Mervinskiy 501

TheEuropeanDataProtectionBoard

HavingregardtoArticle70(1)(i)oftheRegulation2016/679/EUoftheEuropeanParliamentandoftheCouncilof27April2016ontheprotectionofnatural personswithregardtotheprocessingofpersonaldataandonthefreemovementofsuchdata,andrepealingDirective95/46/EC,(hereinafterGDPR),

HavingregardtotheEEAAgreementandinparticulartoAnnexXIandProtocol37thereof,asamendedbytheDecisionoftheEEAjointCommitteeNo 154/2018of6July20181 ,

HavingregardtoArticles12and22ofitsRulesofProcedure, HASADOPTEDTHEFOLLOWINGRECOMMENDATIONS:

INTRODUCTION

1. TheGDPRexpresslyprovidesfortheuseofbindingcorporaterules(hereinafterBCR)byagroupofundertakings,oragroupofenterprisesengagedina jointeconomicactivity(hereinafterGroup)fortransfersofpersonaldatainthesenseofArticle44GDPR.

2. On6February2018,theArticle29WorkingParty(hereinafterWP29)adoptedatablewiththeelementsandprinciplestobefoundinBCRinordertoreflect therequirementsreferringtoBCR(hereinafterWP256rev.01).TheEuropeanDataProtectionBoard(hereinafterEDPB)endorsedWP256rev.01on25 May2018.TheseRecommendationsalsorepealandreplaceWP256rev.01,whileinsubstancebuildingonit.

3. On11April2018,theArticle29WorkingParty(thereinafterWP29)adoptedRecommendationsontheStandardApplicationforApprovalofController BindingCorporateRulesfortheTransferofPersonalData(hereinafter:WP264).TheEuropeanDataProtectionBoard(hereinafterEDPB)endorsedWP256 rev.01on25May2018.TheseRecommendationsrepealandreplaceWP264,whileinsubstancebuildingonit.

4. Theserecommendationsaremeantto:

ProvideastandardformfortheapplicationforapprovalofBCRforcontrollers(hereinafterBCR-C);

1ReferencestoMemberStatesmadethroughoutthisdocumentshouldbeunderstoodasreferencestoEEAMemberStates.

Adoptedversionforpublicconsultation

ClarifythenecessarycontentofBCRCasstatedinArticle47GDPR;

MakeadistinctionbetweenwhatmustbeincludedinBCRCandwhatmustbepresentedtotheBCRLeadsupervisoryauthority(hereinafterBCR Lead)2intheBCRapplication;and

Provideexplanationsandcommentsontherequirements.

5. BCRCaresuitableforframingtransfersofpersonaldatafromcontrollerscoveredbythegeographicalscopeoftheGDPRpursuanttoArticle3GDPR3toother controllersortoprocessors(establishedoutsidetheEEA)withinthesameGroup,whereasBCRforprocessors(hereinafterBCRP)applytodatareceived fromacontrollerthatisnotamemberoftheGroup,andwhicharethenprocessedbytheconcernedGroupmembersasprocessorsand/orsub-processors.

Hence,theobligationssetoutinBCRCapplyinrelationtoentitieswithinthesameGroupactingascontrollersandtoentitiesactingasinternalprocessors. Asforthisverylastcase,itisworthrecallingthat,inadditiontotheBCRC,acontractorotherlegalactunderUnionorMemberStatelaw,bindingonthe processorwithregardtothecontrollerandwhichcomprisesallrequirementsassetoutinArticle28(3)GDPR,mustbesignedbyeachcontrolleractingas dataexporterwithallinternalprocessors4.Indeed,theobligationssetforthinBCRCapplytoentitiesoftheGroupreceivingpersonaldataas(internal) processorstotheextentthatthisdoesnotleadtoacontradictionwiththecontractorotherlegalactenteredintounderArticle28(3)GDPR(i.e.,theprocessors membersoftheGroupprocessingonbehalfofcontrollersmembersoftheGroupshouldprimarilyabidebythiscontract).

6. EUdataprotectionlegislationapplicabletomembersoftheGroupmustbecompliedwithandcannotbeoverruledbyprovisionsintheBCRC,unlesstheBCR Cvoluntarilyprovideforahigherlevelofprotection.

7. PursuanttoArticle46(2)(b)GDPR,BCRareappropriatesafeguardsfortransfersofpersonaldatatothirdcountries.BCRcreateenforceablerightsandsetout commitmentsinordertocreate,forthepersonaldatatransferredundertheBCR,alevelofprotectionessentiallyequivalenttotheoneprovidedbytheGDPR. Therefore,itisnotsufficientfortheBCRCtoonlymakereferencetoprovisionsoftheGDPR,andBCRCapplicantsshouldratherexpresslyformulatethe requirementswithintheirBCRC.

2SeeWP29WorkingDocumentsettingforthacooperationprocedurefortheapprovalofBindingCorporateRulesforcontrollersandprocessorsundertheGDPR,WP263 rev.01,adoptedon11April2018,endorsedbytheEDPB.Availableathttps://edpb.europa.eu/ourworktools/generalguidance/endorsedwp29guidelines_en.

3PleasenotethatatleastonegroupmemberintheEEAisrequired(seeChapter3,Section1.4oftheseRecommendations).

4Article28(3)GDPRrequires,amongothers,foreachcontrollertoprocessorrelationshipaspecification,bywayofcontractorotherlegalact,ofthesubjectmatter,the duration,thenatureandpurposesoftheprocessing,thetypeofpersonaldataandcategoriesofdatasubjectsandtheobligationsandrightsofthecontroller.Ageneric descriptionincludedinaBCRCregardingthecategoriesofdata,datasubjectsetc.wouldnotbesufficientinthisregard.

8. BCRaresubjecttoapproval5bytheBCRLead.Inthisrespect,itisworthhighlightingthedifferencebetweentheBCRLeadwhichiscompetentforissuing theapprovaloftheBCRandtheSAthatiscompetentforaspecifictransfercarriedoutbyacertaincontrollerunderthatBCRC6 .

9. ThedraftapprovaldecisionoftheBCRLeadissubjecttoanopinionbytheEDPB7.TheapprovalconfirmsthattherequirementssetoutinArticle47GDPRare met,andtherefore,thatthecommitmentsincludedintheBCRwillprovideforappropriatesafeguardsinthesenseofArticle46GDPR.

10.However,theapprovaldoesnotincludeanassessmentofwhethereachprocessingisinlinewithallrequirementsoftheGDPRandtheBCR.Forinstance, eachdataexporterneedstoensurethattherequirementssetoutinArticle6GDPR(Lawfulnessofprocessing)andArticle28GDPR(fortransferstoprocessors) oranyadditionalformalitiesspecifiedbythenationallawofaMemberState,ifany,aremetforeachtransfer.Furthermore,itis,forinstance,theresponsibility ofeachdataexportertoassess,foreachtransfer,onacase-by-casebasis,whetherthereisaneedtoimplementsupplementarymeasuresinordertoprovide foralevelofprotectionessentiallyequivalenttotheoneprovidedbytheGDPR8.Suchsupplementarymeasuresareintheresponsibilityofthedataexporter, andassuch,arenotassessedbysupervisoryauthorities(hereinafterSAs)aspartoftheprocessofapprovalofBCR.

11.TheBCRapprovalonlycoverstransfersofpersonaldatatothirdcountries.However,GroupsmaydesignBCRtobeusedastheirglobaldataprotectionpolicy. However,thescopeoftheapprovaloftheBCRbytheBCRLeadisalwayslimitedtotransfersofpersonaldatafromentitiesunderthescopeofapplicationof theGDPR9tothirdcountriesandtheironwardtransferstootherGroupmembersthatareboundbytheBCR(hereinafterBCRmember(s))outsidetheEEA.

12.Onceapproved,BCRcanbeusedfortransfersfromallrelevantMemberStates,andtheSAcompetentforthedataexporterwillalsobecompetenttoassess therespectoftheBCRbythedataimporterinthethirdcountryinrelationtotherelevanttransfers.

13.TheEDPBexpectsallBCRCholderstobringtheirBCRCinlinewiththerequirementssetoutbelow.ThisincludesBCRCthathavebeenapprovedbeforethe publicationoftheseRecommendations.SuchchangeswillhavetobedoneincompliancewiththecommitmentstakenintheirBCRCinaccordancewith Section5.1below.

5InaccordancewithArticle47(1)GDPR.

6ThroughouttheseRecommendations,thetermCompetentSA(s)referstothedataprotectionSA(s)competentforthedataexporter(s)ofthespecifictransfer.

7InaccordancewithArticle46(4),Article64(1)(f)andArticle64(3)GDPR.

