Smoothing the way for international data transfers

To help businesses demonstrate their compliance, the International Chamber of Commerce (ICC) has taken the initiative to standardize the process across all 25 EU countries.

Until now, companies have had to submit different application forms to each EU member state when asking data protection authorities to approve their Binding Corporate Rules (BCRs) – corporate codes which set measures to ensure data protection in transfers from one country within the EU to a country outside it.

“With input from member companies working with BCRs and feedback from various European authorities, we created this standard application form for BCRs,” said Christopher Kuner, Chair of the ICC Task Force on Privacy and Protection of Personal Data. “The same form can be used for approval in all EU member states – that is the main advantage.”

Data protection authorities (DPAs) will also benefit from a more coherent, time-saving application process, while individuals will benefit from greater transparency in the drafting of BCR’s determining how their personal data is safeguarded, Mr Kuner also noted.

The standardized form has been submitted to the working group of European data protection authorities for discussion. DPAs have already responded favourably. “I welcome this ICC initiative, and hope that it will lead to a more streamlined and efficient procedure for approval of BCRs throughout the EU,” said Billy Hawkes, Irish Data Protection Commissioner.

Divided into eight sections, the ICC form guides companies through the application process, ensuring all the necessary information is included, and explains what conditions exist and what obligations need to be met. ICC has already taken a leading role in assisting companies to use BCRs, and published a comprehensive report on binding corporate rules for international transfers of personal data in November 2004.