Privacy Issues, Business Process Outsourcing and Cross-border Data Sharing

Wayne Ha

Organisations continue to collect ever more information – in depth, breadth and volume – on their customers, potential customers and, in some cases, employees. The debate over the need to balance national security, the right to personal privacy and flexibility to do business has led to the formation of international frameworks that will shape how the US does business with different corners of the world. Underpinning this is the concept of data custody that, wanting to chart the best path in an age of distributed cloud storage and processing, confounds both data professionals and risk managers alike.

This chapter will endeavour to unpack, from the data practitioner’s view, how companies could approach business process outsourcing (BPO) given Europe’s and Asia–Pacific’s divergent views on data privacy. An examination of the state of play in the US, UK and Germany will expose specific risks and potential liabilities attached to the cross-border sharing of data and IT infrastructure, and upon whose shoulders liabilities may ultimately rest. An argument will be made that the road to compliance for regional privacy frameworks would limit but not preclude a BPO partner from delivering