8SeeChapter3oftheseRecommendations,Section5.4.1,andEDPBRecommendations01/2020onmeasuresthatsupplementtransfertoolstoensurecompliancewiththe EUlevelofprotectionofpersonaldata,availableathttps://edpb.europa.eu/ourworktools/ourdocuments/recommendations/recommendations012020measures supplementtransfer_en.

9 PleasenotethatatleastonegroupmemberintheEEAisrequired(seeChapter3,Section1.4oftheseRecommendations).

APPLICATIONFORM

GeneralInstructionsforApplicants:

OnlyasinglecopyoftheformneedbefilledoutandsubmittedtotheSupervisoryAuthority(SA)youconsidertobetheBCRLeadinaccordancewith Articles47(1)and64GDPRandtheWP263;thisformmaybeusedinallEEAMemberStates. 



IncaseofapplicationforbothBCR-CandBCR-P,separateformsneedtobefilledoutforeachBCR. 

PleasefilloutallentriesofPartIoftheapplicationformandsubmittheformtotheSAyouconsidertobetheBCRCLead.Assoonasadecisiononthe BCRLeadhasbeenmade(seeWP263),theBCRLeadwilldeterminewhenitwillinviteyoutofilloutandsubmitPartIIoftheapplicationformincluding itsAnnexes. 

Youmayattachadditionalpagesorannexesifthereisinsufficientspacetocompleteyourresponses. 

Youmayindicateanyresponsesormaterialsthatisinyouropinioncommerciallysensitiveandshouldbekeptconfidentialbut,inanycase,beaware thattherelevantdocumentwillbesharedamongtheconcernedSAsandtheEDPBwhich,underArticle64GDPR,hastoissueitsopinionontheapproval draftdecisionofyourBCRC.Requestsbythirdpartiesfordisclosureofsuchinformation,will,however,behandledbyeachSAinvolvedinaccordance withnationallegislation. 

IftheGrouphasitsheadquartersintheEEAtheformshouldbefilledoutandsubmittedbythatEEAentity.

IftheGrouphasitsheadquartersoutsidetheEEA,thentheGroupshouldappointaGroupentitylocatedinsidetheEEA-astheGroupmemberwith delegateddataprotectionresponsibilities.ThisistheentitywhichshouldthensubmittheapplicationonbehalfoftheGroup.

Section2:Shortdescriptionofdataflows



Theapplicantshouldalsogiveabriefdescriptionofthescopeandnatureofthedataflowstothirdcountriesforwhichapprovalissought.

Section3:DeterminationoftheBCRLead



InaccordancewithArticle64GDPR,theBCRLeadistheauthorityinchargeofcoordinatingtheapprovalofyourBCRC,whichthencouldbeconsidered appropriatesafeguardsfortransfersofpersonaldatabyGroupmemberstothirdcountries,withoutrequiringanyspecificauthorisationfortheuse oftheBCRCfromtheotherSAsconcerned.

o BeforeyouapproachoneSAasthepresumptiveBCRLead,youshouldexaminethefactorslistedinSection1ofWP263.Basedonthesefactors youshouldexplaininPart1.3oftheApplicationFormwhichSAshouldbetheBCRLead.TheSAsarenotobligatedtoacceptthechoicethat youmakeiftheybelievethatanotherSAismoresuitabletobeBCRLead,inparticularifitwouldbeworthforspeedinguptheprocedure(e.g. takingintoaccounttheworkloadoftheoriginallyrequestedSA).

PART1:APPLICANTINFORMATION

NameoftheGroupandlocationofitsheadquarters: DoestheGrouphaveitsheadquartersintheEEA? Yes No

Nameandlocationoftheapplicant:

Identificationnumber(ifany): Legalnatureoftheapplicant(corporation,partnership,etc.):

DescriptionofpositionoftheapplicantwithintheGroup: (e.g.headquartersoftheGroupintheEEA,or,iftheGroupdoesnothaveitsheadquartersintheEEA,thememberoftheGroupinsidetheEEAwithdelegateddata protectionresponsibilities)

Nameand/orfunctionofcontactperson(note:thecontactpersonmaychange,youmayindicateafunctionratherthanthenameofaspecificperson):

Address: Country: Phonenumber: E-Mail:

EEAMemberStatesfromwhichtheBCRCwillbeused:

2.SHORTDESCRIPTIONOFPROCESSINGANDDATAFLOWS10

Please,indicatethefollowing: NatureofthedatacoveredbytheBCRC,andinparticular,iftheyapplytoonecategoryofdataortomorethanonecategory,thetypeofprocessingandits purposes,thetypesofdatasubjectsaffected(forinstance,datarelatedtoemployees,customers,suppliersandotherthirdpartiesaspartoftheirrespectiveregular businessactivities,…)

- DotheBCR-ConlyapplytotransfersfromtheEEA,ordotheyapplytoalltransfersbetweenmembersofthegroup? PleasespecifyfromwhichcountrymostofthedataaretransferredoutsidetheEEA: ExtentofthetransferswithintheGroupthatarecoveredbytheBCRC;includingadescriptionandthecontactdetailsofanyGroupmembersintheEEAoroutside theEEAtowhichpersonaldatamaybetransferred

3.DETERMINATIONOFTHELEADSUPERVISORYAUTHORITY(‘BCRLEAD’)

PleaseexplainwhichshouldbetheBCRLead,basedonthefollowingcriteria:

- LocationoftheGroup’sEEAHeadquarters

IftheGroupisnotheadquarteredintheEEA,thelocationintheEEAoftheGroupentitywithdelegateddataprotectionresponsibilities

10SeeArticle47(2)(a)and(b)GDPR. 11SeePart1,WP263.

Thelocationofthecompanywhichisbestplaced(intermsofmanagementfunction,administrativeburden,etc.)todealwiththeapplicationandtoenforcetheBCR CintheGroup

- Thecountrywheremostofthedecisionsintermsofthepurposesandthemeansofthedataprocessingaretaken

EEAMemberStatesfromwhichmostofthetransfersoutsidetheEEAwilltakeplace

4.ACKNOWLEDGEMENT

theapprovaldoesnotincludeanassessmentofwhethereachprocessingisinlinewithallrequirementsoftheGDPRandtheBCRasapplicable,andthateachBCRmember needstoensurethatallrequirementssetoutinGDPRandBCR,asapplicable,aremetforeachtransfer(e.g.,inrelationtolawfulness,Article28requirements,DPIAwhere needed,etc.)

beforecarryingoutanytransferofpersonaldataonthebasisoftheapprovedBCRCtooneofthemembersoftheGroup,itistheresponsibilityofanydataexporter,if neededwiththehelpofthedataimporter,toassesswhetherthelegislationofthethirdcountryofdestinationdoesnotpreventtherecipientfromcomplyingwiththeBCR-C, includingwithregardtoonwardtransfersituations.Thisassessmenthastobeconductedinordertodeterminewhetheranylegislationorpracticesofthethirdcountry, applicabletothetobetransferreddatagobeyondwhatisnecessaryinademocraticsocietytosafeguardimportantpublicinterestobjectives,inparticularcriminallaw enforcementandnationalsecurityandmayimpingeonthedataimporter’sand/orthedataexporter’sabilitytocomplywiththeircommitmentstakenintheBCRC,taking intoaccountthecircumstancessurroundingthetransfer.Incaseofsuchpossibleimpingement,thedataexporterinanEEAMemberState,ifneededwiththehelpofthedata importer,shouldassesswhetheritcanprovidesupplementarymeasuresinordertoexcludesuchimpingementandthereforetoneverthelessensure,fortheenvisagedtransfer athand,anessentiallyequivalentlevelofprotectionasprovidedintheEU.Deployingsuchsupplementarymeasuresistheresponsibilityofthedataexporterandremainsits responsibilityevenafterapprovaloftheBCR-C,andassuch,theyarenotassessedbytheSupervisoryAuthoritiesaspartoftheapprovalprocessoftheBCR-C;

inanycase,wherethedataexporterisnotabletoimplementsupplementarymeasuresnecessarytoensureanessentiallyequivalentlevelofprotectionasprovidedintheEU, personaldatacannotbelawfullytransferredtoathirdcountryundertheBCRC.Inthesamevein,wherethedataexporterismadeawareofanychangesintherelevantthird countrylegislationthatunderminethelevelofdataprotectionrequiredbyEUlaw,thedataexporterisrequiredtosuspendorendthetransferofpersonaldataatstaketothe concernedthirdcountries.

