Declaration of Privacy Rights Action Programme

in the Asia-Pacific Region on the occasion of the

International Forum on Privacy Rights in the Digital Age

Preamble

All the Participants assembled in Seoul for the International Forum on Privacy Rights in the Digital Age (27 -29 September 2005), under the auspices of the Korean National Commission for UNESCO, have agreed to promote the Privacy Rights Action Programme in the Asia-Pacific Region and have adopted the following final declaration:

- Recognizing that privacy is a fundamental human right, and also that all people and organisations have duties to protect privacy and personal data;

- Respecting the cultural differences in perceptions of privacy and how to protect privacy;

- Recognizing that the principles of privacy protection have been discussed by the international organisations and crystallized into a variety of international agreements;

the OECD Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data, the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the United Nations Guidelines concerning Computerized Personal Data Files, the European Union Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the Asia Pacific Economic Cooperation Privacy Framework;

- Recognizing that the developments of information and communication technologies and electronic commerce have created new threats to privacy;

- Noting that those developments have significant benefits as well as privacy risks, and that sometimes the benefits will outweigh the privacy risks;

- Noting that data protection promotes the free flow of information, within and across borders, which ia a prerequisite of modern business as well as beneficial for individuals;

- Bearing in mind that the technology's role is to serve humanity, particularly by contributing to the enhancement of communication, education, science, cultural diversity and human rights;

- Noting the security-first measures in response to terrorism have restricted privacy rights all over the world, not always with justification;

- Aware that the accumulation and processing of databases conducted by the governments and private entities could endanger the privacy of data subjects;

there is conflict of value in the following manner:

· The value of information and databases more often than not outweighs the individual privacy;

· Free flow of data is prerequisite to electronic commerce and businesses;

· Information technologies have made a kingpin in the economic growth;

· Public security is deemed to prevail over individual right to privacy in fighting against terrorism;

- Recalling that internationally accepted personal data protection principles incluede:

· lawful and necessary collection and processing of personal information;

· purpose-specification and limitation;

· accuracy;

· proportionality;

· transparency;

· access to personal information by the individual concerned;

· correction of personal information;

· non-discrimination;

· data security;

· responsibility;

· independent supervision of privacy matters; and

· adequate level of protection when engaging in data export and transborder data flows.

And

- Affirming that sactions should be imposed for breaches of privacy.

Accordingly,

All the Participants express their willingness to strengthen the international recognition of the universal nature of these principles. They share a profound concern about the harmful consequences arising out of the abuse and misuse of personal information, while also understanding the legitimate needs of government and business.

They agree to appeal:

To all data subjects:

- to realize the importance of privacy in the digital age;

- to learn how to protect their own privacy.

To all commercial organisations:

- to adhere to existing government regulation on privacy matters;

- to put sound privacy policies in place for all the stakeholders of the organisation;

- to have at least one senior employee as a contact point on privacy matters within the business;

- to build and use privacy enhancing technologies;

- to alert users of their products and services about any dangers to privacy;

- to minimize privacy threats when developing new projects, for example by conducting and acting on privacy impact assessments;

- to provide financial support for research and education into the field of privacy;

To non-governmental organisations:

- to be aware of the need for privacy protection and also to acknowledge their privacy duties;

- to become watchdogs to protect privacy;

- to provide education about privacy, especially to parents and their children;

- to cooperate with the media in raising privacy awareness;

- to stimulate the creation of privacy protection and promotion groups.

To the governments of the Asia-Pacific region:

- to study privacy laws and implementation experience of other countries in addition to the APEC Privacy Framework and other international privacy agreements;

- to adopt the internationally accepted principles of privacy and personal data protection;

To international organisations dealing with privacy matters:

- to collaborate with each other to enhance the level of protection of privacy in the Asia-Pacific region;

- to consult with regional NGOs concerned with privacy;

To UNESCO:

- to adopt privacy

To this end, all the Participants agree:

- to enhance privacy awareness by undertaking education and research, through government, UNESCO and private sector programmes;

- to build a partnership between the public and private sector to protect privacy, through regulation and/or self-regulation; and

- to develop a sustainable UNESCO network in this region to share information about privacy matters and to achieve the objectives in this Declaration.

September 2005

Seoul, Republic of Korea