Model Provisions for Data Protection in Commonwealth Countries: How Do They Fit?

Abstract

The Commonwealth comprises 56 Member States, almost all of which have English as a lingua franca, a legal system based on the common law, and a colonial/constitutional history linked to the UK. Nevertheless, they do not have a great deal in common when it comes to data protection and privacy laws. Data privacy legislation has been enacted, albeit with very significant variations, in 41 Member States, but that still leaves 15 Commonwealth jurisdictions (UN member states) with no such legislation.

The Commonwealth’s Model Provisions on Data Protection (CMP) was adopted in November 2021 by Commonwealth Law Ministers meeting in Mauritius. Experts from LSE Law School and Edinburgh Law School drafted a comprehensive data privacy Bill, but one that includes optional provisions. The Model Provisions could be used as a template for revising existing laws or drafting new laws. Despite their potential significance, the Model Clauses are as yet little known or analysed.

This article examines the potential significance of this new Commonwealth initiative for the global development of data privacy laws and considers where that initiative sits in comparison with other international data privacy standards. In order to facilitate such an overall comparison, the following Tables classify each of the principles in the Model Provisions as being 1st, 2nd, or 3rd ‘generation’ principles, according to where they first appeared in the European or international instruments under consideration.

This analysis concludes that the Commonwealth has developed one of the strongest international privacy instruments, subject to the significant qualification that CMP allows complete exemptions for national security and law enforcement purposes, rather than the limited exemptions it allows on other topics.

Keywords: Commonwealth, privacy, data protection