Information note on BCRs for Groups of undertakings / enterprises which have ICO as BCR Lead SA

Information note on BCRs for Groups of u ndertakings / enterprises which have ICO as BCR Lead SA Adopted on 22 July 2020 This document is without prejudice to the analysis currently undertaken by the EDPB on the consequences of the CJEU judgment DPC v Facebook Ireland and Schrems 1 for BCRs as transfer tools. 01 2 . T his change of BCR Lead shall take effect at the latest at the end of the Brexit transition period. 1 GDPR, will have to issue a new approval decision following an opinion from the EDPB before the end of the transition period. For BCRs for which ICO acted as BCR Lead SA under Directive 95/46/EC, no approval will have to be issued by the new BCR Lead SA in the EEA. From a content perspective : BCR holders having the ICO as BCR Lead SA need to amend their BCRs with reference to the EEA legal order before the end of the Brexit transition period. To assist Groups of undertakings/enterprises in this process, a checklist of elements to be amended is provided in annex to this note.

In the absence of such changes and/or a new approval, where applicable, before the end of transition period, Groups of undertakings/enterprises will not be able to rely on their BCRs a s a valid transfer mechanism for transfers of data outside the EEA after the end of the transition period. 1 CJEU, Data Protection Commissioner v Facebook Ireland Ltd, Maximillian Schrems (C - 311/18). 01, adopted on 11 April 2018 - endorsed by the EDPB. 01 4 . While the taking over of a BCR by a new BCR Lead SA does not imply that it has verified whether such updates have been made, it remains at any time in a position to do so and to request that relevant changes are made by any BCR holder and adopt any consequent decision in this regard . Any other changes to the BCRs taken over as described above may also be requested if deemed necessary by the n ew BCR Lead SA . A ll the SAs, including the new BCR Lead SA , reserve their right to exercise their powers including, the power of conducting an investigation on BCRs, including of the BCR implementation itself, or to give a special attention to certain aspects of such BCR in the context of a broader investigation of the company, and, where appropriate, an approval.

To assist them in this process, a checklist of elements to be included is provided in annex to this note. In both scenarios above, the SA in the EEA that may be approached to act as the new BCR Lead SA will consider, on the basis of criteria se t out in WP263 and in cooperation with other concerned SAs , whether it is the appropriate BCR Lead SA on a case - by - case basis and inform the G roup accordingly. 01 - endorsed by the EDPB. 01 - endors ed by the EDPB. Annex : Checklist of elements for Controller and Processor BCRs which need to be amended for a BCR Lead SA change in the context of Brexit  The following elements are to be updated due to a BCR Lead SA change in the context of Brexit. In addition to the elements outlined in the table below, all definitions of EEA entities, EEA applicable law and any other relevant definitions should be amended in both BCR f or controllers (“BCR - C”) and BCR for processors (“BCR - P”).

 In the specifi c case of BCR - P, consideration needs to be given to the need to re - word the Service Level Agreement (“SLA”) where the controller is in the UK. Additionally, in BCR - P scenarios where the Group member contracting with the controller is based in the UK, the S LA will need to be re - signed with an EEA - based Group member. Criteria for a BCR Lead SA change 5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs 1. 2 An explanation of how the rules are made binding on the BCR members of the Group of undertakings / enterprises and also the employees YES In the BCRs and the documents linked to it, especially the chosen legally binding measures YES Section 4 of WP264 6 or WP265 7 Art. : where necessary, replace any reference to the former ‘BCR applicant (in the UK)’ with the new ‘BCR app licant in the EEA’. 01 (endorsed by the EDPB), which the EDPB considers are impacted b y Brexit.

6 Article 29 Working Party, Recommendation on the Standard Application for Approval of Controller Bind ing Corporate Rules for the Transfer of Personal Data, WP264, adopted on 11 April 2018 - endorsed by the EDPB. 7 Article 29 Working Party, Recommendation on the Standard Application for Approval of Processor Binding Corporate Rules for th e Transfer of Pers onal Data, WP265, adopted on 11 April 2018 - endorsed by the EDPB. Criteria for a BCR Lead SA change 5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs declaration, it would be necessary to assess that the participating member of the Group of undertakings / enterprises (‘BCR member’) making the unilateral declaration is established in a Member State recognising this legal instrument.  In the legal instrument used to make the BCR binding, replace any reference to the ‘contract law (in the UK)’ applicable to the legally binding instrument with the new EEA contract law.

