Mexico City, March 14th, 2023.<\/p>\n
On 21 April 2022, the United States of America (\u00abUS\u00bb), together with Canada, Japan, South Korea, the Philippines, Singapore, and Chinese Taipei, established the \u00abGlobal CPBR Forum\u00bb which aims to promote and implement the APEC Global Cross Border Privacy Rules (CBPR). In this sense, the Global CPBR Forum is a cooperative body that seeks to promote a certification that helps companies demonstrate internationally that they comply with recognized data protection standards. Therefore, it facilitates cross-border transfers of personal data. This certification is known as CBPR, and one of the \u00abGlobal CBPR Forum\u00bb goals has been to encourage its adoption and use in Latin American countries.<\/p>\n
In the case of Mexico, it has been established in the Agreement between Mexico, the United States of America, and Canada, known as USMCA, in chapter 19, \u00abDigital Trade,\u00bb that the Parties recognize the APEC Transborder Privacy Rules system as a valid mechanism to facilitate cross-border data transfers. The CBPR system requires participating companies to implement privacy policies consistent with the APEC privacy framework to obtain certification. Third-party certifiers assess and certify companies’ compliance with CBPR privacy standards.<\/p>\n
During March 9 and 10, a workshop was held at the National Institute for Transparency, Access to Information and Protection of Personal Data (\u00abINAI\u00bb) entitled \u00abThe Way Forward: United States – Mexico, CBPR Cooperation,\u00bb in which representatives from the US and Mexico met together with stakeholders to reach agreements regarding the regional adoption of the CBPR. In the framework of this event, Commissioner Josefina Rom\u00e1n Vergara mentioned that the Secretary of Economy together with INAI, have been working with the Global CBPR Forum for INAI to become a third-party certifier. As a result, INAI has undertaken various actions, such as creating a direction within the organic structure of INAI to implement CBPR in Mexico and has begun the procedures to become a third-party certifier.<\/p>\n
Within the workshop framework, it was mentioned that the CBPR did not prevent the use of or compliance with other privacy frameworks, such as the General Data Protection Regulation (\u00abGDPR\u00bb) or the use of Model Contractual Clauses. The CBPR is intended to be one more tool at the disposal of companies to comply with their personal data protection obligations. Likewise, the benefits of adopting this CBPR model for companies were emphasized, including: i) Providing confidence to consumers and customers that their personal data are processed under recognized data protection standards; ii) Streamlining business operations between the North American region by establishing a uniform compliance mechanism; and iii) Preventing obstacles between cross-border data transfers and guaranteeing transfer protections.<\/p>\n
The future implementation of the CBPR model in Mexico will undoubtedly bring new tools for small and large businesses to transfer personal data to other jurisdictions and comply with their obligations. The information technology and data protection area remain at your service.<\/p>\n
Sincerely:<\/p>\n
Adolfo Athi\u00e9 Cervantes<\/p>\n
aathie@basham.com.mx<\/a><\/p>\n <\/p>\n Renata Denisse Buer\u00f3n Valenzuela<\/p>\n rbueron@basham.com.mx<\/a><\/p>\n <\/p>\n Erika Itzel Rodr\u00edguez Kushelevich<\/p>\n erodriguez@basham.com.mx<\/a><\/p>\n <\/p>\n Ivan Garc\u00eda Argueta<\/p>\n