Cybersecurity Policy Report, Irish DPC’s Draft BCR Decision Wins EDPB Endorsement, (Nov 13, 2024)

By Tony Foley

The European Data Protection Board (EDPB) announced yesterday that it had issued an opinion on the draft decision of the Irish Data Protection Commission (DPC) regarding binding corporate rules (BCRs) submitted by Aptiv Global Operations Ltd. and its participating companies to facilitate transfers of personal data outside the European Union.

Opinion 23/2024, which may be downloaded from this webpage, notes that, under article 64(1)(f) of the EU’s General Data Protection Regulation (GDPR), the EDPB is responsible for issuing an opinion where a supervisory authority (in this case, the DPC) seeks to approve BCRs under GDPR article 47. The DPC submitted its draft opinion to the EDPB on Sept. 20.

In its assessment, the EDPB found that the draft BCR of the Aptiv group of companies covered all transfers of personal data between the group’s entities bound under the BCRs, as well as the processing conducted by such entities as a controller or internal processor.

In addition, the agency concluded that the draft BCRs contained all of the elements required under GDPR article 47 and the DPC’s recommendations made in its draft decision. Accordingly, the EDPB did not have any concerns that needed to be addressed and concluded that the draft BCRs could be adopted as-is. The EDPB also noted, however, that the approval of the BCRs by the DPC as the BCR lead did not entail the approval of specific transfers to be carried out pursuant to third countries included in the BCRs for which an essentially equivalent level of protection to those guaranteed under the GDPR cannot be ensured.

The DPC must communicate its response to the opinion within two weeks after receiving it, and subsequently must communicate its final decision to the EDPB for inclusion in the board’s register of decisions.

News: InternationalLegislation DataPrivacy GDPR