35. PLENARY SESSION: INFORMATION NOT ON BINDING CORPORATE RULES WITH UK SUPERVISORY AUTHORITIES

23.07.2020

The European Data Protection Board (“EDPB”) has recently published the agenda of Thirty-fifth Plenary session.

For the 35. Plenary session, the EDPB has adopted an information note outlining the actions that need to be taken by Supervisory Authorities, the holders of approved Binding Corporate Rules (“BCRs”) and organisations that have BCRs pending with the UK SA to ensure that these BCRs can still be used as a valid transfer tool, following the end of the transition period. 

As the UK Supervisory Authorities will no longer qualify as a competent authority under the GDPR at the end of the transition period, the approval decisions of the UK SA taken under the GDPR will no longer have legal effect in the European Economic Area (“EEA”).

It is stated that the change of the BCR Supervisory Authorities will have to take place before the end of the Brexit transition period. Current BCR applicants are encouraged to put in place all organisational arrangements to identify a new BCR Lead Supervisory Authorities in the EEA well in advance of the end of the Brexit transition period, including contacting the Supervisory Authority in question to provide all necessary information as to why this Supervisory Authority is being considered as the new BCR Lead Supervisory Authority.

The latter will then take over the application and formally initiate an approval procedure subject to an opinion of the EDPB. Any BCR approved by the UK Supervisory Authority under the GDPR will require the new EEA BCR Lead Supervisory Authority to issue a new approval decision before the end of the transition period, following an opinion from the EDPB.

You can read the EDPB’s announcement and also find the agenda of 35.Plenary session here.

Should you have any queries and/or remarks, please do not hesitate to contact us. 

 

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr