In a letter dated June 12, 2014, Article 29 Working Party (“WP29”) urged Martin Shulz, President of the European Parliament, to include discussions on Binding Corporate Rules for Processors (“BCR-P”) when the trialogue between the European Council, Parliament and Commission on the EU Data Protection Reform will take place.
BCR are a code of conduct
“to be implemented by group of companies acting as processors on behalf and under the instructions of third parties outside of the group acting as controllers, to ensure that transfers of personal data outside the European Union made between the entities of the processor’s group of companies will take place in accordance with the EU rules on data protection.”
BCR-P had been introduced by the European Commission in the draft of the proposed Data Protection Regulation published on 25 January 2012.
In June 2012, the WP29 established a framework to authorize BCR for processors, in addition to BCR for controllers. WP29 officially allows companies to apply for BCR-P since January 2013 (see WP195 and WP204, adopted on April 2013).
However, on March 12, 2014, the European Parliament adopted the LIBE Committee’s report which dropped Article 43.1.a and the BCR-P (Doc P7_TA(2014)0230 ).
One of the critics apparently justifying the dropping of BCR-P is the lack of guarantees to frame the sub-processing activities.
However, WP29 believes that
“BCR-P offer a high level of protection for the international transfers of personal data to processors that qualify to apply for BCR and an optimal solution to promote the European principles of personal data abroad. Hence, denying the possibility for BCR-P will limit the choice of organisations to use model clauses or to apply the Safe Harbor if possible, which do not contain such accountability mechanisms to ensure compliance as it is provided for in BCR-P”.
With its letter, WP29 urges the European institutions to consider the positive outcomes that BCR-P would provide if included in the Data Protection reform under discussion.
The full text of Article 29 Data Protection Working Party Letter to Schulz is available at http://ec.europa…
Related Documents:
- Reform of Data Protection Legislation (Proposal for a European Regulation)
Follow us on& Like us on