February 18, 2019

The note states that in the event of a “no deal” Brexit and the ICO no longer having a role in the BCR community, organisations should consider the following:

• organisations headquartered in the UK wishing to apply for BCRs should identify the most appropriate BCR Lead Supervisory Authority in a EU Member State, according to the criteria set out in the Article 29 Working Party’s “Working Document on the approval procedure of the Binding Corporate Rules for controllers and processors” (WP263);
• organisations for which BCRs are at the review stage by the ICO need to identify a new BCR Lead Supervisory Authority according to the criteria set out in WP263. The new BCR Lead Supervisory Authority will take over the application and formally initiate a new procedure at the time of a “no deal” Brexit;
• if a draft ICO decision for approving BCRs is pending before the EDPB at the time of a “no deal” Brexit, the organisation needs to identify a new BCR Lead Supervisory Authority according to the criteria laid down in WP263. The new BCR Lead will take over and re-submit a draft decision for the approval the BCRs to the EDPB; and
• authorised BCR holders need to identify the new BCR Lead Supervisory Authority, according to the criteria set out in WP 263.

In any of the above scenarios, the Supervisory Authority that may be approached to act as the new BCR Lead Supervisory Authority will consider in cooperation with other concerned Supervisory Authorities whether it is the appropriate BCR Lead on a case-by-case basis and inform the organisation accordingly. For any questions or further information, organisations should contact the ICO. To access the information note, click here.