Privacy Law & Policy Reporter --- "An ISO Standard: Some Common Questions and Answers" [1997] PrivLawPRpr 49; (1997) 4(5) Privacy Law & Policy Reporter 91

---

An ISO Standard: Some Common Questions and Answers

Q. Is the ISO writing a standard on privacy?

A. Not at this stage. The ISO has just asked a small advisory group to consider whether or not ISO has any role to play in this field. A recommendation from that group will be made in January 1998.

Q. Will compliance with the ISO standard meet the European Union’s ‘adequacy’ test?

A. The European Union has not made any formal comment on the relationship between a potential standard and the EU Directive. The standard has not yet been written, and the nature of conformity assessment has not yet been determined.

Q. Will the ISO standard be based on the Canadian standard?

A. There has been some input from Canada to the advisory group, but many other countries are also represented. ISO may draw from a number of sources for the content of the standard.

Q. When will the standard be issued?

A. Standards are only issued after careful consideration and debate. Draft standards are circulated for comment, and a standard can only be published after a vote requiring 75% of member countries’ endorsement. This process may take some time to complete. No work has commenced on the content of a standard at this stage.

Q. How are standards enforced?

A. Standards are flexible documents that can be enforced in many ways by individual countries or even industry sectors. In Australia, compliance with standards is voluntary unless a standard is incorporated into a law or regulation (about 2400 standards have become mandatory in this way). Companies can usually apply to display a logo or trademark if they comply with a standard, although this is subject to independent tests and audits (known as conformity assessment).