Information note on BCRs for Groups of undertakings / enterprises which have ICO as BCR Lead SA

Information note on BCRs for Groups of u ndertakings / enterprises which have ICO as BCR Lead SA Adopted on 22 July 2020 This document is without prejudice to the analysis currently undertaken by the EDPB on the consequences of the CJEU judgment DPC v Facebook Ireland and Schrems 1 for BCRs as transfer tools.  Authorised BCR holders From a procedural perspective: BCR holders having the ICO as the competent Supervisory Authority (“ BCR Lead SA”) need to put in place all organisational arrangements on the basis of which a new BCR Lead in the EEA may be identified according to the criteria laid down in WP263 rev.01 2 . T his change of BCR Lead shall take effect at the latest at the end of the Brexit transition period. For BCRs already approved under the GDPR, the new BCR Lead SA in the EEA, as the new competent Supervisory Authority (“SA”) in accordance with Article 47.1 GDPR, will have to issue a new approval decision following an opinion from the EDPB before the end of the transition period.

For BCRs for which ICO acted as BCR Lead SA under Directive 95/46/EC, no approval will have to be issued by the new BCR Lead SA in the EEA. From a content perspective : BCR holders having the ICO as BCR Lead SA need to amend their BCRs with reference to the EEA legal order before the end of the Brexit transition period. To assist Groups of undertakings/enterprises in this process, a checklist of elements to be amended is provided in annex to this note. In the absence of such changes and/or a new approval, where applicable, before the end of transition period, Groups of undertakings/enterprises will not be able to rely on their BCRs a s a valid transfer mechanism for transfers of data outside the EEA after the end of the transition period. 1 CJEU, Data Protection Commissioner v Facebook Ireland Ltd, Maximillian Schrems (C - 311/18). 2 Article 29 Working Party, Working Document Setting Forth a Co - Operation Procedure for the approval of “Binding Corporate Rules” for controllers and processors und er the GDPR, WP263 rev.01, adopted on 11 April 2018 - endorsed by the EDPB.

Th ey will have to contact this SA in order to provide all necessary information as to why the given SA should be considered as the new BCR Lead SA . The new BCR Lead SA will take over the application and formally initiate an approval procedure subject to an opinion of the EDPB. During the transition period, Group of undertakings/enterprises might decide to transfer their BCR application to a new BCR Lead SA after approval by the ICO. In that case, the new BCR Lead SA in the EEA, as the new competent SA in ac cordance with Article 47.1 GDPR, will have to issue, before the end of the transition period, a new approval decision following an opinion from the EDPB. From a content perspective : Any Group of undertakings/enterprises that has BCRs in the process of be ing approved by the ICO before the end of the transition period following an opinion of the EDPB, must ensure that their BCRs refer to the EEA legal order with information about related changes to become effective (at the latest) at the end of the transiti on period.

To assist them in this process, a checklist of elements to be included is provided in annex to this note. In both scenarios above, the SA in the EEA that may be approached to act as the new BCR Lead SA will consider, on the basis of criteria se t out in WP263 and in cooperation with other concerned SAs , whether it is the appropriate BCR Lead SA on a case - by - case basis and inform the G roup accordingly. For the European Data Protection Board The Chair (Andrea Jelinek) 3 Article 29 Working Party, Working Document setting up a table with the elements and principles to be found in Binding Corporate Rules as last revised and adopted on 6 February 20 18, WP256 rev.01 - endorsed by the EDPB. 4 Article 29 Working Party, Working Document setting up a table with the elements and principles to be found in Processor Binding Corporate Rules as last revised and adopted on 6 February 2018, WP257 rev.01 - endors ed by the EDPB.

