EU Approves Align Technologies as BCRs Enter Their “Golden Age”

With Safe Harbor constantly under fire, the binding corporate rules (BCR) process is becoming an increasingly attractive way for companies to ensure their ability to transfer data out of the European Union. This week, Align Technology, a U.S. medical device company, entered an exclusive club when its BCR application as both a data controller and a data processor was approved by EU data protection authorities.

As K Royal, CIPP/US, CIPP/E, Align’s first dedicated privacy officer, can tell you. It wasn’t an easy process, but she’s confident it’s been time and money well spent.

Despite various champions’ sweat-inducing work to keep Safe Harbor afloat, it’s becoming increasingly difficult to find days of the week that don’t feature headlines from one side of the pond or the other on its impending doom. While the U.S. Department of Commerce and regulators like the Federal Trade Commission’s Julie Brill have indeed

in quelling Europeans’ skepticism (at best) or downright distrust (at worst) of the data transfer mechanism, the Snowden revelations’ significant impact on any trust  Europeans had in the U.S. on data protection and privacy can’t be denied by anyone who’s been paying attention.

So while EU Justice Commissioner Viviane Reding and her team conduct a review of Safe Harbor and the

, companies hoping to seal international deals aren’t taking chances. For that reason among others,

, as promoted recently by Eduardo Ustaran, CIPP/E, in his blog post,

Align Technology brought on Royal just as the European government was setting forth its plans to update the European data protection regulation. Align had just gone through an internal privacy review and was looking to improve its privacy program. While the U.S.-EU Safe Harbor agreement was the initial plan, Align soon realized a BCR regime would establish compliance with a multitude of privacy laws in one fell swoop—COPPA, HIPAA, etc. With the ability to register as both a controller and a processor under the BCR framework established in 2012, Royal and her team were among the first to wind their way through the process.

No, it wasn’t easy, Royal admits. It took a year to negotiate the terms, and Royal had to be creative in how she would effect change at Align in order to satisfy the BCR requirements.  Plus, she was new at the company, and she had a lot to learn—from the ground up—about how Align’s processes worked.

The good news was that Royal’s case for BCRs was supported by Align’s executives and board of directors, who understood that while other data transfer mechanisms might be easier to implement, they were looking for the “right” solution, and not necessarily the easiest one.

“Privacy departments typically don’t get big budgets or lots of project time,” said Royal. “If you want a project done or you approach to change a system, privacy is not generally high on the business priority list.”

She had some help, though.

The HITECH Act was in play, for example, which applies to business associates like Align. Couple that with the Snowden revelations and a flurry of massive breach headlines within the last year or so, and Royal had a case.

“The more bad news other people make, the better it is for those of us trying to get this done,” she said.

Bolstered by the headlines, Royal took sort of a backdoor approach to getting things done. Rather than try to dictate terms from the top down, she jumped on Align’s project team and worked with them from the start.

“Every project that went through, we used that opportunity to leverage or put in place more privacy,” she said. “We kind of built that in; we baked it into the portfolio.” For critical privacy projects, Royal says she had to prioritize projects in order to get the support she needed to get them done.

The BCR process was particularly difficult for Royal because of the company’s youth and aggressive forward march. The focus is innovation, making products better.

“We’re in the technology field, we’re in the medical device field, we’re regulated by the FDA,” she said, adding that the company acts “very much the way one imagines an innovative, technology-focused Silicon Valley company would act. The priorities are centered around the products,” and less about the policies that guide the product development.

But that’s where Royal came in.

She relied heavily on Align’s project engineers, its information security officer and the IT team. The process required weekly meetings, which was a heavy lift. Additionally, Align had previously developed a cross-functional team that serves as the Privacy Working Group.

In late 2012, Royal’s boss, the VP of litigation and regulatory affairs, flew to Europe to meet with the lead data protection regulators in person, feeling it would be a good thing to do early on.

“We said, ‘We want to do BCRs for processors,’ and they said ‘Here’s what to do,’” Royal said, adding that the in-person visit “really went far in helping us when the application came around.”

In the year between the date Align filed the BCR application and it being “closed,” multiple revisions were made to each of the policies submitted. But Royal said the lead European regulators who worked with Align—the Netherlands, as the lead authority, and the UK and Italy—took a very practical approach to the process and understood that the policies and procedures Align would promise to comply with may not be in place from the jump. It was more important to them that the wheels for such processes be in motion, rather than such processes be completely perfect.

“For example, one policy states that we’ll train toward the BCR policies,” Royal said, but “you can’t train toward them until the policies are approved.”

Phil Lee, CIPP/E, CIPM, partner at law firm Fieldfisher, who counseled Align through the BCR application process, said BCRs are entering a “Golden Age” and for a couple of reasons. First, the Snowden revelations, after which his firm saw an “exponential uptick” in the number of applications for BCRs. Indeed, when Royal started the process for Align, she noted there were 19 companies approved for BCRs. When she’d completed the process, there were 53.

“With Safe Harbor, we’re getting clients who are making deals and having customers refuse to sign unless they do something other than Safe Harbor,” Lee said. “It doesn’t matter that Safe Harbor is still legal, they just don’t like it because they’re nervous about it.” He added that in particular, the cloud industry is reaching for BCRs.

Second, BCRs are so comprehensive, they aren’t only a data export solution, but the foundation for a global privacy program itself, capable of helping firms achieve compliance all over the world—beyond just the EU and U.S.

“Don’t be daunted,” Lee said. “BCRs are actually a very straight forward process to go through. The guidance is overwhelming and makes it appear far more daunting than it is.”

But the process has become increasingly streamlined as EU regulators have become more familiar with their shape. And besides, for companies who are employing responsible data protection policies, it’s more about capturing those policies in documented form.

Since Align has gained approval, Royal has been focused on doing personal training for every department at the company. Asked what advice she’d give to a company looking to go through this process themselves, Royal said privacy pros should leverage projects that are based on business needs rather than privacy alone.

Royal said BCRs had executive sponsorship and approval from the board, so when there were setbacks, she could leverage that executive approval.

“But you have to use that power sparingly and strategically,” she said. “Most projects were accomplished by finding where privacy fit within those projects based on business needs.”

Read More by Angelique Carson: