The Article 29 Working Party has adopted Working Paper WP 195 as a new “toolbox” with recommendations for Binding Corporate Rules (BCRs) for data processors. BCRs are becoming increasingly popular among corporate groups as a legal means for providing adequate protection to personal data, which is covered by Directive 95/46/EC and transferred out of the European Union to countries that are not considered to provide an adequate level of protection. WP195 tries to balance the interests of the parties to the Service Agreement, by enabling the processor to change sub-processors under existing BCRs, but at the same time requiring notice to the controller about such change to give the controller a chance to terminate the Service Agreement. Cloud service providers, outsourcing providers, and any other company offering global data processing services to customers in the EU will now have to consider current approaches and whether it is time to start the process to adopt BCRs.
Read more
