy and other human rights when accessing personal data.

Press Announcement (December 14, 2022)

Landmark Agreement Adopted on Safeguarding Privacy in Law Enforcement and National Security Data Access

Organisation for Economic Co-operation and Development

OECD countries today adopted the first intergovernmental agreement on common approaches to safeguarding privacy and other human rights and freedoms when accessing personal data for national security and law enforcement purposes.

The OECD Declaration on Government Access to Personal Data Held by Private Sector Entities seeks to improve trust in cross-border data flows – which are central to the digital transformation of the global economy – by clarifying how national security and law enforcement agencies can access personal data under existing legal frameworks. It marks a major political commitment by the 38 OECD countries and the European Union that signed up to it during the OECD’s 2022 Digital Economy Ministerial Meeting. The Declaration is also open for adherence by other countries.

“Being able to transfer data across borders is fundamental in this digital era for everything from social media use to international trade and cooperation on global health issues. Yet, without common principles and safeguards, the sharing of personal data across jurisdictions raises privacy concerns, particularly in sensitive areas like national security,” OECD Secretary-General Mathias Cormann said, launching the Declaration during the OECD Digital Economy Ministerial Meeting. “Today’s landmark agreement formally recognises that OECD countries uphold common standards and safeguards. It will help to enable flows of data between rule-of-law democracies, with the safeguards needed for individuals’ trust in the digital economy and mutual trust among governments regarding the personal data of their citizens.”

The Declaration, which rejects any approach to government access to personal data inconsistent with democratic values and the rule of law, is the result of two years of work by the OECD with a group of country experts in data protection, national security, and law enforcement. The project stemmed from growing concerns that the absence of common principles in the sensitive domains of law enforcement and national security could lead to undue restrictions on data flows. Another motivating factor is a desire to increase trust among rule-of-law democratic systems that, while not identical, share significant commonalities.

The Declaration complements the OECD Privacy Guidelines, one of the OECD’s flagship achievements dating back to 1980 and the basis of many countries’ privacy rules. Last updated in 2013, the Privacy Guidelines provide a common reference point for the protection of personal data and aim to facilitate cross-border data flows while upholding democratic values, the rule of law and the protection of privacy and other rights and freedoms. Crucially, however, they allow for exceptions for national security and law enforcement purposes. This new Declaration articulates a set of shared principles that reflect commonalities drawn from OECD members’ existing laws and practices and complement each other in protecting privacy and other human rights and freedoms.

The principles set out how legal frameworks regulate government access; the legal standards applied when access is sought; how access is approved, and how the resulting data is handled; as well as efforts by countries to provide transparency to the public. They also tackle some of the thornier issues – such as oversight and redress – that have proved challenging to policy discussions for many years. (See the full official text.)

The Declaration on Government Access is an important milestone in the OECD’s work to support countries in promoting trust in cross-border data flows. The Declaration complements the OECD’s Going Digital project, which in its current and third phase focuses on data governance for growth and well-being and offers evidence-based solutions to critical data governance challenges that countries face. Deliverables from this phase of the project, concluded at the Ministerial Meeting, include the Going Digital Guide to Data Governance Policy Making and the report Going Digital to Advance Data Governance for Growth and Well-being.

• See more on the 2022 OECD Digital Economy Ministerial Meeting.
• Read the original announcement.

Complete Document:  Declaration on Government Access to Personal Data held by Private Sector Entities (PDF) – Mouseover to Scroll

Original Document

Additional Reading

• A Safe Space? EDPB and EDPS Adopt Joint Opinion on European Health Data Space Proposal
• From Continuity to Culture? Preserving and Securing Ukrainian Public and Private Sector Data

Source: ComplexDiscovery