News

The European Union has developed Binding Corporate Rules (BCR) in order to govern international data transfers within companies or groups of companies. These rules can be seen as a code of conduct which defines the company policy on data transfers. This framework aims at adducing adequate safeguards to data transferred from the European Union to third countries.

Recently, the Member States of the APEC have developed a policy framework for international transfers of personal information, called the “Cross-Border Privacy Rules” (CBPR), and designed to provide guarantees to data transfers. Such guarantees are based in particular on certifications by APEC recognized accountability agents.

The EU BCR system and the CBPR are based on a similar approach, namely codes of conduct for international transfers developed by companies and approved a priori by Data Protection Authorities or by recognized accountability agents.

The WP29 (composed of representatives of the EU Data Protection Authorities) carried out a study of the CBPR system in order to identify its similarities and differences with the BCR system. Based on this comparison, the WP29 has launched a reflection in order to develop practical tools that would serve as a referential for multinational group of companies that have activities in both the European Union and the APEC area.

At the end of January 2013, the CNIL, which is rapporteur with the WP29 on this topic, as well as other EU Data Protection Authorities, met in Jakarta with the APEC BCR/CBPR Committee. A roadmap should be adopted in the upcoming months by the WP29 and the APEC in order to continue their cooperation and to materialise such practical tools for international group of companies.