Article 43*
Article 43 – Transfers by way of binding corporate rules
Commission Proposal
1. A supervisory authority shall in accordance with the consistency mechanism set out in Article 58 approve binding corporate rules, provided that they:
(a) are legally binding and apply to and are enforced by every member within the controller’s or processor’s group of undertakings, and include their employees; 2. The binding corporate rules shall at least specify: (a) the structure and contact details of the group of undertakings and its members; 3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for binding corporate rules within the meaning of this Article, in particular as regards the criteria for their approval, the application of points (b), (d), (e) and (f) of paragraph 2 to binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned. 4. The Commission may specify the format and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules within the meaning of this Article. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2). |
EDRi’s proposed amendment
1. A supervisory authority shall in accordance with the consistency mechanism set out in Article 58 approve binding corporate rules, provided that they:
(a) are legally binding and apply to and are enforced by every member within the controller’s or processor’s group of undertakings, and include their employees; 2. The binding corporate rules shall at least specify: (a) the structure and contact details of the group of undertakings and its members; 3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for binding corporate rules within the meaning of this Article, in particular as regards the criteria for their approval, including transparency for data subjects, the application of points (b), (d), (e) and (f) of paragraph 2 to binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned. 4. The Commission may specify the format and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules within the meaning of this Article. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 87(2). |
Justification
The proposed amendment adds more specifications as to the matters that need to be addressed in BCRs and the criteria for their acceptance.