Privacy & Information Security Law Blog

On March 6, 2014 the Article 29 Working Party (the “Working Party”) published a comprehensive Opinion: Opinion 02/2014 on a referential for requirements for Binding Corporate Rules submitted to national Data Protection Authorities in the EU and Cross-Border Privacy Rules submitted to APEC CBPR Accountability Agents. This blog post provides an overview of the Opinion.

Background

Experts from EU data protection authorities (“DPAs”), along with their counterparts from the Asia-Pacific Economic Cooperation (“APEC”) Data Privacy Sub-Group developed a practical tool (the “Referential”) to reflect the respective requirements of the Binding Corporate Rules (“BCR”) and the Cross-Border Privacy Rules (“CBPR”) systems. The Referential lists the main elements generally required for submission of BCR to EU DPAs on the one hand, and those required to submit CBPRs to APEC CBPR recognized Accountability Agents on the other hand. The Referential was endorsed by APEC Senior Officials at their meeting on February 27-28, 2014, and the Working Party adopted its Opinion during its plenary meeting that took place on February 26-27, 2014.

Practical Checklist and Double Certification

The aim of the Referential is to provide an informal, practical checklist and comparative tool for organizations applying for BCR authorization and/or CBPR certification. It was developed to facilitate the design and adoption of data protection policies that comply with both systems. Although the Referential does not establish mutual recognition of both systems, according to the Working Party, it is intended to facilitate double certification. The Working Party also emphasizes that data protection policies of applicant companies operating in both regions must be approved separately by the relevant institutions in accordance with the applicable approval procedures for each system.

Common Requirements and Additional Elements

For each of the essential principles and requirements of the BCR and CBPR systems, the Referential lists the common elements as well as the additional elements that are specific to each system. The Working Party explicitly states that these additional elements must be taken into account by organizations applying for BCR or CBPR approval, but that the Referential does not affect individual authorization of BCR by EU DPAs or the certification of CBPR by APEC Accountability Agents. Further, the Referential does not affect enforcement by the relevant supervisory and/or enforcement authorities.

No Full Compatibility

The Working Party notes that significant differences exist between the requirements generally imposed by EU DPAs for BCR approval (in particular those deriving from EU data protection laws) and the CBPR program requirements. There also are differences between the respective objectives, scopes and review processes of the BCR and CBPR systems. Accordingly, certain BCR and CBPR requirements are not fully compatible.

Recommendations and Guidelines for Applicant Organizations

The Working Party recommends that applicant organizations provide clarity regarding their scope of data protection and privacy rules in order to avoid conflict with applicable laws. According to the Working Party, organizations must clearly specify in their applications the circumstances under which they intend to apply EU data protection laws and/or APEC CBPR program requirements.

The Working Party also notes that an organization’s data protection and privacy rules should be tailor-made to reflect the structure of the corporate group to which they apply, the data processing undertaken by the corporate group, and the policies and procedures that they have in place to protect personal data – EU DPAs and APEC Accountability Agents will not accept a straight “copy and paste” of the Referential.

In terms of scope of the two systems, the Working Party clarifies that CBPR certification is limited to organizations certified within a CBPR-participating Economy, and the scope of a particular organization’s CBPR certification will be limited to the entities, subsidiaries and affiliates identified in its application for CBPR certification. Similarly, the scope of a particular organization’s BCR will be limited to those entities, subsidiaries and affiliates identified in its application for BCR approval. An organization that wishes to transfer personal data from EU Member States to recipients located in non-EU countries may submit an application to the relevant national DPA in the EU for approval of its BCR.

If properly approved, the data protection and privacy rules applicable to cross border transfers of personal data can serve as the corporate group’s policy for all personal data processed by the corporate group as defined pursuant to its BCR and CBPR. Nevertheless, the Working Party emphasizes that EU data protection law requirements also apply where personal data is processed in the EU and, where personal data is processed in an APEC Economy, the laws of the relevant jurisdiction will apply.