LAWASIA DECLARATION

ON THE NEED FOR ADEQUATE PRIVACY LAWS

IN THE ASIA-PACIFIC REGION 

A.     Under Article II of LAWASIA's Constitution, LAWASIA's objects include the protection of human rights, the diffusion of knowledge of laws, the promotion of development of law in the region and the promotion of uniformity in the region in appropriate fields of law.  

B.     Article 7 of the International Covenant on Civil and Political Rights provides that individuals should not  be subjected to arbitrary or unlawful interference with their privacy.  

1. Member organisation from countries in the Asia-Pacific region should urge their respective lawmakers to enact adequate privacy laws as soon as practicable.
2. It is desirable that all privacy legislation in the region be underpinned by consistent privacy principles.
3. A number of privacy frameworks have been enacted over the years which would form a suitable basis for the enactment of domestic legislation, including the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1981), the Council of Europe Convention and the APEC Privacy Principles (2004), domestic legislation in the form of the Privacy Act 1988 (Australia) and the Privacy Act  1993 (New Zealand), and the recommendations of the Australian Law Reform Commission in its report entitled Australian Privacy Law and Practice (2008). 
4. LAWASIA does not seek to prescribe or recommend specific privacy principles for adoption within the Asia-Pacific Region, save that it considers that privacy legislation should reflect the high level principles set out in the Attachment to this Declaration.  

    SIGNED the ninth day of November 2009                                                                        

    Glenn Ferguson (President)

1. Member organisation from countries in the Asia-Pacific region should urge their respective lawmakers to enact adequate privacy laws as soon as practicable.
2. It is desirable that all privacy legislation in the region be underpinned by consistent privacy principles.
3. A number of privacy frameworks have been enacted over the years which would form a suitable basis for the enactment of domestic legislation, including the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1981), the Council of Europe Convention and the APEC Privacy Principles (2004), domestic legislation in the form of the Privacy Act 1988 (Australia) and the Privacy Act  1993 (New Zealand), and the recommendations of the Australian Law Reform Commission in its report entitled Australian Privacy Law and Practice (2008).
4. LAWASIA does not seek to prescribe or recommend specific privacy principles for adoption within the Asia-Pacific Region, save that it considers that privacy legislation should reflect the high level principles set out in the Attachment to this Declaration.
5. Data collectors should publish, or otherwise make available, a privacy policy which explains how it will handle personal information and what rights individuals have in relation to accessing and, if appropriate, correcting that information. 
    
6. Data collectors must only use information for the primary purpose of collection or for a related purpose which the individual could reasonably expect in the circumstances.
7. Data collectors must not transfer personal information to another person without the consent of the data subject if to do so is inconsistent with the primary purpose of collection or a related secondary  purpose unless the transfer is required or permitted by law or is necessary for law enforcement.
8. Personal information held by a data collector may only be used for direct marketing where this is consistent with the primary or related purpose of collection, or where the individual has otherwise expressly or implicitly consented. 
9. Data collectors must take reasonable steps to ensure that personal information for which it is responsible remains accurate and up to date. 
10. Data collectors must take reasonable steps to ensure that personal information under its control remains free from unauthorised access or modification.  
11. Individuals are entitled to have access to, and to correct any inaccuracies in, information about them which is held by a data collector, subject to exceptions in the case of the protection of confidentiality, trade secrets and information relevant to law enforcement security. 
12. A data collector must not transfer personal information to another jurisdiction unless that other jurisdiction has comparable data protection laws or, alternatively, the recipient agrees to be  contractually bound by privacy obligations consistent with these principles.