, IGA). 3 The creation of third - party beneficiary rights for data subjects. Including the possibility to lodge a YES YES Art. 01 9 . 01, including with respect to rights that are enforceable directly against the processor, and rights that are enforceable against the processor when the data subj ect is not able to bring a claim against the controller. 4  Ensure that the service agreement used to make the BCR - P binding towards the controller is signed, on the side of the Group of undertakings / enterprises acting as processor, by a BCR member in the EEA. 01 - endorsed by the EDPB. 01 - endorsed by the EDPB. , either a BCR member with delegated data protection responsibilities in the EEA, or the EEA exporter). 5 The EU headquarters, EU member with delegated data protection responsibilities or the data exporter accepts liability for paying compensation and to remedy breaches of the BCRs YES YES Section 1, 3, and 4 of WP264 and WP265 Art.

f GDPR  Where the BCR member with delegated responsibilities was one based in the UK, the new entity taking liability for any violations of the BCRs by other BCR members outside of the EEA shall be located in the EEA .  Furthermore, as a reminder, where the BCRs provide that every BCR member exporting data out of the EEA on the basis of the BCRs will be liable for breaches of the BCRs by the data importer, the BCR member located in the UK shall be considered a data importer and not a data exporter. 6. The company has sufficient assets. NO YES Art. f GDPR  Provide confirmation of whether the new entity taking liability in the EEA has Criteria for a BCR Lead SA change 5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs Section 4 of WP264 and WP265 sufficient financial means (or confirmation of an insurance) to cover any damages. 2. EFFECTIVENESS 2.

The existence of a complaint handling process for the BCRs . YES YES Section 5 of WP264 and WP265 Art. 3. GDPR  Ensure that any reference to the competent SA refers to EEA SAs (choice before the SA in the EEA State of his habitual residence, place of work or place of the alleged infringement in the EEA, pursuant to Art . 77 GDPR).  Ensure that any reference to the ‘competent courts’ or ‘national jurisdiction” will be based in the EEA (choice for the data subject to act before the EEA courts where the controller or processor has an establishment or where the data subject has his or her EEA habitual residence pursuant to Art . 79 GDPR). 3. The existence of an audit programme covering the BCRs . YES YES Art. 2. l and Art. 3 GDPR Ensure that the SAs having received the authority/power to carry out a data protection audit Criteria for a BCR Lead SA change 5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs Section 5 of WP264 and WP265 of any BCR are based in the EEA.

 Replace any reference to the former BCR Lead SA (in the UK) with the new one. 3. COOPERATION DUTY 3. 1. A duty to cooperate with SAs. YES YES Section 6 of WP264 and WP265 GDPR Art. l.  Ensure that the duty to cooperate with the SAs is referring to SAs based in the EEA. 2 A duty to cooperate with the controller . 2  Ensure that the duty to cooperate with the SAs is referring to SAs based in the EEA. 4. 1. A description of the material scope of the BCRs (nature of data transferred, ty pe of data subjects, countries). YES YES Section 2, 3, and 7 of WP264 and Section 2, 3, and 8 of WP265 Art. b GDPR  Remove the UK from the list of ‘EEA M ember S tates’.  Add the UK to the list of third countries to which personal data will be transferred (if applicable) and remove UK entities from the list of exporters. 2. A statement of the geographical scope of the BCRs . YES YES Section 2 and 7 of WP264 and Section 2 and 8 of WP265 Art.

a GDPR  Add the UK to the list of third countries and remove UK entities from the list of exporters. 5. 1. A process for updating the BCRs . YES YES Section 8 of WP264 and WP265 Art. k GDPR  Replace any reference to the former BCR Lead SA (in the UK) with the new one in the EEA. 6. 2. Accountability and other tools . YES YES Section 10 of WP264 and WP265 Art. d and Art. 30 GDPR  Ensure that any reference to SAs i s to be understood as EEA SAs. 3. A need to be transparent where national legislation prevents the group from complying with the BCRs . YES NO Art. m GDPR  Ensure that the reporting duty will be made to EEA SAs .