# Opinion 21/2021 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the CGI Group - Type: Guidance - Source: EDPB - Identifier: opinion-212021-on-the-draft-decision-of-the-french-en - Date: 2021-07-01 - Original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-212021-on-the-draft-decision-of-the-french_en - Canonical: https://overview.legal/posts/126010 - Topics: Social Media, Data Controller, Data Processor, Codes of Conduct, Processors, International Transfer, Supervisory Authorities, Supervision, Personal Data, Processing ## Summary Adopted Opinion 21/2021 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the CGI Group Adopted on 1 July 2021 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64(1) (f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such… ## Full text Adopted Opinion 21/2021 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the CGI Group Adopted on 1 July 2021 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64(1) (f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), Having regard to the European Economic Area ( hereinafter “ EEA ” ) Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 1 , Having regard to Article s 10 and 22 of its Rules of Procedure . Whereas: (1) The main role of the European Data Protection Board (here in after the “ EDPB ” ) is to ensure the consistent application of the GDPR throughout the EEA . To this effect, it follows from A rticle 64(1)(f) GDPR that the EDPB shall issue an opinion where a supervisory authority ( here in after “ SA ” ) aims to approve binding corporate rules ( here in after “ BCRs ” ) within the meaning of A rticle 47 GDPR. (2) The EDPB welcomes and acknowledges the efforts the companies make to uphold the GDPR standards in a gl obal environment. Building on the experience under Directive 95/46/EC , the EDPB affirms the important role of BCRs to frame international transfers and its commitment to support the companies in setting - up their BCRs. This opinion aims towards this objecti ve and takes into account that the GDPR strengthened the level of protection, as reflected in the requirements of A rticle 47 GDPR , and conferred to the EDPB the task to issue an opinion on the competent SA ’s (BCR s Lead) draft decision aiming to approve BCR s. This task of the EDPB aims to ensure the consistent application of the GDPR, including by the SAs , controllers , and processors. (3) Pursuant to Article 46(1) GDPR, in the absence of a decision pursuant to Article 45 ( 3) GDPR , a controller or processor may transfer personal data to a third country or international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are av ailable. A group of undertakings or group of enterprises engaged in a joint economic activity may provide such safeguards by the use of legally binding BCRs, which expressly confer enforceable rights on data subjects and fulfil a series of requirements ( A r ticle 46 GDPR). The specific requirements listed in the GDPR are the minimum items BCRs shall specify ( A rticle 47(2) GDPR). The BCRs are subject to approval from the competent SA , in accordance with the consistency mechanism set out in A rticle 63 and Artic le 64(1)(f) GDPR, provided that the BCRs meet the conditions set out in Article 47 GDPR, together with the requirements set out in the relevant working documents of the Article 29 Working Party 2 , endorsed by the EDPB. 1 References to “Member States” made throughout this opinion should be understood as references to “EEA Member States”. 2 The Working Party on the Protection of Individuals with regard to the Processing of Personal Data instituted by Article 29 of Dire ctive 95/46/EC . 4 Adopted (4) This opinion only covers EDPB’s co nsideration that the BCRs submitted for the required opinion afford appropriate safeguards in that they meet all requirements of Article 47 GDPR and WP256 rev01 of the Article 29 Working Party, as endorsed by the EDPB 3 . Accordingly, this opinion and the SA s’ review do not address elements and obligations of the GDPR mentioned in the BCRs at issue other than those related to Article 47 GDPR . (5) WP256 rev.01 of the Article 29 Working Party, as endorsed by the EDPB, provides for the required elements for BCRs for controllers (hereinafter “BCR - C”) , including the Intra - Company Agreement where applicable, and the application form. WP264 of the Art icle 29 Working Party 4 , as endorsed by the EDPB, provides for recommendations to the applicants to help them demonstrate how to meet the requirements of Article 47 GDPR and WP256 rev01. Additionally, WP264 informs the applicants that any documentation subm itted is subject to access to documents requests in accordance with the SAs’ national laws. The EDPB is subject to Regulation 1049/2001 5 pursuant to Article 76(2) GDPR. ( 6 ) Taking into account the specific characteristics of BCRs provided for by Article 47(1) and (2) GDPR , each application should be addressed individually and is without prejudice to the assessment of any other BCRs . The EDPB recalls that BCRs should