Annex : Checklist of elements for Controller and Processor BCRs which need to be amended for a BCR Lead SA change in the context of Brexit  The following elements are to be updated due to a BCR Lead SA change in the context of Brexit. In addition to the elements outlined in the table below, all definitions of EEA entities, EEA applicable law and any other relevant definitions should be amended in both BCR f or controllers (“BCR - C”) and BCR for processors (“BCR - P”).  In the specifi c case of BCR - P, consideration needs to be given to the need to re - word the Service Level Agreement (“SLA”) where the controller is in the UK. Additionally, in BCR - P scenarios where the Group member contracting with the controller is based in the UK, the S LA will need to be re - signed with an EEA - based Group member. Criteria for a BCR Lead SA change 5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs 1.

BINDING NATURE 1.2 An explanation of how the rules are made binding on the BCR members of the Group of undertakings / enterprises and also the employees YES In the BCRs and the documents linked to it, especially the chosen legally binding measures YES Section 4 of WP264 6 or WP265 7 Art. 47.1.a and 47.2.c GD PR  Duty of the Group of undertakings / enterprises to arrange internal matters in order to ensure that the BCRs will be binding throughout the EEA, e.g.: where necessary, replace any reference to the former ‘BCR applicant (in the UK)’ with the new ‘BCR app licant in the EEA’.  If the bindingness is ensured by means of a unilateral 5 Those criteria are those from the WP256rev.01 and WP257rev.01 (endorsed by the EDPB), which the EDPB considers are impacted b y Brexit. 6 Article 29 Working Party, Recommendation on the Standard Application for Approval of Controller Bind ing Corporate Rules for the Transfer of Personal Data, WP264, adopted on 11 April 2018 - endorsed by the EDPB. 7 Article 29 Working Party, Recommendation on the Standard Application for Approval of Processor Binding Corporate Rules for th e Transfer of Pers onal Data, WP265, adopted on 11 April 2018 - endorsed by the EDPB.

5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs declaration, it would be necessary to assess that the participating member of the Group of undertakings / enterprises (‘BCR member’) making the unilateral declaration is established in a Member State recognising this legal instrument.  In the legal instrument used to make the BCR binding, replace any reference to the ‘contract law (in the UK)’ applicable to the legally binding instrument with the new EEA contract law.  Request the Grou p of undertakings / enterprises to amend/update all the documents linked to the BCR, especially the chosen legally binding measures (e.g., IGA). EXTERNALLY 1.3 The creation of third - party beneficiary rights for data subjects. Including the possibility to lodge a YES YES Art. 47.1.b and 47.2.c, 47.2.e GDPR  Ensure that the refe rred competent SAs are based in the EEA, in line with the Criteria for a BCR Lead SA change 5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs complaint before the competent SA and before the courts Section 4 of WP264 and WP265 WP256 rev.01 8 and WP257 rev.01 9 .  Ensure that reference is made to EEA - based courts in line with the WP256 rev.01 and WP257 rev.01, including with respect to rights that are enforceable directly against the processor, and rights that are enforceable against the processor when the data subj ect is not able to bring a claim against the controller. 1.4 Responsibility towards the controller YES (applicable only to BCR - P) YES (applicable to BCR - P only ) Section 4 of WP265 WP257 rev.01 Section 1.4  Ensure that the service agreement used to make the BCR - P binding towards the controller is signed, on the side of the Group of undertakings / enterprises acting as processor, by a BCR member in the EEA.  Ensure that the controller is entitled to enforce the BCR - P 8 Article 29 Working Party, Working Document setting up a table with the elements and principles to be found in Binding Corpora te Rules as last revised and adopted on 6 February 2018, WP256 rev.01 - endorsed by the EDPB. 9 Article 29 Working Party, Working Document setting up a table with the elements and principles to be found in Processor Bindi ng Corporate Rules as last revised and adopted on 6 February 2018, WP257 rev.01 - endorsed by the EDPB.

