Binding Corporate Rules

Binding Corporate Rules or "BCRs" were developed by the European Union Article 29 Working Party to allow multinational corporations, international organizations and groups of companies to make intra-organizational transfers of personal data across borders in compliance with EU Data Protection Law. The BCRs were developed as an alternative to the U.S. Department of Commerce EU Safe Harbor Safe Harbor (which is for US organizations only) and the EU Model Contract Clauses.

BCRs are required to be approved by the data protection authority in each EU Member State (such as the Information Commissioner's Office in the United Kingdom) in which the organization will rely on the BCRs. The EU has developed a mutual recognition process under which BCRs approved by one member state's data protection authority (known as the "lead" authority) may be approved by the other relevant member states who may make comments and ask for amendments.

BCRs typically form a stringent, intra-corporate global privacy policy that satisfies EU standards and may be available as an alternative means of authorizing transfers of personal data (e.g., customer databases, HR information, etc.) outside of Europe.

BCRs should be seen as a framework having different elements (Internal legal agreement, Policies, training, audit, etc.) providing compliance with EU data protection regulations and effective privacy and data protection.

The Article 29 Working Party issued several guidance documents on BCR content, acceptance criteria and submission process.

BCR's by themselves do not "authorize" all transfers automatically for all EU member states. Most of member states still require a formal "transfer notification" which is normally granted if the BCR has been accepted by the relevant country.

The following companies have obtained authorizations for BCRs:

Accenture with the UK ICO as the lead DPA

Atmel Corporation with the UK ICO as the lead DPA

American Express with the UK ICO

Bank Austria Creditanstalt

BP with the UK ICO as the lead DPA

Bristol Myers Squibb with the CNIL as the lead DPA

CareFusion Incorporated with the UK ICO as the lead DPA.

Cargill

Citigroup with the UK ICO

CMA-CGM with CNIL

D.E. Master Blenders 1753 ("DEMB") ex Sara Lee International B.V. (indirect subsidiary of Sara Lee Corporation) with the Dutch DPA

Daimler Benz

Deutsche Post DHL with Germany's Federal Commissioner for Data Protection and Freedom of Information

Deutsche Telekom

eBay with the Luxemburg DPA as the lead

First Data with the UK ICO as the lead DPA

GE with UK ICO as the lead DPA

HP with the CNIL as the lead DPA

Hyatt Hotel Corporation with the UK ICO as the lead DPA

IMS Health Incorporated with the UK ICO as the lead DPA

Intel with the UK ICO as the lead DPA

International SOS with the CNIL as the lead DPA

JPMorgan Chase with the UK ICO as the lead DPA

Linklaters with the UK ICO

LVMH with CNIL

Michelin with the CNIL as the lead DPA

Novartis with CNIL

Novo Nordisk with the Danish DPA as the lead

Philips (2) with the UK ICO as the lead DPA

Safran with the CNIL as the lead DPA

Sanofi Aventis with the CNIL as the lead DPA

Schering with the Berlin Data Protection Commissioner

Schlumberger Ltd. with the Dutch DPA

Shell International B.V. with the Dutch DPA

Spencer Stuart with the UK ICO as the lead DPA

In addition, the Article 29 Working Party has introduced guidance for BCRs for processors (also known as 'Binding Safe Processor Rules' or BSPR).