The European Data Protection Board ("EDPB") has published an Information Note on Binding Corporate Rules ("BCRs") for groups of undertakings/enterprises which currently have the ICO as the competent supervisory authority ("BCR Lead SA"). The ICO will no longer be able to act as a BCR Lead SA after the end of the Brexit transition period on 31 December 2020.

We have summarised the key points from the Information Note below.

If you already have BCRs and the ICO is the BCR Lead SA:

  • all organisational arrangements need to be in place to identify a new BCR Lead SA in the EEA;
  • the change of BCR Lead SA must take effect before the end of the Brexit transition period at the latest;
  • if the BCRs were approved under the GDPR, the new BCR Lead SA in the EEA will have to issue a new approval decision following an opinion from the EDPB before the end of the transition period;
  • for BCRs where the ICO acted as a BCR Lead SA under the Data Protection Directive (Directive 95/46/EC), no approval is required by the new BCR Lead SA in the EEA;
  • it is necessary to amend the BCRs to refer to the EEA legal order before the end of the Brexit transition period (the EDPB has included a checklist of elements in an annex to note);
  • importantly, if such changes to the BCRs and/or new approval are not in place before the end of the transition period, the group of undertakings/enterprises will not be able to rely on the BCRs as a valid transfer mechanism outside of the EEA after the end of the transition period.

If you have current BCR applications before the ICO:

  • if at the review stage by the ICO, you are encouraged to put in place all organisational arrangements for a new BCR Lead SA in the EEA to be identified before the end of the Brexit transition period;
  • you will need to contact that supervisory authority in the EEA to provide all the necessary information regarding why it should be considered as the new BCR Lead SA;
  • the new BCR Lead SA will take over the application and formally initiate an approval procedure, subject to an opinion of the EDPB;
  • during the transition period, you may decide to transfer the BCR application to a new BCR Lead SA after approval by the ICO. Before the end of the transition period, the new BCR Lead SA in the EEA will then have to issue a new approval decision following an opinion from the EDPB;
  • in terms of content, for BCRs in the process of being approved by the ICO before the end of the transition period following an opinion of the EDPB, the BCRs must refer to the EEA legal order with information about related changes to become effective (at the latest) at the end of the transition period (there is a checklist of elements to be included in the annex to the note).

It is also important to note that the EDPB has stated this information note is "without prejudice to the analysis currently undertaken by the EDPB on the consequences of the CJEU judgement" in Schrems II for BCRs as a transfer tool.