5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs against at least one BCR member in the E EA (i.e., either a BCR member with delegated data protection responsibilities in the EEA, or the EEA exporter). 1.5 The EU headquarters, EU member with delegated data protection responsibilities or the data exporter accepts liability for paying compensation and to remedy breaches of the BCRs YES YES Section 1, 3, and 4 of WP264 and WP265 Art. 47.2.f GDPR  Where the BCR member with delegated responsibilities was one based in the UK, the new entity taking liability for any violations of the BCRs by other BCR members outside of the EEA shall be located in the EEA .  Furthermore, as a reminder, where the BCRs provide that every BCR member exporting data out of the EEA on the basis of the BCRs will be liable for breaches of the BCRs by the data importer, the BCR member located in the UK shall be considered a data importer and not a data exporter. 1.6.

The company has sufficient assets. NO YES Art. 47.2.f GDPR  Provide confirmation of whether the new entity taking liability in the EEA has Criteria for a BCR Lead SA change 5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs Section 4 of WP264 and WP265 sufficient financial means (or confirmation of an insurance) to cover any damages. 2. EFFECTIVENESS 2. The existence of a complaint handling process for the BCRs . YES YES Section 5 of WP264 and WP265 Art. 47.2.i and Art 12.3. GDPR  Ensure that any reference to the competent SA refers to EEA SAs (choice before the SA in the EEA State of his habitual residence, place of work or place of the alleged infringement in the EEA, pursuant to Art . 77 GDPR).  Ensure that any reference to the ‘competent courts’ or ‘national jurisdiction” will be based in the EEA (choice for the data subject to act before the EEA courts where the controller or processor has an establishment or where the data subject has his or her EEA habitual residence pursuant to Art . 79 GDPR). 2.3.

The existence of an audit programme covering the BCRs . YES YES Art. 47.2.j ; Art 47.2. l and Art. 38.3 GDPR Ensure that the SAs having received the authority/power to carry out a data protection audit Criteria for a BCR Lead SA change 5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs Section 5 of WP264 and WP265 of any BCR are based in the EEA.  Replace any reference to the former BCR Lead SA (in the UK) with the new one. 3. COOPERATION DUTY 3. 1. A duty to cooperate with SAs. YES YES Section 6 of WP264 and WP265 GDPR Art. 47.2.l.  Ensure that the duty to cooperate with the SAs is referring to SAs based in the EEA. 3.2 A duty to cooperate with the controller . YES (applicable only to BCR - P) YES (applicable to BCR - P only ) Section 7 of WP265 WP257rev.01 Section 3.2  Ensure that the duty to cooperate with the SAs is referring to SAs based in the EEA. 4.

DESCRIPTION OF PROCESSING AND DATA FLOWS 4.1. A description of the material scope of the BCRs (nature of data transferred, ty pe of data subjects, countries). YES YES Section 2, 3, and 7 of WP264 and Section 2, 3, and 8 of WP265 Art. 47.2.b GDPR  Remove the UK from the list of ‘EEA M ember S tates’.  Add the UK to the list of third countries to which personal data will be transferred (if applicable) and remove UK entities from the list of exporters. Criteria for a BCR Lead SA change 5 In the BCRs In the application form Text of reference Comments Reference to application form / BCRs 4.2. A statement of the geographical scope of the BCRs . YES YES Section 2 and 7 of WP264 and Section 2 and 8 of WP265 Art. 47.2.a GDPR  Add the UK to the list of third countries and remove UK entities from the list of exporters. 5. MECHANISMS FOR REPORTING AND RECORDING CHANGES 5.1. A process for updating the BCRs .

YES YES Section 8 of WP264 and WP265 Art. 47.2.k GDPR  Replace any reference to the former BCR Lead SA (in the UK) with the new one in the EEA. 6. DATA PROTECTION SAFEGUARDS 6.1.2. Accountability and other tools . YES YES Section 10 of WP264 and WP265 Art. 47.2.d and Art. 30 GDPR  Ensure that any reference to SAs i s to be understood as EEA SAs. 6.3. A need to be transparent where national legislation prevents the group from complying with the BCRs . YES NO Art. 47.2.m GDPR  Ensure that the reporting duty will be made to EEA SAs .