WeacknowledgeonbehalfofeachmemberoftheGroupthat

Date,Signatureoftheapplicant(Boardlevel) PART2:BACKGROUNDPAPER 5.BINDINGNATUREOFTHEBCR-C

BindingwithintheentitiesoftheGroup

HowaretheBCRCmadebindinguponthemembersoftheGroup?

IntraGroupAgreement

UnilateralDeclaration(hereinafter:UD)iftherequirementssetoutinSection1.2ofthe“Elementsandprinciples”part(=Chapter3)oftheseEDPBRecommendations aremet

Othermeans(onlyiftheGroupdemonstrateshowthebindingcharacteroftheBCRCisachieved),pleasespecify

PleaseattachthedraftIntraGroupAgreement/UD/“othermeans”.PleasenotethatthesedocumentswillhavetobesignedatBoardlevelaftertheBCRCapprovalhasbeen obtained.

Pleaseexplainthelegalbasisenablingthemember(s)oftheGroupwithdelegateddataprotectionresponsibilitytoenforcetheBCR-Cobligationsofothermembersofthe Group(e.g.rightsofaparentcompanyresidingincorporatelaw):

DoestheinternallybindingeffectofyourBCRCextendtothewholeGroup?(IfsomeGroupmembersshouldbeexempted,specifyhowandwhy)

Bindingupontheemployees

YourGroupmaytakesomeorallofthefollowingstepstoensurethattheBCR-Carebindingonemployees,buttheremaybeothersteps.Please,givedetailsbelow.

Individualandseparateagreement(s)/undertakingwithsanctions;

Clauseinemploymentcontractwithadescriptionofapplicablesanctions;

Collectiveagreementswithsanctions;

Internalpolicieswithsanctions(buttheGroupmustproperlyexplainhowtheBCRCaremadebindingonemployees);

Othermeans(buttheGroupmustproperlyexplainhowtheBCR-Caremadebindingonemployees)

Pleaseprovideasummary,supportedbyextractsasappropriate,toexplainhowtheBCRCarebindinguponemployees.

Assets

PleaseconfirmthattheliableBCR-Cmember(s)establishedontheterritoryofanEEAMemberState(e.g.theEuropeanheadquartersoftheGroup,orthememberofthe GroupwithdelegateddataprotectionresponsibilitiesintheEEA)hasmadeappropriatearrangementstoenableitselfpaymentofcompensationforanydamagesresultingfrom thebreachoftheBCRCbyBCRmembersoutsidetheEEA,andexplainhowthisisensured.

6.EFFECTIVENESS

PleaseexplainhowyournetworkofDPOsorprivacyofficersfunctions:

Internalstructure: Roleandresponsibilities: Date,Signatureoftheapplicant(Boardlevel) (pleasealsoindicatename,position,andcontactdetails)

ANNEX1: COPYOFTHEBCR-C

PleaseattachacopyofyourBCRCtoyourapplication.PleasenotethatallmandatorycontentneedstobeincludedintheBCRdocuments(inthecoredocument(s)orits annexes),while“supportingdocuments”(i.e.documentsthatarenotpartoftheBCR)mayonlybesubmittedforreasonsoffurtherexplanation12 .

ANNEX2:

Pleasefilloutthetable“ElementsandPrinciplestobefoundinBCRC”andattachittoyourapplication.

12Pleasenotethatanydocumentsthataresubmittedmaybesubjecttoaccessrequestsbasedonfreedomofinformationlegislation,asapplicable.

CriteriaforBCR-Capproval In BCR-C In application form Reference Comments

1BINDINGNATURE

Internally

1.1DutytorespecttheBCRC YES NO Article47(1)(a) and (2)(c) GDPR14

1.2Explanationofhowthe BCRCareinternally15 made bindingontheBCRmembers, andontheiremployees

NO YES

Article47(1)(a) and(2)(c)GDPR

TheBCRCmustbelegallybindingandshould containacleardutyforeachBCRmember,including theiremployees,torespecttheBCRC.

TheGroupwillhavetoexplaininitsapplicationform howtheBCRCaremadebinding:

i.ForeachBCRmember,byoneormoreofthe following: a)Intra-groupagreement;

b)UnilateralDeclaration(hereinafterUD),if thefollowingrequirementsaremet:

13Tobecompletedbytheapplicantbyinsertingreferencestotheparagraphs/sections/partsoftheBCRdocumentsand,ifnecessary,anysupportingdocuments,thataddress therespectiverequirement.PleasenotethatallmandatorycontentneedstobeincludedintheBCRdocuments(inthecoredocument(s)oritsannexes),whilesupporting documents(i.e.documentsthatarenotpartoftheBCR)mayonlybesubmittedforreasonsoffurtherexplanation.Furthermore,itisnotnecessarytocopy&pastetext fromtheBCRdocuments,butitsufficesmentioningtherelevantsectionsofthedocumentsassuch.Examples:Section4.1oftheBCRdocumentandparagraph2.1ofAnnex I(intragroupagreement);Part2,Section4oftheApplication,Section2.1oftheBCRdocumentandparagraph3ofAnnex2(Auditconcept).

14ReferencesinthispapertoGDPRprovisionsdonotimplythatGDPRappliesdirectlytotheBCRmembersactingasdataimporters,butshouldratherbeunderstoodasthe thresholdforcommitmentsthatneedtobemadeinaBCR.IftheBCRmakereferencetoGDPRprovisions,possiblewordingtoindicatethismighte.g.beinlinewithArticle XoftheGDPR, asthoseprovidedforbyArticleXoftheGDPR.

15Pleasenotethanbesidehavinginternalbindingnature(i.e.bindingeffectontheBCRmembersandtheiremployees)theBCRCmustalsohaveanexternalbindingeffect inthesenseofprovidinglegalenforceability(ofcertainpartsoftheBCRC)forthedatasubjectsbycreatingthirdpartybeneficiaryrights.SeeSection1.3belowasregards thisexternalbindingeffect.

Theentity/entitiestakingresponsibility andliability(seeSection1.4below) is/arelocatedinaMemberState recognisingUDsasbinding;

Theentity/entitiestakingresponsibility andliability(seeSection1.4below) is/arelegallyabletobindtheotherBCR members,andthisisexpresslyprovided for,e.g.inaseparatewritten commitmentfromthatentity;

TheBCRCstatetheprinciplethatallthe entitiesidentifiedintheUDareboundby theBCRC;

ThelawapplicabletotheUDisthelawof thecountryoftheentity/entitiestaking responsibilityandliability(seeSection 1.4below).Theapplicablelawis expresslystatedintheUD;and ItistheGroupsresponsibilitytoverify thatanyadditionalrequirementsofthe applicablelawforbindingnessaremet (suchaspublicationoftheUD,).

c)Othermeans(onlyiftheGroup demonstrateshowthebindingcharacterof theBCRCisachieved).TheBCRLeadcan requirecorrespondingdocumentationthat demonstratesthebindingcharacter.16

16Themoststraightforwardinstrumentinthisregardisacontractualarrangement(i.e.,anintragroupagreement),sincecontractualarrangementscanbelegallyenforced bythirdpartiesasbeneficiariesunderprivatelawinallMemberStates

ii.Onemployeesbyoneormoreof:

a)Individualandseparateagreement(s)/ undertakingwithsanctions; b)Clauseinemploymentcontractwitha descriptionofapplicablesanctions; c)Collectiveagreementswithsanctions; d)Internalpolicieswithsanctions;or e)Othermeans.

Regardingd)ande)above,theGroupshould properlydemonstratehowthosemeansmakethe BCRCbindingontheemployees.

TheBCRLeadcanrequestcorresponding documentationthatdemonstratesthebinding character.

