Balancing organizational accountability and privacy self-management in Asia-Pacific

A comparative analysis of legal bases for processing of personal data across data protection laws in Asia-Pacific

WHY THIS REVIEW?

ABLI Data Privacy Project

In 2016, ABLI initiated a Data Privacy Project (“Project”) to provide a framework for dialogue, research, and other activities with the aims of increasing legal certainty, accessibility, and availability of laws and regulations relating to data protection and privacy, facilitating cross-border compliance efforts by organizations, and promoting legal convergence to ensure a consistently high level of data protection for individuals across the Asia-Pacific region.

The work themes addressed in the Project are selected based on the suggestions and needs of a wide network of public and private stakeholders in the region, including data protection regulators, privacy professionals, legal practitioners, academics, think tanks, etc.

A precedent: “Transferring Personal Data in Asia: A path to legal certainty and regional convergence”

The first line of work in the Project focused on cross-border data transfer regulations in Asia-Pacific. This work demonstrated the challenges that arise from divergence in laws, regulations, and other frameworks across the region, and the negative impact of such divergence on private stakeholders that operate across borders, data subjects, and regulators.

This work also led to several publications, including a landmark paper – “Transferring Personal Data in Asia: A path to legal certainty and regional convergence” (ABLI, May 2020) – that provides a detailed comparative analysis of data transfer regulations in Asia-Pacific and sets out proposals for regional stakeholders to promote legal certainty and greater consistency in requirements for cross-border transfer of personal data.

Notice and choice, consent, and alternative legal bases for processing personal data in Asian data protection laws

ABLI’s network of stakeholders has consistently given feedback that the areas most in need of regulatory coherence in Asia-Pacific are the implementation of consent requirements and the various alternatives and exceptions to those requirements. However, ABLI also received feedback that the culture of “compliance through consent” is so deeply ingrained in practice that no change can occur without resolute and coordinated action from regulators.

Therefore, in 2021, ABLI embarked on the second phase of the Project: identifying common ground in requirements for consent and other legal bases for processing personal data in regional laws and regulations which regulators, through coordinated efforts, could develop into a consistent set of norms for Asia-Pacific that would balance privacy accountability by organizations that process personal data and “privacy selfmanagement” by individual data subjects.