GE Gains First Binding Corporate Rules UK Approval
Significance of Binding Corporate Rules
On Thursday 15th December 2005 GE was approved in the UK as the first ever organisation gaining UK approval for its Binding Corporate Rules to export data from the European Economic Area, though this is currently restricted to data under the jurisdiction of the UK Commissioner. As the first such approval GE is in the forefront of Data Privacy.
GE has limited the data covered to be solely Employee Data currently. And the rules themselves are pubic domain, as they should be, on GE's website.
What is the Process?
The UK Information Commissioner submitted the rules to the other EEA Data Protection Authorities in April 2005 under the co-operation procedure when there was a month in which the other authorities could make comments. An iterative process then took place to get to where they are today. In December 2005 the Final Approved version was submitted to the others DPAs. And they can still comment and ask for alterations. Good housekeeping by GE and the UK Commissioner makes any substantial comments unlikely, but they are still possible. Obviously any modifications must also be acceptable to the UK Commissioner, since he has approved the rules in the first place.
What needs to be understood is that this is both an iterative process of gaining approval and also that each DPA acts independently. That the UK has approved the GE BCRs is actually not relevant to the other DPAs making their own national decisions. And each nation can impose special conditions.
The Eventual Outcome
GE will be approved to transfer its employee data worldwide lawfully within the GE group of Companies. This makes sense. BCRs are not a carte blanche to transfer data to third parties. Of course this is subject to any non conflicting EEA legislation.
We've asked GE for a comment and will be publishing it here as soon as we have it. We assume that they will move to full BCRs for their entire sales and marketing data after piloting the system with employee data, but we'll let you know what they say.
It's a complex procedure, but not half as complex as using the Model Contract Clauses to create either a potentially legally precarious "many to many" contract, or multiple "one to one" contracts between every entity in a complex group structure.
|
