83 FR 657 - Applications To Serve as Accountability Agents in the Asia Pacific Economic Cooperation (APEC) Privacy Recognition for Processors (PRP) System

DEPARTMENT OF COMMERCE
International Trade Administration

Federal Register Volume 83, Issue 4 (January 5, 2018)

The International Trade Administration's Office of Digital Services Industries (ODSI) invites interested organizations to submit applications for recognition by APEC to act as an Accountability Agent for U.S.-based companies that are subject to Federal Trade Commission jurisdiction as part of APEC's Privacy Recognition for Processors system.

[Federal Register Volume 83, Number 4 (Friday, January 5, 2018)]
[Notices]
[Pages 657-658]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2018-00046]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF COMMERCE

International Trade Administration

[Docket No.: 160721646-6646-01]
RIN No. 0625-XC022


Applications To Serve as Accountability Agents in the Asia 
Pacific Economic Cooperation (APEC) Privacy Recognition for Processors 
(PRP) System

AGENCY: International Trade Administration, U.S. Department of 
Commerce.

ACTION: Notice of opportunity for organizations to submit applications 
to serve as Accountability Agents in the Asia Pacific Economic 
Cooperation (APEC) Privacy Recognition for Processors (PRP) system.

-----------------------------------------------------------------------

SUMMARY: The International Trade Administration's Office of Digital 
Services Industries (ODSI) invites interested organizations to submit 
applications for recognition by APEC to act as an Accountability Agent 
for U.S.-based companies that are subject to Federal Trade Commission 
jurisdiction as part of APEC's Privacy Recognition for Processors 
system.

DATES: Applications may be submitted beginning December 29, 2017. Until 
further notice, there is no closing date for submitting applications.

ADDRESSES: Please submit applications by email to 
[email protected], attention: Michael Rose, Office of Digital 
Services Industries, International Trade Administration, U.S. 
Department of Commerce. See SUPPLEMENTARY INFORMATION for additional 
instructions on submitting applications.

FOR FURTHER INFORMATION CONTACT: All questions concerning this notice 
should be sent to the attention of Michael Rose, Office of Digital 
Services Industries, International Trade Administration, U.S. 
Department of Commerce, by telephone at (202) 815-0374 (this is not a 
toll-free number) or by email at [email protected].

SUPPLEMENTARY INFORMATION: In 2004, Leaders of the 21 APEC economies 
\1\ endorsed the ``APEC Privacy Framework'' (Framework). The goal of 
the Framework is to facilitate the flow of information between the 21 
economies in APEC by promoting a common set of privacy principles that 
will enhance electronic commerce, facilitate trade and economic growth, 
and strengthen consumer privacy protections. In order to implement this 
Framework, member economies developed a voluntary system of Cross 
Border Privacy Rules (CBPR), which was endorsed by APEC Leaders in 
November 2011 (the Leaders' Declaration is available at http://www.apec.org/Meeting-Papers/Leaders-Declarations/2011/2011_aelm.aspx). 
The Leaders' Declaration instructs APEC member economies to implement 
the APEC CBPR system to reduce barriers to information flows, enhance 
consumer privacy, and promote interoperability across regional data 
privacy regimes. In July 2012, the United States formally commenced 
participation in the CBPR system. The United States issued an open 
invitation for interested organizations to submit applications for 
recognition by APEC to act as an Accountability Agent for U.S.-based 
companies that are subject to Federal Trade Commission jurisdiction as 
part of APEC CBPR system, available at: https://www.federalregister.gov/documents/2012/07/30/2012-18515/applications-to-serve-as-accountability-agents-in-the-asia-pacific-economic-cooperation-apec-cross.
---------------------------------------------------------------------------

    \1\ The 21 APEC economies are Australia, Brunei Darussalam, 
Canada, Chile, the People's Republic of China, Hong Kong, Indonesia, 
Japan, the Republic of Korea, Malaysia, Mexico, New Zealand, Papua 
New Guinea, Peru, Philippines, Russia, Singapore, Chinese Taipei, 
Thailand, the United States, and Vietnam.*COM019*
---------------------------------------------------------------------------

    The APEC CBPR system applies to personal information controllers 
(``controller''), defined in the Framework as ``person(s) or 
organization(s) who control the collection, holding, processing or use 
of personal information''. APEC developed the Privacy Recognition for 
Processors (PRP) system to complement the CBPR system, and APEC Leaders 
endorsed the PRP system in February 2015. The United States was 
approved by APEC economies on the Joint Oversight Panel, the body 
overseeing the CBPR and PRP systems, to participate in the PRP system 
on November 15, 2017.
    The PRP system is designed to help personal information processors 
(``processors''), third parties that are acting as agents to perform 
task(s) on behalf of and under the instructions of a controller, 
demonstrate their ability to implement a controller's privacy 
obligations related to the processing of personal information. The PRP 
system also helps controllers identify qualified

[[Page 658]]

and accountable processors and helps ensure that processing is 
consistent with the controller's CBPR System processing requirements.
    The PRP system requires processors to implement privacy policies 
and practices consistent with the PRP system requirements for all 
personal information that they process on behalf of controllers, and 
these policies and practices must be assessed as compliant by an APEC-
recognized Accountability Agent (``PRP certification''). Under the PRP 
system, an ``Accountability Agent'' is a third-party organization that 
provides verification services related to the data privacy policies and 
practices for those processors seeking PRP certification. Only APEC-
recognized Accountability Agents may perform PRP certifications.
    An Accountability Agent may only provide PRP certification for a 
U.S. processor that is subject to the enforcement authority of the 
Federal Trade Commission, the U.S. privacy enforcement authority.
    An applicant may be designated as an Accountability Agent if APEC 
member economies recognize that it meets the recognition criteria 
agreed to by APEC. Those criteria are set forth in the Accountability 
Agent APEC Application for the PRP System (``APEC PRP System Guide''), 
which is available at: https://cbprs.blob.core.windows.net/files/Accountability%20Agent%20Application%20for%20PRP%20Revised%20For%20Posting%203-16.pdf.
    Organizations interested in being designated as an Accountability 
Agent should notify the Department of Commerce of their interest in 
obtaining APEC recognition and submit the information described in the 
APEC PRP System Guide to the Office of Digital Services Industries by 
email at [email protected].

    Dated: December 29, 2017.
James Sullivan,
Deputy Assistant Secretary for Services, U.S. Department of Commerce.
[FR Doc. 2018-00046 Filed 1-4-18; 8:45 am]
 BILLING CODE 3510-DR-P