With Safe Harbor constantly under fire, the binding corporate rules (BCR) process is becoming an increasingly attractive way for companies to ensure their ability to transfer data out of the European Union. This week, Align Technology, a U.S. medical device company, entered an exclusive club when its BCR application as both a data controller and a data processor was approved by EU data protection authorities.

As K Royal, CIPP/US, CIPP/E, Align’s first dedicated privacy officer, can tell you. It wasn’t an easy process, but she’s confident it’s been time and money well spent.

Despite various champions’ sweat-inducing work to keep Safe Harbor afloat, it’s becoming increasingly difficult to find days of the week that don’t feature headlines from one side of the pond or the other on its impending doom. While the U.S. Department of Commerce and regulators like the Federal Trade Commission’s Julie Brill have indeed invested time and resources in quelling Europeans’ skepticism (at best) or downright distrust (at worst) of the data transfer mechanism, the Snowden revelations’ significant impact on any trust  Europeans had in the U.S. on data protection and privacy can’t be denied by anyone who’s been paying attention.

So while EU Justice Commissioner Viviane Reding and her team conduct a review of Safe Harbor and the European Court of Justice prepares to rule on its scope, companies hoping to seal international deals aren’t taking chances. For that reason among others, BCRs are becoming an increasingly attractive alternative, as promoted recently by Eduardo Ustaran, CIPP/E, in his blog post, “Five Reasons To Do BCRs Now.”

Align Technology brought on Royal just as the European government was setting forth its plans to update the European data protection regulation. Align had just gone through an internal privacy review and was looking to improve its privacy program. While the U.S.-EU Safe Harbor agreement was the initial plan, Align soon realized a BCR regime would establish compliance with a multitude of privacy laws in one fell swoop—COPPA, HIPAA, etc. With the ability to register as both a controller and a processor under the BCR framework established in 2012, Royal and her team were among the first to wind their way through the process.

Making the Case for BCRs at Your Company

No, it wasn’t easy, Royal admits. It took a year to negotiate the terms, and Royal had to be creative in how she would effect change at Align in order to satisfy the BCR requirements.  Plus, she was new at the company, and she had a lot to learn—from the ground up—about how Align’s processes worked.

The good news was that Royal’s case for BCRs was supported by Align’s executives and board of directors, who understood that while other data transfer mechanisms might be easier to implement, they were looking for the “right” solution, and not necessarily the easiest one.

“Privacy departments typically don’t get big budgets or lots of project time,” said Royal. “If you want a project done or you approach to change a system, privacy is not generally high on the business priority list.”

She had some help, though.

The HITECH Act was in play, for example, which applies to business associates like Align. Couple that with the Snowden revelations and a flurry of massive breach headlines within the last year or so, and Royal had a case.

“The more bad news other people make, the better it is for those of us trying to get this done,” she said.

Bolstered by the headlines, Royal took sort of a backdoor approach to getting things done. Rather than try to dictate terms from the top down, she jumped on Align’s project team and worked with them from the start.

“Every project that went through, we used that opportunity to leverage or put in place more privacy,” she said. “We kind of built that in; we baked it into the portfolio.” For critical privacy projects, Royal says she had to prioritize projects in order to get the support she needed to get them done.

The BCR process was particularly difficult for Royal because of the company’s youth and aggressive forward march. The focus is innovation, making products better.

“We’re in the technology field, we’re in the medical device field, we’re regulated by the FDA,” she said, adding that the company acts “very much the way one imagines an innovative, technology-focused Silicon Valley company would act. The priorities are centered around the products,” and less about the policies that guide the product development.

But that’s where Royal came in.

She relied heavily on Align’s project engineers, its information security officer and the IT team. The process required weekly meetings, which was a heavy lift. Additionally, Align had previously developed a cross-functional team that serves as the Privacy Working Group.

In late 2012, Royal’s boss, the VP of litigation and regulatory affairs, flew to Europe to meet with the lead data protection regulators in person, feeling it would be a good thing to do early on.

“We said, ‘We want to do BCRs for processors,’ and they said ‘Here’s what to do,’” Royal said, adding that the in-person visit “really went far in helping us when the application came around.”

In the year between the date Align filed the BCR application and it being “closed,” multiple revisions were made to each of the policies submitted. But Royal said the lead European regulators who worked with Align—the Netherlands, as the lead authority, and the UK and Italy—took a very practical approach to the process and understood that the policies and procedures Align would promise to comply with may not be in place from the jump. It was more important to them that the wheels for such processes be in motion, rather than such processes be completely perfect.

