International Conference of Data Protection and Privacy Commissioners

International Conference of Data Protection and Privacy Commissioners
Name	International Conference of Data Protection and Privacy Commissioners
Abbreviation	ICDPPC
Formation	1979
Type	International forum
Headquarters	Rotating host
Region served	Global
Membership	National and subnational data protection authorities

International Conference of Data Protection and Privacy Commissioners is an annual multilateral forum bringing together national and subnational data protection authorities such as the Office of the Privacy Commissioner of Canada, Information Commissioner's Office (United Kingdom), Bundesbeauftragte für den Datenschutz und die Informationsfreiheit and Australian Information Commissioner to discuss cross-border General Data Protection Regulation, Privacy Act 1988 (Australia), Personal Information Protection and Electronic Documents Act. The conference convenes officials from bodies like the European Data Protection Supervisor, Data Protection Commission (Ireland), Federal Trade Commission and Office for Civil Rights (HHS) alongside representatives from organizations such as the Organisation for Economic Co-operation and Development, Council of Europe, United Nations, and International Telecommunication Union.

History

The ICDPPC traces origins to meetings among authorities including the Commission nationale de l'informatique et des libertés, Privacy Commissioner of New Zealand, Dutch Data Protection Authority, and Federal Commissioner for Data Protection and Freedom of Information (Baden-Württemberg) in the late 1970s and early 1980s, influenced by instruments like the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, the Council of Europe Convention 108, and the European Convention on Human Rights. Early conferences featured participation from entities such as the United Nations Human Rights Committee, World Intellectual Property Organization, and International Labour Organization, and addressed matters raised by cases from tribunals including the European Court of Human Rights and national courts like the Supreme Court of Canada and the High Court of Australia. Over decades, the ICDPPC engaged with developments including the adoption of the Data Protection Directive 1995, the formulation of the General Data Protection Regulation, the emergence of multinational platforms such as Google, Facebook, and Microsoft, and controversies involving investigations by the Office of the Privacy Commissioner of Canada and enforcement by the Information Commissioner's Office (UK).

Membership and Organization

Membership comprises authorities akin to the Data Protection Commission (Ireland), Autoriteit Persoonsgegevens (Netherlands), Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (Germany), Commission Nationale de l'Informatique et des Libertés (France), Austrian Data Protection Authority, and subnational regulators such as the Office of the Privacy Commissioner of British Columbia and California Privacy Protection Agency. Observers have included intergovernmental organizations like the Organisation for Economic Co-operation and Development, the Council of Europe, the United Nations Educational, Scientific and Cultural Organization, technology firms exemplified by Apple Inc., Amazon (company), Twitter, and civil society groups including Privacy International, Electronic Frontier Foundation, and Access Now. The conference's structure mirrors forums such as the International Organization for Standardization, with working groups that echo committees in the European Data Protection Board, G7, and G20 to coordinate thematic strands on enforcement, technology, and international cooperation.

Governance and Secretariat

Governance traditionally rests with a Bureau composed of chairing authorities similar to the Office of the Australian Information Commissioner and the Privacy Commissioner of Canada, supported by a Secretariat often hosted by an authority such as the Data Protection Commissioner (Ireland) or the Information Commissioner's Office (UK). Secretariat functions resemble those of the Council of Europe Secretariat and the OECD Secretariat and coordinate with agencies like the European Commission, United Nations Office of the High Commissioner for Human Rights, and the World Bank for project administration. Decision-making relies on consensus-building practices seen in the Council of the European Union and the United Nations General Assembly, while formal documents are promulgated by chairs in formats similar to resolutions of the United Nations Human Rights Council.

Key Resolutions and Initiatives

The conference has produced influential instruments including non-binding resolutions and model frameworks comparable to the OECD Guidelines and the Council of Europe Convention 108, addressing issues tied to technologies associated with Amazon (company), Google, Facebook, Microsoft, and TikTok (ByteDance). Notable outputs have tackled transborder data flows as in responses to Schrems v. Data Protection Commissioner, privacy aspects of surveillance raised by cases like those involving the National Security Agency, algorithmic decision-making concerns intersecting with studies by European Commission experts and reports from Amnesty International and Human Rights Watch. Initiatives have established best-practice guides on topics such as international cooperation mirroring Mutual Legal Assistance Treaty approaches, cross-border complaint mechanisms inspired by International Criminal Court cooperation, and capacity-building programs partnering with institutions like the World Bank and United Nations Development Programme.

Annual Conferences and Agendas

Each annual meeting—hosted in cities where authorities such as the Office of the Privacy Commissioner of Canada, Commission nationale de l'informatique et des libertés, Data Protection Commission (Ireland), or Information Commissioner's Office (UK) act as hosts—sets agendas reflecting contemporaneous debates involving European Commission proposals, rulings from the European Court of Justice, litigation such as Schrems II, regulatory actions by the Federal Trade Commission, and legislative reforms like amendments to the Privacy Act 1988 (Australia), California Consumer Privacy Act, and the Data Protection Act 2018. Sessions frequently feature panels with participants from United Nations, International Telecommunication Union, Organisation for Economic Co-operation and Development, civil society organizations like Electronic Frontier Foundation and Privacy International, and industry representatives from Google, Facebook, and Microsoft.

Impact on International Privacy Law and Policy

The ICDPPC has influenced transnational norms alongside instruments like the General Data Protection Regulation, the OECD Guidelines, and the Council of Europe Convention 108, shaping jurisprudence in courts such as the European Court of Justice and national tribunals including the Supreme Court of Canada and the High Court of Australia. Its consensus statements have informed policy positions of bodies like the European Commission, enforcement strategies of the Information Commissioner's Office (UK) and Data Protection Commission (Ireland), and legislative drafting in jurisdictions influenced by frameworks such as the California Consumer Privacy Act and Personal Information Protection and Electronic Documents Act. Through collaboration with actors like the World Bank, United Nations Development Programme, and Organisation for Economic Co-operation and Development, the conference has contributed to capacity building, model laws, and cross-border cooperation mechanisms affecting multinational corporations including Amazon (company), Apple Inc., Google, and Facebook.

Category:Privacy law