Externally 1.3.1Creationofthirdparty beneficiaryrightsthatare enforceablebydatasubjects

YES NO Article47(1)(b), (2)(c)and(e) GDPR

TheBCRCmustexpresslyconferrightstodata subjectstoenforcetheBCRCasthirdparty beneficiaries,atleastasregardsthefollowing elementsoftheBCRC:

Dataprotectionprinciples,lawfulnessof processing,securityandpersonaldatabreach notifications,restrictionsononwardtransfers (seeArticle47(2)(d)GDPR,andSections5.1.1, 5.1.2,5.1.3secondparagraph3rdindent[duty tonotifywithoutunduedelaytodatasubjects wherethepersonaldatabreachislikelytoresult

inahighrisktotheirrightsandfreedoms],and 5.1.4below);

TransparencyandeasyaccesstotheBCRC(see Article47(2)(g)GDPR,andSections1.7and5.1.1 below);

- Rightsofinformation,access,rectification, erasure,restriction,notificationregarding rectificationorerasureorrestriction,objection toprocessing,rightnottobesubjectto decisionsbasedsolelyonautomated processing,includingprofiling (seeArticle 47(2)(e),Articles15to19,21and22GDPR,and Section5.2below);

- Obligationsincaseoflocallawsandpractices affectingcompliancewiththeBCR-Candincase ofgovernmentaccessrequests (seeArticle 47(2)(m)GDPR,andSection5.4.1and5.4.2 below);

RighttocomplainthroughtheGroupsinternal complaintprocess(seeArticle47(1)(i)GDPR, andSection3.2below);

- CooperationdutieswithCompetentSAs(see Article47(2)(j),(k),and(l)GDPR,andSection4.1 below)relatingtocomplianceobligations coveredbythisthirdpartybeneficiaryclause;

- Jurisdictionandliabilityprovisions(seeArticle 47(2)(e)and(f)GDPR,andSections1.3.2and1.4 below);

1.3.2Righttojudicialremedies, redressandcompensationfor datasubjects

YES NO Article47(2)(e) andArticles77to 82GDPR

- Dutytoinformthedatasubjectsaboutany updateoftheBCR-CandofthelistofBCR members(seeSection8.1below);

Third-partybeneficiaryclauseitself(seepresent Section1.3.1);

- Righttojudicialremedies,redressand compensation(seeSection1.3.2below)

Theserightsdonotextendtothoseelementsofthe BCRCpertainingtointernalmechanisms implementedwithinentities,suchasdetailsof training,auditprogramme,compliancenetwork, andmechanismforupdatingtheBCR-C.

TheGroupneedstomakesurethatthird-party beneficiaryrightsareeffectivelycreatedtomake thosecommitmentsbinding(seeSection1.2below).

TheBCRCshallexpresslyconferondatasubjectsthe righttojudicialremediesandtherighttoobtain redressand,whereappropriate,compensationin caseofanybreachofoneoftheenforceable elementsoftheBCR-CasenumeratedinSection 1.3.1above.TheBCRmembersacceptthatdata subjectsmayberepresentedbyanot-for-profit body,organisationorassociationunderthe conditionssetoutinArticle80(1)GDPR(seeArticles 7782GDPR).

TheBCRmembersshouldmakesurethatallthose rightsarecoveredbythethirdpartybeneficiary clauseoftheBCR-C,forexample,bymaking referencetotheclauses,sections,and/orpartsof

1.4OneormoreBCR member(s)intheEEAwith delegateddataprotection responsibilityacceptliability forpayingcompensationto datasubjectsandremedying breachesoftheBCR-C (hereinafter LiableBCR Member(s))

YES NO Article47(2)(f) GDPR

theBCRCwherethoserightsareregulated,orby listingtheminthesaidthirdpartybeneficiary clause.

TheBCR-Cmustconferondatasubjectstherightto lodgeacomplaint(byincludingadirectreferenceto suchrightintherelevantBCR-Cdocumentsthatare bindingandpublished):

- withaSA,inparticularintheMemberStateof thedatasubjectshabitualresidence,placeof workorplaceoftheallegedinfringement;and

- beforethecompetentcourtoftheMember Stateswherethecontrollerorprocessorhasan establishment,orwherethedatasubjecthas theirhabitualresidence.

TheBCRCmustcontainadutythat,atanygiven time,oneBCRmemberintheEEAaccepts responsibilityforandagreestotakethenecessary actionstoremedytheactsofotherBCRmembers outsideoftheEEA,andtopaycompensationforany materialornonmaterialdamagesresultingfromthe violationoftheBCR-CbysuchBCRmembers (centralisedresponsibilityandliabilityregime).

SAsmayalso,onacasebycasebasis,accept solutionswhereseveralBCRmembersestablishedin theEEAhavesuchresponsibilityandliability,and wheresufficientandadequateassurancesare providedbytheapplicant.Whereanalternative mechanismtothecentralisedresponsibilityand liabilityregimeisused,theapplicantshouldshow thatdatasubjectswillbetransparentlyinformed,

assistedinexercisingtheirrightsandnot disadvantagedorundulyinhibitedinanywaybythe useofsuchalternativemechanism.

TheBCR-Cshouldalsostatethat,ifaBCRmember outsidetheEEAviolatestheBCRC,thecourtsor otherjudicialauthoritiesintheEEAwillhave jurisdiction,anddatasubjectswillhavetherights andremediesagainsttheLiableBCRmemberasif theviolationhadbeencausedbythelatterinthe MemberStateinwhichitisbased,insteadoftheBCR memberoutsidetheEEA.

GDPR

1.5TheLiableBCRmember(s) hassufficientassets NO YES Article70(1)(i)

Theapplicationformshouldcontainaconfirmation thattheLiableBCRmember(s)hassufficientassets, orhasmadeappropriatearrangementstoenable itselftopaycompensationfordamagesresulting fromabreachoftheBCR-C.

Suchconfirmationshouldberenewedatthe occasionofeveryannualupdate(seeSection8.1 below).

1.6Theburdenofprooflies withtheLiableBCRmember(s)

YES NO Article47(2)(f)

GDPR

TheBCRCmustcontainthecommitmentthatwhere datasubjectscandemonstratethattheyhave suffereddamageandestablishfactswhichshowitis likelythatthedamagehasoccurredbecauseofthe breachoftheBCR-C,itwillbefortheLiableBCR membertoprovethattheBCRmemberoutsideof theEEAwasnotresponsibleforthebreachofthe BCRCgivingrisetothosedamages,orthatnosuch breachtookplace.

1.7EasyaccesstotheBCRCfor

datasubjects

YES NO Article47(2)(g)

GDPR

TheBCR-Cmustcontainthecommitmentthatall datasubjectsshouldbeprovidedwithinformation

ontheirthirdpartybeneficiaryrights,withregardto theprocessingoftheirpersonaldata,andonthe meanstoexercisethoserights.

Furthermore,theBCR-Cmustcontainthe commitmentthatdatasubjectswillbeprovidedat leastwiththedescriptionofthescopeoftheBCR-C (seeSection2below),theclauserelatingtothe Groupsliability(seeSection1.4above),theclauses relatingtothedataprotectionprinciples(see Section5.1.1below),tothelawfulnessofthe processing(seeSection5.1.2below),tosecurityand personaldatabreachnotifications(seeSection5.1.3 below),torestrictionsononwardtransfers(see Section5.1.4below),andtheclausesrelatingtothe rightsofthedatasubjects(seeSection5.2below). Thisinformationshouldbeuptodate,and presentedtodatasubjectsinaclear,intelligible,and transparentway.Thisinformationshouldbe providedinfull,henceasummaryhereofwillnotbe sufficient.

Moreover,theBCRCmustillustratethewayin whichsuchinformationwillbeprovided.For instance,theBCR-Cmaystatethatatleasttheparts oftheBCRConwhichinformationtodatasubjects ismandatory(asdescribedintheprevious paragraphs)willbepublishedontheinternetoron theintranet(whendatasubjectsareonlytheGroup staffhavingaccesstotheintranet).

IncasetheGroupplanstonotpublishtheBCRCas awhole,butonlycertainpartsoraspecificversion aimedatinformingdatasubjects,theGroupshould

2SCOPEOFTHEBCR

2.1Descriptionofthematerial scopeoftheBCRC YES YES Article47(2)(b) GDPR

expresslyprovideintheBCRCthelistofthe elementsthatitwillincludeinthatpublicversion.

Insuchsituation,thedescriptionofthematerial scopeoftheBCR-C17shouldalwaysbepartofthe informationontheBCRCthatispubliclyavailable. Thelistofdefinitions(seeSection9.1below)and,if applicable,ofabbreviationswhichareusedinthe BCRC,shouldinanycasebeincludedinthepartsof theBCRCwhicharepublished.TheBCRCshould containanexpresscommitmentinthisregard. TheBCRCmustuseclearandplainlanguagesothat employeesandanyotherpersoninchargewith applyingtheBCRCcansufficientlyunderstand them.Thesameappliestoanyparts/versionofthe BCRCthatwillbepublishedwiththeaimof providingaccesstotheBCR-Cfordatasubjects.

InordertobetransparentastothescopeoftheBCR C,theBCR-Cmustspecifytheirmaterialscope,and thereforecontainadescriptionofthetransfers.

TheBCRCmust,inparticular,specifypertransferor setoftransfers18(forexample,bymeansofatable): thecategoriesofpersonaldata;

17SeeSection2.1below.

