General Data Protection Regulation compliance was top of the list for many global corporate legal departments in 2018. As we plan for a world "post- GDPR" and set priorities for next year, what are appropriate next steps to strengthen a company’s privacy regime? Should a company react to worldwide privacy developments as they come, or is there a way to include biding corporate rules as part of a comprehensive and scalable privacy program?
Binding corporate rules are known as the “gold standard” for data protection. So far only 132 companies have obtained approved BCRs, which allows them to simplify transnational data flows, harmonize their data management and governance processes and, perhaps most importantly, stand out among peers and utilize privacy as a competitive differentiator. On the other hand, BCRs are not the right choice for all companies and have their disadvantages; notably a long, costly and potentially grueling approval process with the lead supervisory authority.
This article provides a high-level overview of BCRs and points out pros and cons to assist privacy professionals in developing a strategic approach to privacy, which may in certain cases include BCRs.
What are BCRs?
BCRs are a strict set of internal binding rules that define a company’s policy on data protection. They allow for the transfer of personal data from the European Economic Area/EU to the countries that do not provide an adequate level of protection within the same corporate group. Article 47 of the GDPR recognizes BCRs as an “appropriate safeguard” for cross-border data transfer and provides mechanisms to streamline the approval process.
There are two types of BCRs. BCRs for controllers (BCR-C) are designed for transfer of personal data from EU-based controllers to other non-EU entities within the same corporate group. BCRs for processors (BCR-P) apply to personal data received from an EU controller that is not a member of the group (e.g. an enterprise client of a multinational software provider) and then processed by the group entities. Thus BCR-P covers (sub)processing activities on behalf of a third party. The latest Article 29 Working Party guidance on BCRs (for controllers and processors) stressed that businesses with approved BCRs should update them in line with the new GDPR requirements in advance of the May 25 ,2018 effective date. Companies with the U.K. regulator as their DPA will also need to review their BCRs in light of Brexit.
Of course, companies must establish a lawful basis for processing data. BCRs only facilitate transfer of data out of the EEA/EU; they do not in and of themselves legitimize the collection, processing or sharing of data.
The process to obtain BCRs includes five steps:
- You must designate the lead authority (for criteria, see: How is the lead authority chosen?).
- You must submit a BCRs application and supporting documentation to the lead authority.
- The lead authority will review. This step is likely the most extensive and requires close cooperation with the lead authority.
- There's an opinion from the European Data Protection Board (either endorses or amendments required).
- There's the BCR approval.
Timing estimates from start to finish of a BCR process start at 18 months; however, the process can take much longer due to review and scrutiny by the regulator. Also, there may be delays due to scarcity of resources within national data protection authorities' offices and other regulatory priorities (i.e. enforcing GDPR).
Examples of approved BCR documentation are available at the IAPP Resource Center.
BCR benefits: Best case route
There are a number of advantages to BCRs, and they may offer the best case route. First, they serve as a sign of a company’s privacy maturity, meet increasing customer expectations and support a global company culture of privacy and data protection.
Second, they ease the administrative burden of managing and updating intra-company agreements along with standard contractual clauses (which could be a cumbersome process for a large companies) and simplify organizational complexity around data governance policies and processes.
Finally, due to their flexibility, BCRs can support global compliance across various jurisdictions with unique data protection, privacy and data security laws. BCRs and the underlying compliance assessment could also support other privacy certifications a company may want to pursue such as APEC Cross Border Privacy Rules, EU Cloud Code of Conduct, and eventual GDPR certification (none currently but will likely be available after 2020).
BCR risks: Better call reinforcements
BCRs are not the right solution for all companies, especially smaller companies that are not transnational. There are strong indicators not to be hasty along the BCR route due to the uncertainty of actual benefits provided in a post-GDPR environment as well as the true costs, resource needs and timing to obtain the approval. Any strategic planning should consider the downsides and reinforcements if BCRs are not in fact the right option at this time.
BCR could be viewed as a “last resort” and part of your contingency planning in case SCCs and Privacy Shield are invalidated. However, it is not clear if the same challenges — notably lack of due process and government access to data— will be used to eventually invalidate BCRs as an onward data transfer mechanism.
But perhaps the major drawback is that BCRs may not be needed if SCCs and Privacy Shield survive legal scrutiny. Yet they are an important tool from the compliance perspective and desirable in some circumstances.
Is it worth the effort?
It depends on many factors, such as the size of a company, available budget and resources, and overall business strategy. Similar to GDPR compliance activities, any BCR project will require cross-functional efforts and alignment from your business and governance stakeholders.
If your company considers going this route, then it makes sense to start now. After months spent in preparation for the GDPR, companies can leverage momentum, stakeholder involvement and current documentation of data flows and data inventory.
BCRs may represent a long-term strategic solution for your corporate privacy program. Your company could be one of the select few with approved BCRs and potentially benefit from efficiencies and direct dialogue established with your supervisory authority.
photo credit: GWP Virtual Network Meeting 2015 via photopin