Privacy & Information Security Law Blog

On July 13, 2011, the Belgian Privacy Commission (the “Belgian DPA”) signed a Protocol with the Ministry of Justice which significantly simplifies the authorization procedure for binding corporate rules (“BCRs”) under Belgian law.  The Protocol was just made public on the Belgian DPA's website.  The European Context

BCRs are a legal mechanism used by multinational companies for purposes of complying with EU data protection law, to provide an adequate level of data protection when transferring personal data within their corporate groups globally.  BCRs must be reviewed and approved by the relevant EU data protection authorities (“DPAs”) to provide a legal basis for the transfer of personal data.  DPAs generally follow a two-step approval process that involves (1) reviewing the adequacy level at the European level, and (2) approving/authorizing the BCRs under national law.

In recent years, the DPAs have streamlined the review procedure considerably.  In particular, the Article 29 Working Party has developed a cooperation procedure and a mutual recognition mechanism to ease the BCR approval process for companies.  But even if these developments have simplified the process, and even if BCRs are approved using the mutual recognition procedure, the DPAs still may need to issue a formal authorization pursuant to applicable national data protection and administrative rules.  In other words, even after BCRs are deemed adequate, they still must be formally authorized by each national DPA in accordance with applicable national law.  Below we focus on the new BCR authorization procedure under Belgian law.

The New Belgian Authorization Procedure

Although Belgium has been part of the mutual recognition scheme since September 2009, it has been virtually impossible to approve any BCRs in Belgium due to the Belgian Data Protection Act requirements.  Indeed, Article 22, §1, al. 2 of the Belgian Data Protection Act requires a Royal Decree to authorize the transfer of personal data on the basis of BCRs.  This requirement was extremely impractical and burdensome.  As a direct consequence, to date no company has obtained approval for its BCRs in Belgium.

Following lengthy discussions, the Belgian DPA successfully managed to simplify the procedure for approval of BCRs by signing a Protocol on BCRs with the Belgian Ministry of Justice.  The Protocol contains (1) the minimum requirements for approval of BCRs, (2) the new procedure for approval agreed upon by the Belgian DPA and the Ministry of Justice, (3) an explanatory note, and (4) a pre-approved template Royal Decree.  While a Royal Decree still will be required, the Protocol and its attachments will help facilitate the procedure for having BCRs approved under Belgian law.  In practice, the new procedure can be summarized as follows:

• Companies will send their BCRs to the Belgian DPA for approval.
• The Belgian DPA will review the BCRs in accordance with the Protocol to verify that the BCRs are complete.
• Once the Belgian DPA determines that the BCRs are complete, the DPA will inform the company seeking approval and the Belgian Ministry of Justice.
• The Ministry of Justice will automatically issue a formal request for Opinion to the Belgian DPA.
• The Belgian DPA will have 60 days to formally review the BCRs and send its Opinion to the Ministry of Justice (including a copy of the BCRs, its analysis and a draft Royal Decree prepared in accordance with the template Royal Decree attached to the Protocol).
• If the DPA’s Opinion is favorable, the Ministry of Justice will verify that the process specified in the Protocol has been followed and, if so, automatically approve the BCRs by signing the Royal Decree and publishing it in the Official Gazette.

With this new procedure, the BCR approval burden will shift from the Ministry of Justice to the Belgian DPA, actually giving more power to the Belgian DPA.  This new procedure also is likely to result in a significant increase in the number of BCRs approved in Belgium in the near future.  Specifically, it will allow companies whose BCRs already have been approved as adequate to obtain legal authorization to transfer personal data outside of Belgium in accordance with Belgian data protection law.  It also will increase the Belgian DPA’s visibility with respect to BCRs (a topic about which the Belgian DPA has been very active in the past few years), and allow the Belgian DPA to become a lead authority where appropriate.