OECD countries adopt an agreement on government access to private sector data
The OECD countries adopted, on 14 December, a declaration on access to personal data for national security and law enforcement purposes. The agreement stems from the need to create trust for cross-border data flows, and clarifies how national security and law enforcement agencies can access personal data under existing legal frameworks.
This is the first intergovernmental agreement in this area on common approaches to safeguarding privacy and other human rights and freedoms. The Declaration on Government Access to Personal Data Held by Private Sector Entities marks a major political commitment by the 38 OECD countries and the European Union. However, it is not legally binding.
The high-level declaration includes seven principles including redress, oversight and transparency. The principles apply to ‘government access to and processing of personal data in the possession or control of private sector entities when governments are pursuing law enforcement and national security purposes within their respective territories in accordance with their national legal framework, including situations where countries have the authority under their national legal framework to mandate that private sector entities provide data to the government when the private sector entity or data are not located within their territory.’
The signatories agree that where there are restrictions for transborder flows in national laws, they take into account a destination country’s effective implementation of the principles as a ‘positive contribution’. Coinciding with the declaration, the EU issued its draft adequacy decision on EU-US data flows on 13 December.
OECD Secretary-General Mathias Cormann said: “Today’s landmark agreement formally recognises that OECD countries uphold common standards and safeguards. It will help to enable flows of data between rule-of-law democracies, with the safeguards needed for individuals’ trust in the digital economy and mutual trust among governments regarding the personal data of their citizens.”