Article 19.8: each Party adopts or maintains a legal framework protecting personal information of digital trade users (comprehensive, sector-specific or enforceable voluntary undertakings all qualify), taking into account the APEC Privacy Framework and the 2013 OECD Guidelines, with key principles of collection limitation, choice, data quality, purpose specification, use limitation, security, transparency, individual participation and accountability; restrictions on cross-border flows should be necessary and proportionate; each Party publishes how individuals obtain remedies and how enterprises comply, and the APEC Cross-Border Privacy Rules are recognised as a valid transfer mechanism. For organisations: privacy compliance follows each Party's own law; APEC CBPR (now the Global CBPR Forum) certification is recognised as a transfer tool.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.