18Theinformationonthetransfersmustbeexhaustiveinthateverytransferorsetoftransfersmustbedescribed.Thisdoesnotmeanthattheinformationmustbeprovided withahighdegreeofspecificityorgranularity.Wherethedescriptionprovidedbytheapplicantistoobroad,generalorvague,theapplicantshouldbeabletoexplainwhyit isnotinapositiontoprovidemoredetailedinformation.Ifandtotheextentthatanyoftheelementsprovidedinthetransfersdescriptionchangesinthefuture,theprocess forBCRCupdatesapplies,i.e.,informationontheamendmentstotheBCRCmustbeprovidedintheannualBCRCupdatenotifiedtotheBCRLead(seeSection8.1below).

2.2ListofBCRmembers,and descriptionofthegeographical scopeoftheBCR-C

YES YES Article47(2)(a) GDPR

- thetypeofprocessingandtheirpurposes; thecategoriesofdatasubjects(e.g.data relatedtoemployees,customers,suppliers andotherthirdpartiesaspartoftheGroups respectiveregularbusinessactivities);and

- thethirdcountryorcountries.

Astothedatasubjectscovered,BCRCwillapplyto alldatasubjectswhosepersonaldataare transferredwithinthescopeoftheBCRCfroman entityunderthescopeofapplicationofChapterV GDPR.Therefore,thescopeoftheBCRCmay,in particular,notbelimitedtoEEAcitizensorEEA residents.

TheBCRCshallspecifythestructureandcontact detailsoftheGroupandofeachofitsBCRmembers (contactdetailsoftheBCRmembers suchas addressandcompanyregistrationnumber,where available shouldbeinsertedinthelistofBCR membersthatispartoftheBCR-C,forexamplean annexthereof,thathastobepublishedalongwith theBCRC).

TheBCR-Cshouldindicatethattheyatleastapplyto allpersonaldatatransferredtoBCRmembers outsidetheEEA,andonwardtransferstootherBCR membersoutsidetheEEA.

3EFFECTIVENESS

3.1 Suitable training programme YES NO Article47(2)(n) GDPR

TheBCRCmuststatethatappropriateandupto datetrainingontheBCRCisprovidedtopersonnel

3.2Complainthandlingprocess fortheBCRC

YES NO

Article47(2)(i) andArticle12(3) GDPR

thathavepermanentorregularaccesstopersonal data,whoareinvolvedinthecollectionofdataorin thedevelopmentoftoolsusedtoprocesspersonal data.

Thetrainingprogramme,includingitsmaterials,has tobedevelopedtoasufficientlyelaboratedegree beforetheBCRCareapproved.

TrainingintervalsshouldbespecifiedintheBCRC.

Trainingshouldcover,amongothers,proceduresof managingrequestsforaccesstopersonaldataby publicauthorities.

TheSAsevaluatingtheBCRCmayaskforexamples andexplanationsofthetrainingprogrammeduring theapplicationprocedure.

Aninternalcomplainthandlingprocessmustbeset upintheBCRCtoensurethatanydatasubject shouldbeabletoexercisetheirrightsandcomplain aboutanyBCRmember.

TheBCRC(or,dependingonthecase,thepartsof theBCRCthatwillbepublishedfortheattentionof datasubjects,seeSection1.7above)willincludethe point(s)ofcontactwheredatasubjectscanlodge anycomplaintsrelatedtotheprocessingoftheir personaldatacoveredbytheBCR-C.Asinglepoint ofcontactoranumberofpointsofcontactare possible.Inthisregard,aphysicaladdressshouldbe provided.Additionally,furthercontactoptionsmay beprovided,e.g.agenericemailaddressand/ora phonenumber.

Whiledatasubjectsareencouragedtousethe point(s)ofcontactindicated,thisisnotmandatory.

TheBCRCmustcontainthedutyforthecontroller toprovideinformationonactionstakentothe complainantwithoutunduedelay,andinanyevent withinonemonth,byaclearlyidentifieddepartment orpersonwithanappropriatelevelofindependence intheexerciseoftheirfunctions.Takingintoaccount thecomplexityandnumberoftherequests,that onemonthperiodmaybeextendedatmaximumby twofurthermonths,inwhichcasethecomplainant shouldbeinformedaccordingly.

TheBCRC(or,dependingonthecase,thepartsof theBCR-Cthatwillbepublishedfortheattentionof datasubjects,seeSection1.7above)shouldinclude informationaboutthepracticalstepsofthe complaintprocess,inparticular:

- Wheretocomplain(point(s)ofcontact;see above); Inwhatform;

- Consequencesofdelaysforthereplytothe complaint;

Consequencesincaseofrejectionofthe complaint;

Consequencesincasethecomplaintis consideredasjustified;and

- Consequencesifthedatasubjectisnotsatisfied bythereply,i.e.,righttolodgeaclaimbeforethe

3.3Auditprogrammecovering theBCR-C

YES NO Article47(2)(j) and(l),and

Article 38(3)

GDPR

competentcourtandacomplaintbeforeaSA (seeSection1.3.2above),whileclarifyingthat suchrightisnotdependentonthedatasubject havingusedthecomplainthandlingprocess beforehand.

TheBCRCmustcreateadutyfortheGrouptohave dataprotectionauditsonaregularbasis(byeither internaland/orexternalaccreditedauditors)andif thereareindicationsofnoncompliancetoensure verificationofcompliancewiththeBCR-C.

Theauditfrequencyenvisagedshouldbespecifiedin theBCRC.Thefrequencyneedstobedetermined onthebasisoftherisk(s)posedbytheprocessing activitiescoveredbytheBCRCtotherightsand freedomsofdatasubjects.

Inadditiontotheregularaudits,specificaudits(ad hocaudits)mayberequestedbythePrivacyofficer orFunction(seeSection3.4below),oranyother competentfunctionintheorganisation.

Ifauditswillbecarriedoutbyexternalauditors,the BCRCshouldspecifytheconditionsunderwhich suchauditorsmaybeentrusted.

TheBCR-Cshouldstatewhichentity(department withintheGroup)decidesontheaudit plan/programme,andwhichentitywillconductthe audit.Dataprotectionofficersshouldnotbethe onesinchargeofauditingcompliancewiththeBCR C,ifsuchsituationcanresultinaconflictofinterests. Functionsthatmaypossiblybeentrustedwith decidingontheauditplan/programmeand/orwith

conductingauditsinclude,forinstance,Audit Departments,butotherappropriatesolutionsmay beacceptabletooprovidedthat:

- thepersonsinchargeareguaranteed independenceastotheperformanceoftheir dutiesrelatedtotheseaudits;and theBCRCincludeanexplicitcommitmentinthis regard.

TheBCR-Cshouldstatethattheauditprogramme coversallaspectsoftheBCRC(forinstance, applications,ITsystems,databasesthatprocess personaldata,oronwardtransfers,decisionstaken asregardsmandatoryrequirementsundernational lawsthatconflictwiththeBCR-C,reviewofthe contractualtermsusedforthetransfersoutofthe Grouptocontrollersorprocessorsofdata, correctiveactions,etc.),includingmethodsand actionplansensuringthatcorrectiveactionshave beenimplemented.

ItisnotmandatorytomonitorallaspectsoftheBCR CeachtimeaBCRmemberisaudited,aslongasall aspectsoftheBCRCaremonitoredatappropriate regularintervalsforthatBCRmember.

Moreover,theBCRCshouldstatethattheresults willbecommunicated:

- tothePrivacyofficerorFunction(seeSection3.4 below);

- totheboardoftheLiableBCRmember;and

3.4Creationofanetworkof dataprotectionofficers(DPOs) orappropriatestafffor monitoringcompliancewith theBCRC

YES NO Article47(2)(h) andArticle38(3) GDPR

- whereappropriate,alsototheGroupsultimate parent'sboard.

TheBCRCmuststatethatCompetentSAscanhave accesstotheresultsoftheaudituponrequest.

SinceSAsarealreadyboundbyanobligationof confidentialityinthecourseofexercisingtheirpublic office(seeinparticularArticle54(2)GDPR),theBCR Cshouldnotcontainwordingaimedatrestricting thedutyofallBCRmemberstocommunicatethe resultsoftheaudit(s)totheSAsongroundsof confidentiality,e.g.relatedtotheprotectionof businesssecrets.

TheBCR-Cmustcontainacommitmenttodesignate aDPO,whererequiredinlinewithArticle37GDPR, oranyotherpersonorentity(suchasachiefprivacy officer)withresponsibilitytomonitorcompliance withtheBCRC,enjoyingthehighestmanagement supportforthefulfillingofthistask.

TheDPOortheotherprivacyprofessionalscanbe assistedbyateam,anetworkoflocalDPOsorlocal contacts,asappropriate(hereinafter Privacy officerorFunction).

