The draft agenda for the next Article 29 Working Party meeting on 6-7 June includes a draft opinion on Binding Corporate Rules (“BCRs”) for processors. This could finally mean that BCRs for processors are within sight.
We all know that BCRs are not available for processors. This doesn’t make much sense. There are, after all, many large service providers that process vast quantities of personal data on behalf of other organisations. Encouraging high standards of global privacy compliance from these major players is key to securing the protection of personal data. BCRs are also a much more effective solution than model contracts; BCRs require applicants to demonstrate they have policies and procedures in place to achieve real protection for personal data. Model contracts can merely be signed and placed in a drawer to gather dust.
In this context, BCRs for processors (sometimes called “Binding Safe Processor Rules”) would be hugely beneficial. Customers could avoid the quagmire of entering into a matrix of model contracts. The service providers will be able to use the new BCRs as a “badge of privacy compliance”. All good reasons for moving forward with this.
The Article 29 Working Party’s listing of this as an agenda item is a breakthrough after years of disappointment. Many had started to question if anything would be introduced before the new Data Protection Regulation, which (in draft) formally establishes a regime for BCRs for processors, comes into force.
So what does listing as an agenda item mean? Well, it certainly does not mean that BCRs for processors are now a certainty. Agreement will have to be reached by the Article 29 Working Party. But it has in the past shown resolve. It is not unrealistic to hope that an opinion on BCRs for processors could be adopted this year.
At the risk of killing the optimism, however, it is important to remember that an opinion of the Article 29 Working Party is persuasive, but not binding. The reality is that a positive opinion may be ignored by national regulators, European or national courts. But a number of national regulators have already indicated their support for BCRs for processors. Also, there has been a high level of support for the existing BCR regime, which itself is heavily reliant on the opinions of the Article 29 Working Party. There is little doubt that a positive opinion will have a real practical effect. Just don’t put the champagne on ice quite yet.