Binding Corporate Rules explained
Binding Corporate Rules are a set of data
processing rules created by the Article 29 Working Party of the European Union
on January 1st, 2013. They allow companies from all over the world to
process personal data with strict safeguards that have been approved by the
Article 29 Working Party.
This is a party made up of one representative from
each state in the European Union. These Binding Corporate Rules were designed
so that data processors didnít have to get the individual authority for data
protection from each of the member states of the European Union. Meaning, they
donít have to get a contract for every transfer of data to each state.
states of the European Union are actually individual countries in Europe. Some
of these countries include Ireland, Italy, Greece, Germany, France, Finland and
Austria; just to name a few. Using the Binding Corporate Rules is an
alternative to using Safe Harbor, which is where organizations within the
United States and European Union keep customer data. It was created by the
United States Department of Commerce under the directives of the European
Union. Safe Harbor is often criticized for not being as secure in protecting
personal data as with the Binding Corporate Rules, since it only protects
transfers going to the United States. Binding Corporate Rules are designed to
assist in the international transferring of personal information to locations
that do not provide a high amount of data protection in their area. The
European Union officials make sure that all the personal data that is
transferred outside the Economic European Area will be guided by the European
Unionís rules of data protection.
The companies that elect to use the binding
corporate rules have to comply with its strict rules. In order for a company to
be accepted under these rules they must implement the binding corporate rules
into their own system. To keep compliance the companyís system must contain
privacy principles, such as transparency, security, and data quality. They just
have tools of effectiveness, such as auditing, training and some sort of
complaint handling system. There must also be an element that proves the
binding corporate rules are actually binding.
Once compliance is verified these
organizations can transfer personal information outside of the Economic
European Area. This allows companies to export personal data outside of the
Economic European Area to locations in other countries that donít have the same
level of protection. This is important because data protection is fundamental
towards the way companies carry out their business.