EU Binding Corporate Rules For Transferring Data: A Comparison of US Law, EU Law, and Soon-To-Be EU Law

David A. Zetoony

Bryan Cave LLP

In the United States companies are permitted to transfer personal information – including sensitive personal information – as needed between their offices, locations, and corporate affiliates. For example there are no restrictions that prevent a company from sending personal information collected within the US to a company data center located outside of the US.

In the European Union, the EU Data Protection Directive 95/46/EC (the “Directive”) creates a legal framework for the national data protection laws in each EU member state. The Directive states that personal data may only be transferred to countries outside the EU when an adequate level of protection is guaranteed. 

Few exemptions apply, and the laws of the United States are not considered by the European Union as providing an adequate level of data protection. As a result, if a company intended to transfer personal information from the EU into the United States they had to take an additional step to verify that the data would be treated with an “adequate” level of protection when it arrived in the US. 

After the Safe Harbor was invalidated, there are functionally only two verification steps that would satisfy the adequacy requirement: (1) have the receiving and transmitting entities enter into a template contract that was pre-approved by the EU Commission, or (2) have a multinational company that was sending data to an affiliated entity in another country enter into Binding Corporate Rules (“BCR”).

Although BCRs are not expressly codified in the EU Directive, they were developed by the Working Party – a multinational advisory board that interpreted the EU Directive – and interpreted by the Working Party as conferring an adequate level of protection.¹ BCRs are in-kind privacy rules and standards that allow multinational groups of companies to transfer personal data within their group of companies, including to corporate affiliates outside of the EU. In order to obtain approval at a BCR, a company's privacy policy has to demonstrate that it ensures an adequate level of data protection and respective safeguards under EU law. BCR are an internal tool only and do not allow for any data transfers outside of a corporate group.

The law in the European Union is changing, with a new General Data Protection Regulation (“GDPR”) going into effect in 2018. Not only does the GDPR recognize the validity of BCRs that were approved under the EU Directive,² it codifies the availability of the BCR solution and codifies the minimum requirements which organizations must meet in order to obtain approval for a BCR.³

When drafting BCRs a company must include, among other things, the following provisions:

1. Organizational Structure. A description of the structure and contact information of each member of the multinational company.⁴
2. Data Transfers Envisioned. A description fo the categories of personal data, the type of processing, the purpose of the processing and the impacted data subjects that are envisioned. You must also include a list of the third countries to which information will be transferred.⁵
3. Legally Binding. An affirmation that the rules are intended to be legally binding upon the organization.⁶
4. Application of Privacy Principles. An explanation of how the organization intends to apply basic privacy principles such as data minimization, limited data retention, security by design, etc.⁷
5. Rights of Data Subjects. An explanation of what rights the organization will provide data subjects, and how data subjects can exercise those rights.⁸
6. Acknowledgment of Potential Liability. The portion of the multinational organization that is based in the EU must acknowledge that it will be liable for a breach of the BCRs committed by any member of the organization that is not based in the EU.⁹
7. Monitoring Compliance. How compliance with the BCRs will be monitored internally.¹⁰
8. Communicating with Data Subjects. How the organization wil communicate information about the BCRs to data subjects and how data subjects may submit complaints about privacy or security practices.
9. Data Protection Training. How employees will be trained with regard to their obligations under the BCR.¹²
10. Cooperation with Regulators. A commitment that all intercompany members will cooperate with regulators to confirm that the BCRs are complied with, including a willingness to make available to regulators the results of data protection audits performed within the corporate group.¹³

---

1. Article 29 Data Protection Working Party, Working Paper 74, Working Document: Transfers of personal data to third countries: Appplying Article 26(2) of the EU Data Protection Directive to Binding Corporate Rules for International Data Transfers (June 3, 2003).

2. GDPR Art. 89b.

3. GDPR Art. 43.

4. GDPR Art. 43(2)(a).

5. GDPR Art. 43(2)(b).

6. GDPR Art. 43(2)(c).

7. GDPR Art. 43(2)(d).

8. GDPR Art. 43(2)(e).

9. GDPR Art. 43(2)(f).

10. GDPR Art. 43(2)(h), (i).

11. GDPR Art. 43(2)(g), (hh).

12. GDPR Art. 43(2)(m).

13. GDPR Art. 43(2)(k).