International data transfers: Time to rethink binding corporate rules

International data transfers continue to be a top compliance and legal issue for both European and global organizations, requiring continuous reevaluation and increasing resources.

In its recent guidance from December 2022, the European Data Protection Board provided draft guidance with updated interpretations and requirements regarding the use of the binding corporate rules transfer mechanism. In doing so, the EDPB missed an opportunity to address BCRs in a systematic, strategic and forward-thinking way, and to enable this important transfer mechanism to evolve into a more scalable, powerful and globally relevant tool for sustainable international data transfers. 

Binding corporates rules are an innovative and comprehensive data transfer mechanism developed, well before the EU General Data Protection Regulation, collaboratively by the European Commission, member state data protection authorities and multinational businesses to enable responsible cross-border data flows within a corporate group.

Organizations applying for BCRs must show their comprehensive internal policies and procedures are legally binding and enforced across all corporate entities within the group and provide adequate protection for personal data shared within the group. The GDPR now explicitly recognizes BCRs and sets out requirements in Article 47.

Several other countries, such as the U.K., Singapore, Brazil, and South Africa, also recognize BCRs as an international data transfer mechanism.

Under the GDPR, Article 47 sets out requirements for BCRs, which amount to a comprehensive privacy program in line with the principles of the GDPR, including governance mechanisms, data protection officers, data subject rights, training and communication, and audits and assessments. BCRs require the approval of the competent DPA through a special regulatory coordination mechanism.

Importantly and de facto, BCRs represent a comprehensive data privacy compliance program and enable organizations to comply with the accountability requirements of Articles 4 and 24 of the GDPR. Many multinational companies implement a single data protection program to:

1. Ensure accountability and local compliance with the GDPR.
2. Leverage that program for BCRs and compliance with international data flow rules.

Organizations that have implemented BCRs, both as controllers and processors, report business benefits as well as internal and external recognition from their "BCR status." BCRs are often seen as the gold standard for privacy and data protection management programs. They also act as a "soft certification," demonstrating an organization’s commitment to and compliance with data privacy rules to business partners and individuals.

In reality, BCRs are complex and expensive to implement.

The regulatory application and approval process is burdensome and excessively long, leaving organizations in legal limbo in the interim. For these reasons, organizations are reluctant to embrace BCRs, opting instead for arguably less effective contracts for their numerous intragroup data flows.

Consequently, BCRs do not yet deliver their full potential.

It is high time to reconsider and evolve BCRs in light of the GDPR and new laws, as well as numerous new developments in international data transfers in Europe and beyond. To effectively and efficiently realize the potential of BCRs, policymakers should:

1. Promote, incentivize and recognize their special nature. The European Commission, the EDPB and other supervisory authorities should proactively promote the wide adoption of BCRs and make it easier, and more attractive, for corporate groups of all sizes to obtain BCR approval. The BCR requirements cannot be more strict than for other transfer mechanisms and must reflect the unique nature of this transfer mechanism. A BCR is not a contract. It is more akin to an enforceable corporate code of conduct, or a third-party certified accountability framework, demonstrating the existence of accountability and a comprehensive data privacy management program within the corporate group and all its entities.
2. Simplify and even transform the approval process. To facilitate their wider use, BCRs must be scalable and configurable for organizations of all sizes and corporate structures. DPAs should lessen the overall administrative burden and timelines of the BCR application process and provide clear, workable criteria. To lighten the burden on DPAs and significantly decrease the length of the approval process, initial evaluations by accredited third parties could be considered, similar to CBPR and GDPR certifications, or organizations should eventually even be able to self-certify to program requirements.
3. Ensure a risk-based approach to risk assessments. BCRs represent a binding commitment to a uniform level of privacy protection across the entirety of a corporate group. Policymakers should therefore ensure the guidance and requirements for transfer risk assessments under BCRs do not have higher standards than other transfer mechanisms, such as standard contractual clauses. Instead, the same risk-based, contextual approach should apply to BCRs. Otherwise, businesses that have invested in a higher level of compliance, i.e., BCRs, are effectively penalized for and disincentivized from doing so going forward.
4. Make BCR interoperable and mutually recognized across jurisdictions. At present, organizations face a duplicative process of going through the same BCR approval procedure in the EU and the U.K. without any difference in the substantive requirements. An informal mutual recognition should be expanded to the U.K., just like the past expansion for Switzerland, for example. Also, the Global Privacy Assembly should work on a mutual recognition project, fully or partly, for BCRs approved in countries outside the EU under similar data protection laws, like Brazil, Singapore, and Australia.
5. Recognize transfers from BCR to BCR approved companies. Today, corporate groups with BCRs are only able to rely on BCR for intragroup data transfers, i.e., to controllers and processors within the corporate group. Given BCRs are reviewed and approved by regulators under the GDPR and represent a comprehensive compliance program that delivers a high level of data protection for all data once it enters a corporate group, companies with BCRs should be able to facilitate transfers to other BCR-approved companies. This level of recognition would dramatically increase the appeal of BCRs. When one BCR-approved organization is permitted to transfer data to and receive data from another BCR-approved organization, both organizations would reap huge benefits from the assurance of the mutual commitment to privacy.

Now is the time for policymakers to recognize the true potential of BCRs. Companies are keen to demonstrate they are trusted data stewards and business partners no matter where they operate. At the same time, more jurisdictions are adopting BCR-like provisions. This presents an urgent opportunity for policymakers to incentivize the further adoption of BCRs, with an eye on accessibility for organizations of all sizes and mutual recognition between BCR-approved organizations within the same jurisdiction and beyond.