TheDPOshalldirectlyreporttothehighest managementlevel.Inaddition,theDPOcaninform thehighestmanagementlevelifanyquestionsor problemsariseduringtheperformanceoftheir duties.

TheBCRCshouldincludeabriefdescriptionofthe internalstructure,role,positionandtasksofthe DPOorsimilarfunctionandthenetworkcreatedto

ensurecompliancewiththeBCRC.Forexample, thattheDPOorchiefprivacyofficerinformsand advisesthehighestmanagement,dealswith CompetentSAsinvestigations,monitorsand annuallyreportsoncomplianceatagloballevel,and thatlocalDPOsorlocalcontactscanbeinchargeof handlinglocalcomplaintsfromdatasubjects, reportingmajorprivacyissuestotheDPO, monitoringtrainingandcomplianceatalocallevel.

TheDPOshouldnothaveanytasksthatcouldresult inconflictofinterests.TheDPOshouldnotbein chargeofcarryingoutdataprotectionimpact assessments,neithershouldtheybeinchargeof carryingouttheBCRCauditsifsuchsituationscan resultinaconflictofinterests.However,theDPO canplayaveryimportantandusefulroleinassisting theBCRmembers,andtheadviceoftheDPOshould besoughtforsuchtasks.

TheBCRCshouldspecifythattheDPOorother privacyprofessionalsmaybedirectlycontacted.The BCRCshouldincludeacommitmenttopublishtheir contactdetails.

4COOPERATIONDUTY

tocooperatewith,toaccepttobeauditedandtobe inspected,includingwherenecessary,on-site,bythe competentSAs, totakeintoaccounttheiradvice,and

- toabidebydecisionsoftheseSAs onanyissuerelatedtotheBCR-C.

TheBCR-Cshallincludetheobligationtoprovidethe CompetentSAs,uponrequest,withanyinformation abouttheprocessingoperationscoveredbythe BCRC.

SinceSAsarealreadyboundbyanobligationof confidentialityinthecourseofexercisingtheirpublic office(seeinparticularArticle54(2)GDPR),theBCR Cmaynotcontainwordingaimedatrestrictingthe dutyofallBCRmemberstocooperatewiththe CompetentSAs,totakeintoaccounttheiradvice,to abidebytheirdecisionsortoaccepttobeaudited andtobeinspectedbythemincluding,where necessary,onsite,ortoacceptauditsbythemon groundsofconfidentiality,e.g.relatedtothe protectionofbusinesssecrets.

TheBCRCcanneitherlimitthedutytocooperate withCompetentSAsnorlimittheirpowers,in particularinrelationtothepracticalmodalitiesof theauditsconductedbytheseSAs(e.g.,notlimited tobusinesshours).

TheBCRCneedtoincludeacommitmentthatany disputerelatedtotheCompetentSAsexerciseof supervisionofcompliancewiththeBCRCwillbe resolvedbythecourtsoftheMemberStateofthat SA,inaccordancewiththatMemberStates procedurallaw.TheBCRmembersagreetosubmit themselvestothejurisdictionofthesecourts.

5DATAPROTECTIONSAFEGUARDS

5.1.1Descriptionofthedata protectionprinciples

YES NO Article47(2)(d) GDPRandArticle 5GDPR

TheBCRCshouldexplicitlyincludeanddescribethe followingprinciplestobeobservedbytheBCR members.

TheBCRCneedtoestablishthoseprinciplesina sufficientlyelaboratedmannerthatisinlinewith thecontentoftheprinciplesasprovidedforinthe GDPRprovisions.

TheBCRCshouldnotincludegenerallimitationsto theapplicationoftheseprinciples(e.g.,predefined listsofoverridinginterests),whichlimitationscan onlybeappliedonacase-bycasebasis,and,where applicable,inaccordancewiththetransparency requirements.

i.Transparency,fairnessandlawfulness(see Section5.1.2below)forprocessingofpersonal data,specialcategoriesofdata,anddata relatingtocriminalconvictionsandoffences (seeArticle5(1)(a),andArticles6,9,and10 GDPR);

ii.Purposelimitation(seeArticle5(1)(b)GDPR);

iii.Dataminimisationandaccuracy(seeArticle 5(1)(c)and(d)GDPR);

iv.Limitedstorageperiods(seeArticle5(1)(e) GDPR);

v.Security (integrityandconfidentiality,see Section5.1.3below,andArticle5(1)(f)GDPR); and

5.1.2Lawfulnessofprocessing YES NO Article47(2)(d), Article5(1)(a), andArticles6 and9GDPR

vi.Onwardtransfers

(seeSection5.1.4belowand ChapterVGDPR).

TheBCRCshouldcontainanexhaustivelistofall legalbasisforprocessingwhichtheBCRmembers intendtorelyon.Onlylegalbasisasthosestipulated inArticle6(1)and(3)GDPR,orinotherlegalbasis laiddowninUnionorMemberstatelaw,as permittedbytheGDPR,canbeused19 .

Inaddition,specialcategoriesofpersonaldatamay onlybeprocessedifexemptionsastheones envisagedbyArticle9(2)GDPRapply.TheBCRC shouldcontainanexhaustivelistofallsuch exemptions.

Processingofpersonaldatarelatingtocriminal convictionsandoffencesshallbeprohibited,unless thesameexemptionsastheonesenvisagedby Article10GDPRapply.

5.1.3Securityandpersonal databreachnotifications

YES NO Article47(2)(d) andArticles32to 34GDPR

TheBCR-Cshouldincludeacommitmentto implementappropriatetechnicalandorganisational measurestoensurealevelofsecurityappropriateto therisk(s)fortherightsandfreedomsofnatural persons(seeArticle5(f)andArticle32GDPR).Itis notmandatorytocopypastethewordingofsuch GDPRprovisions.However,theBCR-Cneedtocreate thoseobligationsinasufficientlyelaboratedmanner thatisinlinewiththecontentoftheseprovisions.

TheBCRCshouldincludeadutytonotify:

19Asregardspossibleconflictswiththirdcountrylegalobligations,seeSection54.1below.

5.1.4Restrictionsononward transfers YES NO Article47(2)(d) GDPRandArticle 44GDPR

- withoutunduedelay,anypersonaldata breachestotheLiableBCRmemberandthe relevantPrivacyofficerorFunction,aswell astotheBCRmemberactingasacontroller whenaBCRmemberactingasaprocessor becomesawareofadatabreach;

- withoutunduedelay,and,wherefeasible, notlaterthan72hoursafterhavingbecome awareofthepersonaldatabreachtothe CompetentSA,unlessthepersonaldata breachisunlikelytoresultinarisktothe rightsandfreedomsofnaturalpersons;

- withoutunduedelaytodatasubjects,where thepersonaldatabreachislikelytoresultin ahighrisktotheirrightsandfreedoms.

Furthermore,anypersonaldatabreachshouldbe documented(comprisingthefactsrelatingtothe personaldatabreach,itseffects,andtheremedial actiontaken),andthedocumentationshouldbe madeavailabletotheCompetentSAuponrequest (seeArticles33and34GDPR).

BCRCshouldcontainthecommitmentthatpersonal datathathavebeentransferredundertheBCRmay onlybeonwardtransferredoutsidetheEEAto processorsandcontrollerswhicharenotboundby theBCR-C20iftheconditionsfortransferslaiddown inArticles44to46GDPRareappliedinorderto ensurethatthelevelofprotectionofnaturalpersons guaranteedbyGDPRisnotundermined.Inthe

20ForonwardtransferstootherBCRmembersoutsidetheEEA,seeSection2.2above

5.2Rightsofdatasubjects YES NO Article47(2)(e), Articles12to19 and21to22 GDPR

absenceofanadequacydecisionorappropriate safeguards,BCRCmayincludeaprovisionthat onwardtransfersmayexceptionallytakeplaceifa derogationappliesinlinewithArticle49GDPR.

TheBCRCshouldprovidedatasubjectswiththe rightsofinformation,access,rectification,erasure, restriction,notificationregardingrectificationor erasureorrestriction,objectiontoprocessing,right nottobesubjecttodecisionsbasedsolelyon automatedprocessing,includingprofiling,inthe samewayastheserightsareprovidedforbyArticles 12to19,andArticles21and22GDPR.

Itisnotmandatorytocopy-pastethewordingofthe abovementionedGDPRprovisions.However,the BCRCneedtocreatethoserightsinasufficiently elaboratedmannerthatisinlinewiththecontentof theseprovisions.

5.3Accountabilityandother

tools

YES NO Article47(2)(d), andArticles30, 3536GDPR

EveryBCRmemberactingascontrollershallbe responsibleforandabletodemonstratecompliance withtheBCRC(seeArticle5(2)andArticle24GDPR).

