The Accountability Project marked its five-year anniversary in April 2014. During each of its five years, the Project provided shape and definition to the data protection practices that make up accountability. The result has influenced lawmakers, regulators and policy makers to adopt elements of accountability.The Project’s first year established that, to be accountable, an organisation should design and implement comprehensive data and privacy protection programmes based on analysis of the risks data use raises for individuals and on responsible decisions about how those risks can be appropriately mitigated. Through its Galway Paper, the Project articulated essential elements of how an accountable organisation demonstrates commitment to accountability, implements data privacy policies linked to recognise outside criteria and establishes performance mechanisms to ensure responsible decision making about the management of data consistent with organisation policies. It is against these elements that an organisation’s accountability is measured.In its second year, the Project issued the Paris Paper that proposed the fundamental conditions of accountability that an organisation put in place and be able to demonstrate to regulators. It further considered how, and under what circumstances, regulators, data protection authorities and their designated agents would measure accountability. The Project anticipated that organisations and regulators must be able to implement and measure the fundamentals in a manner suitable for the organisation, its business model, and the way it collects, uses, and stores data. In year three, the Project considered accountability as an approach to privacy and data protection required and implemented across the marketplace, and articulated the benefits that would accrue to individuals, the market and organisations as a result. While all organisations would adopt accountability in this model, the Project presented the Madrid Paper that identified instances in which an organisation might seek recognition of its accountability. It also described under what circumstances organisations would be required to demonstrate their accountability and what exactly that demonstration would entail.By the Project’s fourth year in 2012, accountability had emerged as a recognised approach to privacy and data protection. The European Commission had proposed a data protection regulation that would apply across European Union (“EU”) member countries and in which accountability played a critical role. The Federal Privacy Commissioner of Canada and Information Commissioners of Alberta and British Columbia in Canada released a document articulating what data protection authorities would expect of organisations under an accountability approach. The Asia-Pacific Economic Cooperation (“APEC”) forum finalised its Cross Border Privacy Rules system, an accountability-based code of conduct for businesses in the APEC region.In its fifth year, the Project focused on the application of accountability under specific conditions such as distributed environments, public clouds and scalability. That year, the Project introduced risk as another element of consideration. The influence of the Project could be seen in the work of the regulators with the Hong Kong Privacy Commissioner’s guidance, “A Best Practice Guide.” In addition, the influence of the Project included the Article 29 Working Party and the APEC Data Privacy Subgroup release of their review of the EU’s Binding Corporate Rules (“BCRs”) and APEC’s CBPR system. Both explicitly acknowledged the common elements of the two accountability-certifying systems that used very different assessment processes. While the work of the Project continued at the Centre, a new organisation, the Foundation was formed to provide a non-profit home for work to implement accountability into governance structures. The Foundation focused its efforts on international dialogue on specific infrastructure issues related to accountability with a presentation before the Organisation for Economic Co-operation and Development (“OECD”).
Read full abstract