be customised to take account of the structure of the group of companies that they apply t o, the processing they undertake , and the policies and procedures that they have in place to protect personal data 6 . (7 ) The opinion of the EDPB shall be adopted, pursuant to Article 64(3) GDPR in conjunction with A rticle 10(2) of the EDPB Rules of Procedure, within eight weeks after the Chair has decided that the file is complete. Upon decision of the EDPB Chair, this period may be extended by a further six weeks, taking into account the complexity of the subject matter. HAS ADOPTED THE FOLLOWING OPINION : 1 SUMMARY OF THE FACTS 1. In accordance with the cooperation procedure as set out in WP263 rev.01, the draft BCR - C of the CGI Group were reviewed by French Supervisory Authority as the BCR Lead SA (hereinafter the “BCR Lead SA”) . 2. The BCR Lead SA has s ubmitted its draft decision regarding the draft BCR - C of the CGI Group , requesting an opinion of the EDPB pursuant to A rticle 64(1)(f) GDPR on 20 April 2021 . The decision on the completeness of the file was taken on 17 May 2021 . 3 Article 29 Working Party , Working Document setting up a table with the elements and principles to be found in Binding Corporate Rules , a s last r evised and a dopted on 6 February 2018 , WP 256 rev.01. 4 Article 29 Working Party, Recommendations on the Standard Application for Approval of Controller Binding Corporate Rules for the Transfer of Personal Data, adopted on 11 April 2018, WP264. 5 Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents . 6 This view was expressed by the Article 29 Working party in Working Document Setti ng up a framework for the structure of Binding Corporate Rules, adopted on 24 June 2008 , WP154. 5 Adopted 2 ASSESSMENT 3. The draft BCR - C of the CGI Group cover transfers of personal data when CGI Group entities , legally bound by the BCRs and having implemented the BCRs, act as a Data Controller and when CGI Group entities act as a Data Processor on behalf of CGI (“internal data processor” ) (article 2 BCR - C) . 4. Concerned data subjects include CGI Group’s employees, job candidates, clients, shareholders, suppliers and subcontractors and other third parties such as visitors. 5. The draft BCR - C of CGI Group have been scrutinised according to the procedures set up by the EDPB. The SAs assembled within the EDPB have concluded that the CGI Group draft BCRs - C contain all elements required under A rt icle 47 GDPR and WP256 rev01, in concordance with the draft decision of the BCR Lead SA submitted to the EDPB for an opinion. Therefore, the EDPB does not have any concerns that need to be addressed. 3 CONCLUSIONS / RECOMM ENDATIONS 6. Taking into account the above and the commitments that the group members will undertake by signing the CGI Group’s Intercompany A greement, the EDPB considers that the draft d ecision of the BCR Lead SA may be adopted as it is, since the draft BCR - C of the CGI Group contain appropriate safeguards to ensure that the level of protection of natural persons guarantee d by the GDPR is not undermined when personal data will be transferred to and processed by the g roup m embers based in third countries. Finally, the EDPB also recalls the provisions contained within A rticle 47(2)(k) GDPR and WP256 rev.01 providing the condi tions under which the applicant may modify or update the BCRs, includi ng updates to the list of BCRs g roup m embers . 4 FIN AL REMARKS 7. This opinion is addressed to the F rench Supervisory Authority and will be made public pursuant to A rticle 64(5 )( b) GDPR. 8. According to Article 64 (7) and (8) GDPR, the French Supervisory Authority shall communicate its response to this opinion to the Chair within two weeks after receiving the opinion . 9. Pursuant to A rticle 70(1)(y) GDPR, the F rench Supervisory Authority shall co mmunicate the final decision to the EDPB for inclusion in the register of decisions which have been subject to the consistency mechanism. 10. In accordance with the judgment of the Court of Justice of the European Union C - 311/187 7 , it is the responsibility of the data exporter in a Member State, if needed with the help of the data importer, to assess whether the level of protection required by EU law is respected in the third country concerned, in order to determine if the guarantees provided by BCRs can be com plied with in practice, taking into consideration the possible interference created by the third country legislation with the fundamental rights. If this is not the case, the data exporter in a Member State, if needed with the help of the data importer, sh ould assess whether they can provide supplementary measures to ensure an essentially equivalent level of protection as provided in the EU . 7 CJEU, Data Protection Commissioner v .Facebook Ireland Ltd and Maximillian Schrems , 16 July 2020, C - 311/18. 6 Adopted For the European Data Protection Board The Chair (Andrea Jelinek) --- Generated by overview.legal · https://overview.legal/posts/126010 · 2026-07-17