August 3, 2020

On 22 July, during its 35^th Plenary session, the EDPB adopted an “Information note on Binding Corporate Rules for Groups of undertakings/enterprises which have ICO as Lead Authority” setting out the actions that need to be taken to ensure that BCRs can continue to be used after the end of the transition period. The EDPB says that the document is without prejudice to the analysis currently being undertaken by the EDPB on the consequences of the judgment in Case C-311/18 Data Protection Commissioner v Facebook Ireland Ltd (Schrems II) for BCRs as transfer tools.

The note states that BCR holders that have the ICO as the Lead Supervisory Authority (LSA) need to put in place all organisational arrangements on the basis of which a new BCR Lead in the EEA may be identified in accordance with Article 29 Working Party Working Document WP263. The change of LSA will take effect at the latest at the end of the Brexit transition period. For BCRs already approved under the GDPR, the new LSA in the EEA will have to issue a new approval decision following an opinion from the EDPB before the end of the transition period.

In terms of BCRs for which the ICO acted as the LSA under the Data Protection Directive (95/46/EC), no approval will have to be issued by the new LSA in the EEA.

BCR holders also need to amend their BCRs with reference to the EEA legal order before the end of the Brexit transition period. The document provides a checklist of elements to be amended. If the changes are not made or a new approval obtained before the end of the transition period, undertakings will not be able to rely on their BCRs as a valid transfer mechanism for transfers of data outside the EEA after the end of the transition period.

As for BCR applications currently with the ICO for review, undertakings are encouraged to put in place all organisational arrangements to identify a new LSA in the EEA before the end of the Brexit transition period. The new LSA will take over the application and formally initiate an approval procedure subject to an opinion of the EDPB.

During the transition period, undertakings might decide to transfer their BCR application to a new LSA after approval by the ICO. In that case, the new LSA will have to issue, before the end of the transition period, a new approval decision following an opinion from the EDPB.

Undertakings with pending BCR applications must also, before the end of the transition period, ensure that their BCRs refer to the EEA legal order with information about related changes to become effective (at the latest) at the end of the transition period. The document contains a checklist of elements to be included.

The document states that in both scenarios above, the SA in the EEA that is asked to act as the new LSA will consider, on the basis of criteria set out in WP263 and in cooperation with other concerned SAs, whether it is the appropriate LSA on a case-by-case basis and inform the undertaking accordingly. To read the Information Note in full, click here.