TheBCRCneedtocontainacommitmenttoenter intocontractswith all internalandexternal contractors/processorsandmustspecifythecontent ofsuchcontracts,assetoutinArticle28(3)GDPR, includingthedutytofollowthecontrollers instructionsandimplementappropriatetechnical andorganisationalmeasures.

TheBCRCshouldcontainacommitmentthat,in ordertodemonstratecompliance,BCRmembers havetomaintainarecordofallcategoriesof

processingactivitiescarriedoutonpersonaldata transferredundertheseBCRC.TheBCRCmust specifythecontentoftherecord,inlinewithwhatis requiredbyArticle30(1)(forcontrollers)andArticle 30(2)(forprocessors).Thisrecordshouldbe maintainedinwriting,includinginelectronicform, andshouldbemadeavailabletotheCompetentSA onrequest.

TheBCRCshouldcontainthecommitmentthatdata protectionimpactassessmentsshouldbecarriedout forprocessingoperationsonpersonaldata transferredundertheseBCRCthatarelikelyto resultinahighrisktotherightsandfreedomsof naturalpersons(seeArticle35GDPR).

Whereadataprotectionimpactassessment indicatesthattheprocessingwouldresultinahigh riskintheabsenceofmeasurestakenbythe controllertomitigatetherisk,theBCRmember actingasacontrollershould,priortoprocessing, consulttheCompetentSA(seeArticle36GDPR).

TheBCRCshouldenvisagethatappropriate technicalandorganisationalmeasuresdesignedto implementdataprotectionprinciplesandto facilitatecompliance,inpractice,withthe requirementssetupbytheBCRC,shouldbe implemented(dataprotectionbydesignandby defaultseeArticle25GDPR).

5.4.1Locallawsandpractices affectingcompliancewiththe

BCRC21

YES NO Article47(2)(m) GDPR

TheBCRCshallcontainaclearcommitmentthat BCRmemberswillusetheBCRCasatoolfor transfersonlywheretheyhaveassessedthatthelaw andpracticesinthethirdcountryofdestination applicabletotheprocessingofthepersonaldataby theBCRmemberactingasdataimporter,including anyrequirementstodisclosepersonaldataor measuresauthorisingaccessbypublicauthorities, donotpreventitfromfulfillingitsobligationsunder theseBCRC.

TheBCR-Cshouldfurtherspecifythatthisisbased ontheunderstandingthatlawsandpracticesthat respecttheessenceofthefundamentalrightsand freedoms,anddonotexceedwhatisnecessaryand proportionateinademocraticsocietytosafeguard oneoftheobjectiveslistedinArticle23(1)GDPR,are notincontradictionwiththeBCR-C.

TheBCR-Cshouldalsocontainacommitmentthat, inassessingthelawsandpracticesofthethird countrywhichmayaffecttherespectofthe commitmentscontainedintheBCRC,theBCR membershavetakendueaccount,inparticular,of thefollowingelements:

i.Thespecificcircumstancesofthetransfersorset oftransfers,andofanyenvisagedonward transferswithinthesamethirdcountryorto anotherthirdcountry,including:

21Forfurtherdetails,seeEDPBRecommendations01/2020onmeasuresthatsupplementtransfertoolstoensurecompliancewiththeEUlevelofprotectionofpersonal data,availableathttps://edpb.europa.eu/ourworktools/ourdocuments/recommendations/recommendations012020measuressupplementtransfer_en

- purposesforwhichthedataaretransferred andprocessed(e.g.marketing,HR,storage, ITsupport,clinicaltrials);

typesofentitiesinvolvedintheprocessing (thedataimporterandanyfurtherrecipient ofanyonwardtransfer);

- economicsectorinwhichthetransferorset oftransfersoccur;

categoriesandformatofthepersonaldata transferred;

locationoftheprocessing,including storage;and - transmissionchannelsused.

ii.Thelawsandpracticesofthethirdcountryof destinationrelevantinlightofthecircumstances ofthetransfer22,includingthoserequiringto disclosedatatopublicauthoritiesorauthorising accessbysuchauthoritiesandthoseproviding foraccesstothesedataduringthetransit betweenthecountryofthedataexporterand thecountryofthedataimporter,aswellasthe applicablelimitationsandsafeguards.

iii.Anyrelevantcontractual,technicalor organisationalsafeguardsputinplaceto supplementthesafeguardsundertheBCRC,

22Asregardstheassessmentoftheimpactofthelawsandpracticesofthethirdcountries,pleaseseeEDPBRecommendations01/2020onmeasuresthatsupplementtransfer toolstoensurecompliancewiththeEUlevelofprotectionofpersonaldata.

includingmeasuresappliedduringthe transmissionandtotheprocessingofthe personaldatainthecountryofdestination.

TheBCR-Cshouldalsocontainacommitmentthat whereanysafeguardsinadditiontothoseenvisaged undertheBCR-Cshouldbeputinplace,theLiable BCRmember(s),andtherelevantPrivacyofficeror Functionwillbeinformedandinvolvedinsuch assessment.

TheBCRCshouldcontainalsoanobligationforthe BCRmemberstodocumentappropriatelysuch assessment,aswellasthesupplementarymeasures selectedandimplemented.Theyshouldmakesuch documentationavailabletothecompetentSAsupon request.

TheBCRCshouldobligeanyBCRmemberactingas dataimportertopromptlynotifythedataexporter if,whenusingtheseBCRCasatoolfortransfers,and forthedurationoftheBCRmembership,ithas reasonstobelievethatitisorhasbecomesubjectto lawsorpracticesthatwouldpreventitfromfulfilling itsobligationsundertheBCRC,includingfollowing achangeinthelawsinthethirdcountryora measure(suchasadisclosurerequest).This informationshouldalsobeprovidedtotheLiable BCRmember(s).

Uponverificationofsuchnotification,theBCR memberactingasdataexporter,alongwiththe LiableBCRmember(s)andtherelevantPrivacy officerorFunction,shouldcommittopromptly identifysupplementarymeasures(e.g.technicalor

organisationalmeasurestoensuresecurityand confidentiality)tobeadoptedbytheBCRmember actingasdataexporterand/ordataimporter,in ordertoenablethemtofulfiltheirobligationsunder theBCR-C.ThesameappliesifaBCRmemberacting asdataexporterhasreasonstobelievethataBCR memberactingasitsdataimportercannolonger fulfilitsobligationsunderthisBCRC.

WheretheBCRmemberactingasdataexporter, alongwiththeLiableBCRmember(s)andthe relevantPrivacyofficerorFunction,assessesthat theBCRCevenifaccompaniedbysupplementary measurescannotbecompliedwithforatransfer orsetoftransfers,orifinstructedbytheCompetent SAs,itcommitstosuspendthetransferorsetof transfersatstake,aswellasalltransfersforwhich thesameassessmentandreasoningwouldleadtoa similarresult,untilcomplianceisagainensuredor thetransferisended.

TheBCRCshouldcontainacommitmentthat followingsuchasuspension,theBCRmemberacting asdataexporterhastoendthetransferorsetof transfersiftheBCR-Ccannotbecompliedwithand compliancewiththeBCRisnotrestoredwithinone monthofsuspension.Inthiscase,personaldatathat havebeentransferredpriortothesuspension,and anycopiesthereof,should,atthechoiceoftheBCR memberactingasdataexporter,bereturnedtoitor destroyedintheirentirety.

TheBCRCshouldcontainacommitmentthatthe liableBCRmember(s)andtherelevantPrivacy

5.4.2Obligationsofthedata

importerincaseofgovernment accessrequests

YES NO Article47(2)(m) GDPR

officerorFunctionwillinformallotherBCR membersoftheassessmentcarriedoutandofits results,sothattheidentifiedsupplementary measureswillbeappliedincasethesametypeof transfersiscarriedoutbyanyotherBCRmemberor, whereeffectivesupplementarymeasurescouldnot beputinplace,thetransfersatstakearesuspended orended.

TheBCRCneedstoincludeadutyfordataexporters tomonitor,onanongoingbasis,andwhere appropriateincollaborationwithdataimporters, developmentsinthethirdcountriestowhichthe dataexportershavetransferredpersonaldatathat couldaffecttheinitialassessmentofthelevelof protectionandthedecisionstakenaccordinglyon suchtransfers.

