Expedia Group holds the Global CBPR and PRPP certifications.
The Global CBPR (Cros-Border Privacy Rules) and PRP (Privacy Recognition for Processors) systems are global data protection certifications established by the Global CBPR Forum to facilitate secure, trusted, and compliant international data transfers between jurisdictions. The Global CBPR and PRP Systems require participating businesses to implement data privacy policies consistent with the Global Cross-Border Privacy Rules (CBPR) Framework. These policies and practices must be assessed as compliant with the minimum program requirements of the Global CBPR and PRP Systems by an Accountability Agent (an independent Global CBPR and PRP system recognized public or private sector entity) and be enforceable by law.
CBPR Certification
The Global CBPR System, initially endorsed by APEC Leaders in 2011, is a voluntary, accountability-based system that facilitates privacy-respecting data flows among international jurisdictions. The Global CBPR certification is a set of requirements applicable to controllers that is based on nine main privacy principles: Preventing harm; Notice; Collection limitation; Uses of personal information; Choice; Integrity of personal information; Security safeguards; Access and correction; and Accountability.
The initial participating member jurisdictions in the Global CBPR Forum are the USA, Mexico, Japan, Canada, Singapore, the Republic of Korea, Australia, Chinese Taipei and the Philippines with additional jurisdictions like Bermuda, Dubai, Nigeria, Mauritius, and the United Kingdom having joined as associate members or through related arrangements, with more expected to join soon.
The Global CBPR certification is a set of rules for processors that is based on two main principles: security safeguards and accountability. The PRP requirements are integrated with the CBPR system.
The Global CBPR System Certification Mark and Global PRP System Certification Mark TM are trademarks of the International Trade Administration/Office of Global Data Policy and Privacy, used with permission.