XpertDPO has provided feedback to the European Data Protection Board (EDPB) on Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR).
Status update: The EDPB adopted the final Recommendations 01/2022 after the consultation. Readers should use the EDPB consultation and final recommendations page for the current text; this article records XpertDPO’s contribution during the consultation process.
The EDPB recommendations build upon the agreements reached by data protection authorities during approval procedures on concrete BCR applications since the GDPR came into force. They also bring the existing guidance in line with the requirements in the Court of Justice of the European Union’s Schrems II ruling, providing clarity for controllers relying on Binding Corporate Rules for international data transfers.
XpertDPO welcomes the EDPB’s recommendations and its efforts to ensure a level playing field for all BCR applicants. While the recommendations provide a standard form for the application for approval of BCR for controllers (BCR-C) and clarify the necessary content of a BCR-C, there is still scope for more standardisation to simplify the process for companies considering BCRs as an appropriate safeguard for transfers of personal data to third countries.
XpertDPO submitted a detailed response to the public consultation. The former EDPB-hosted submission file is no longer available at its published URL, and XpertDPO retains its submission record. For support with the BCR approval process, contact XpertDPO at info@xpertdpo.com or on +353 1 678 8997.