WithoutprejudicetotheobligationoftheBCR memberactingasdataimportertoinformthedata exporterofitsinabilitytocomplywiththe commitmentscontainedintheBCR-C(seeSection 5.4.1above),theBCRCshouldalsoincludethe followingcommitments:

i. TheBCRmemberactingasdataimporterwill promptlynotifythedataexporterand,where possible,thedatasubject(ifnecessarywith thehelpofthedataexporter)ifit:

a)receivesalegallybindingrequestbya publicauthorityunderthelawsofthe countryofdestination,orofananother thirdcountry,fordisclosureofpersonal datatransferredpursuanttotheBCR-C;

suchnotificationwillincludeinformation aboutthepersonaldatarequested,the requestingauthority,thelegalbasisfor therequestandtheresponseprovided; b)becomesawareofanydirectaccessby publicauthoritiestopersonaldata transferredpursuanttotheBCRCin accordancewiththelawsofthecountryof destination;suchnotificationwillinclude allinformationavailabletothedata importer.

ii. Ifprohibitedfromnotifyingthedataexporter and/orthedatasubject,thedataimporter willuseitsbesteffortstoobtainawaiverof suchprohibition,withaviewtocommunicate asmuchinformationaspossibleandassoon aspossible,andwilldocumentitsbestefforts inordertobeabletodemonstratethemupon requestofthedataexporter.

iii. ThedataimporterwillprovidetheBCR memberactingasdataexporter,atregular intervals,withasmuchrelevantinformation aspossibleontherequestsreceived(in particular,numberofrequests,typeofdata requested, requesting authority or authorities,whetherrequestshavebeen challengedandtheoutcomeofsuch challenges,etc.).Ifthedataimporterisor becomespartiallyorcompletelyprohibited fromprovidingthedataexporterwiththe aforementionedinformation,itwill,without

unduedelay,informthedataexporter accordingly.

iv. Thedataimporterwillpreservethe abovementionedinformationforaslongas thepersonaldataaresubjecttothe safeguardsprovidedbytheBCR-C,andshall makeitavailabletotheCompetentSAsupon request.

v. Thedataimporterwillreviewthelegalityof therequestfordisclosure,inparticular whetheritremainswithinthepowers grantedtotherequestingpublicauthority, andwillchallengetherequestif,aftercareful assessment,itconcludesthatthereare reasonablegroundstoconsiderthatthe requestisunlawfulunderthelawsofthe countryofdestination,applicableobligations underinternationallaw,andprinciplesof internationalcomity.

Thedataimporterwill,underthesame conditions,pursuepossibilitiesofappeal. Whenchallengingarequest,thedata importerwillseekinterimmeasureswitha viewtosuspendingtheeffectsoftherequest untilthecompetentjudicialauthorityhas decidedonitsmerits.Itwillnotdisclosethe personaldatarequesteduntilrequiredtodo soundertheapplicableproceduralrules.

vi. Thedataimporterwilldocumentitslegal assessmentandanychallengetotherequest

6TERMINATION

6.1Termination YES NO Article70(1)(i) GDPR

fordisclosureand,totheextentpermissible underthelawsofthecountryofdestination, makethedocumentationavailabletothe dataexporter.Itwillalsomakeitavailableto theCompetentSAsuponrequest.

vii. Thedataimporterwillprovidetheminimum amountofinformationpermissiblewhen respondingtoarequestfordisclosure,based onareasonableinterpretationoftherequest.

Inanycase,theBCRCshouldstatethattransfersof personaldatabyaBCRmembertoanypublic authoritycannotbemassive,disproportionateand indiscriminateinamannerthatwouldgobeyond whatisnecessaryinademocraticsociety(astothe consequencesofsuchcases,seeSection 5.4.1above).

TheBCRCshouldspecifythataBCRmemberacting asdataimporter,whichceasestobeboundbythe BCRCmaykeep,return,ordeletethepersonaldata receivedundertheBCR-C.

Ifthedataexporteranddataimporteragreethatthe datamaybekeptbythedataimporter,protection mustbemaintainedinaccordancewithChapterV GDPR.

7 NONCOMPLIANCE

7.1.Non-Compliance YES NO Article70(1)(i) GDPR

TheBCRCshouldcontaincommitmentsastothe followingobligations:

i. NotransferismadetoaBCRmemberunless theBCRmemberiseffectivelyboundbythe BCRCandcandelivercompliance.

ii. Thedataimportershouldpromptlyinform thedataexporterifitisunabletocomply withtheBCRC,forwhateverreason, includingthesituationsfurtherdescribed underSection5.4.1above.

iii. Wherethedataimporterisinbreachofthe BCRCorunabletocomplywiththem,the dataexportershouldsuspendthetransfer.

iv. Thedataimportershould,atthechoiceof thedataexporter,immediatelyreturnor deletethepersonaldatathathasbeen transferredundertheBCRCinitsentirety, where:

- thedataexporterhassuspendedthe transfer,andcompliancewiththisBCR Cisnotrestoredwithinareasonable time,andinanyeventwithinonemonth ofsuspension;or thedataimporterisinsubstantialor persistentbreachoftheBCR-C;or thedataimporterfailstocomplywitha bindingdecisionofacompetentcourtor CompetentSAregardingitsobligations undertheBCR-C.

8MECHANISMSFORREPORTINGANDRECORDINGCHANGES

8.1Processforupdatingthe BCRC YES NO Article47(2)(k) GDPR

Thesamecommitmentsshouldapplytoanycopies ofthedata.Thedataimportershouldcertifythe deletionofthedatatothedataexporter.

Untilthedataisdeletedorreturned,thedata importershouldcontinuetoensurecompliancewith theBCR-C.

Incaseoflocallawsapplicabletothedataimporter that prohibit the return or deletion ofthetransferredpersonaldata,thedataimporter shouldwarrantthatitwillcontinuetoensure compliancewiththeBCRC,andwillonlyprocessthe datatotheextentandforaslongasrequiredunder thatlocallaw.

Forcaseswereapplicablelocallawsand/or practicesaffectcompliancewiththeBCRC,see Section5.4.1above.

TheBCRChavetobekeptuptodateinorderto reflectthecurrentsituation(forinstancetotake intoaccountmodificationsoftheregulatory environment,theseEDPBRecommendations,or changestothescopeoftheBCR-C).

TheBCR-Cshouldimposeadutytoreportchanges, includingtothelistofBCRmembers,withoutundue delay,toallBCRmembers.

TheBCR-Cshouldidentifyapersonor team/departmentthatkeepsafullyupdatedlistof theBCRmembers,keepsrecordofanyupdatesto theBCRC,andprovidesthenecessaryinformation

9-DEFINITIONS

9.1Listofdefinitions YES NO Article70(1)(i) GDPR

todatasubjects,and,uponrequest,toCompetent SAs.

WhereamodificationtotheBCRCwouldpossibly bedetrimentaltotheleveloftheprotectionoffered bytheBCRCorsignificantlyaffectthem(e.g. changestothebindingcharacter,changeofthe LiableBCRmember(s)),itmustbecommunicatedin advancetotheSAs,viatheBCRLead,withabrief explanationofthereasonsfortheupdate.Inthis case,theSAswillalsoassesswhetherthechanges maderequireanewapproval.

AnyotherchangestotheBCRCortothelistofBCR membersshouldbenotifiedonceayeartotheSAs, viatheBCRLead,withabriefexplanationofthe reasonsfortheupdate.Thisincludesanychanges madeinordertoaligntheBCR-Cwithanyupdated versionoftheseEDPBRecommendations.

ItremainstheresponsibilityoftheBCRCholderto keepitup-to-dateandincompliancewithArticle47 GDPRandtheseEDPBRecommendations.

Theapplicantshouldincludealistofdefinitionsin theBCRC.Thelistshouldincludethemostrelevant terms.TotheextenttheBCR-Ccontainterms definedintheGDPR,thedefinitionsprovidedshould notvaryfromtheGDPR.Forbetterreadability,these definitionsshouldbereplicatedinthelist.

Ifthetermsdataexporteranddataimporterare used,theymustbedefined.Theapplicantmayfind itusefultoaddfurthertermsandtheirdefinitions.

IfthetermCompetentSA(s)isusedbythe applicant,itshouldbedefinedasreferringtothe EEAdataprotectionSAcompetentforthedata exporter.

Wherethetermapplicablelawisused,itshould beclarified,ineachcase,whetheritrefersto national/locallawofathirdcountryasapplicableto theBCRmembers.Inanycase,BCRmembersmust complywiththerequirementssetoutunder Sections5.4.1and5.4.2above.

ReferencestoGDPRprovisionsshouldgenerallybe avoided.However,ifthereisaneedforreferenceto aparticularprovisionoftheGDPR,itshouldbe quotedinfullintheBCR-C.

FortheEuropeanDataProtectionBoard

TheChair (AndreaJelinek)