“For example, one policy states that we’ll train toward the BCR policies,” Royal said, but “you can’t train toward them until the policies are approved.”

The Golden Age of BCRs

Phil Lee, CIPP/E, CIPM, partner at law firm Fieldfisher, who counseled Align through the BCR application process, said BCRs are entering a “Golden Age” and for a couple of reasons. First, the Snowden revelations, after which his firm saw an “exponential uptick” in the number of applications for BCRs. Indeed, when Royal started the process for Align, she noted there were 19 companies approved for BCRs. When she’d completed the process, there were 53.

“With Safe Harbor, we’re getting clients who are making deals and having customers refuse to sign unless they do something other than Safe Harbor,” Lee said. “It doesn’t matter that Safe Harbor is still legal, they just don’t like it because they’re nervous about it.” He added that in particular, the cloud industry is reaching for BCRs.

Second, BCRs are so comprehensive, they aren’t only a data export solution, but the foundation for a global privacy program itself, capable of helping firms achieve compliance all over the world—beyond just the EU and U.S.

Want to Apply for BCRs? Take a Deep Breath

“Don’t be daunted,” Lee said. “BCRs are actually a very straight forward process to go through. The guidance is overwhelming and makes it appear far more daunting than it is.”

But the process has become increasingly streamlined as EU regulators have become more familiar with their shape. And besides, for companies who are employing responsible data protection policies, it’s more about capturing those policies in documented form.

Since Align has gained approval, Royal has been focused on doing personal training for every department at the company. Asked what advice she’d give to a company looking to go through this process themselves, Royal said privacy pros should leverage projects that are based on business needs rather than privacy alone.

Royal said BCRs had executive sponsorship and approval from the board, so when there were setbacks, she could leverage that executive approval.

“But you have to use that power sparingly and strategically,” she said. “Most projects were accomplished by finding where privacy fit within those projects based on business needs.”

Read More by Angelique Carson:
Biometrics Industry: “There Is No Anonymity If We Choose To Live in Society”
July/August Product Roundup

Little DuckDuckGo Had a Very Big Week
Should the Facial Recognition Code Apply to the Gov’t? Could It?

Written By

Angelique Carson, CIPP/US


If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find a KnowledgeNet Chapter Near You

Talk privacy and network with local members at IAPP KnowledgeNet Chapter meetings, taking place worldwide.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

The Privacy Core™ Library Has Evolved

Privacy Core™ e-learning essentials just expanded to include seven new units for marketers. Keep your data safe and your staff in the know!

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

Upcoming Web Conferences

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Team

Get your team up to speed on privacy by bringing IAPP training to your organization.

Let’s Get You DPO Ready

There’s no better time to train than right now! We have all the resources you need to meet the challenges of the GDPR.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

FIP Designation

Recognizing the advanced knowledge and issue-spotting skills a privacy pro must attain in today’s complex world of data privacy.

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.


The IAPP’S CIPP/E and CIPM are the ANSI/ISO-accredited, industry-recognized combination for DPO readiness. Learn more today.

Learn more about IAPP certification »

Are You Ready for the GDPR?

Check out the IAPP's EU Data Protection Reform page for all the tools and resources you need.

IAPP-OneTrust PIA Platform

New U.S. Government Agency privacy impact assessments - free to IAPP members!

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

Privacy Vendor List

Find a privacy vendor to meet your needs with our filterable list of global service providers.

More Resources »

Europe Data Protection Intensive 2017

The Intensive is sold out! But cancellations do happen—so hurry and get on the wait list in case more seats become available.

Global Privacy Summit 2017

The world’s premier privacy conference returns with the sharpest minds, unparalleled programs and preeminent networking opportunities.

Canada Privacy Symposium 2017

The Symposium returns to Toronto this spring and registration has opened! Take advantage of Early Bird rates and join your fellow privacy pros for another stellar program.

The Privacy Bar Section Forum 2017

The Privacy Bar Section Forum is sold out! But you can still add your name to the wait list, and we'll keep in touch about your status. Good luck!

Asia Privacy Forum 2017

Call for Speakers open! Join the Forum in Singapore for exclusive networking and intensive education on data protection trends and challenges in the Asia Pacific region.

Privacy. Security. Risk. 2017

We're bringing the best of the best in privacy and infosecurity to sunny San Diego. Early registration for P.S.R. opens May 1.

Europe Data Protection Congress 2017

Call for Speakers open! The Congress is your source for European policy debate, multi-level strategic thinking and thought-provoking discussion. Submit a proposal by March 19.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»