Multinational companies build up complex information structures to share data on an international level. However, sharing personal data on such a level brings with it questions of legality. In its working document for binding corporate rules (BCRs) for international data transfers, the article 29 working party has outlined principles that may be used to govern such transfers. Based on article 26(2) of the European Union (EU) Data Protection Directive, this forms the authority for the concept of BCRs.

BCRs are intra-corporate global rules that establish consistent and compliant requirements for the use of personal data within a multinational company, satisfying EU standards and making it possible for the local data protection authorities (DPAs) to authorise the data transfer. This concept standardises data protection procedures and thus gives a greater flexibility and efficiency in complying with the legal requirements and transferring personal data around the world.

The development of the concept in Scandinavia is still in its infancy, with only one application for BCRs being received – and that has taken more than five months to complete.

The concept behind BCRs was the development of an alternative means of authorising transfers of personal data. The rules can be used in addition to European Commission decisions on standard contractual clauses, where applicable or the Safe Harbor Principles. Local DPAs can give groups using BCRs general authorisation for the transfer of personal data, provided that the necessary safeguards are in place.

The General Electric (GE) group was the first multinational company in Scandinavia to apply for authorisation and establish the use of BCRs in a project where employee data is to be transferred outside member states. This has attracted attention in the Scandinavian market and has led to increased interest in the BCR concept.

Generally, the use of BCRs is a novelty in Europe and, until recently, there was no precedent in Scandinavian countries on BCRs. Very few law firms in Europe have actually submitted BCR applications to regulators. GE was advised by law firm DLA Nordic on the approval of BCRs by DPAs in Sweden, Norway and Denmark for all companies within the Scandinavian region of the GE group.

For a group of companies such as GE to adopt and use BCRs, it must be able to guarantee adequate protection of personal data with regard to its transfer to a third country. The BCRs must be legally binding and apply generally and throughout the corporate group, irrespective of where the group companies are established or the nationality of the individuals whose personal data is being processed.

To ensure adequate protection of personal data it is also important to ensure compliance to protection rules by the group and its employees. Experience suggests that for an organisation such as GE the implementation of a BCR project strengthens the existing knowledge of compliance issues among employees and management. It encourages 'best practice' and underlines the importance of a compliance strategy within the organisation. This effect of an implemented BCR project is in itself a welcome addition to the authorisation to transfer the data.

The application process for authorisation from several DPAs to transfer data can, in itself, be a quite complicated procedure. However, the cooperation procedure for issuing common opinions on adequate safeguards resulting from BCRs, as approved by the article 29 working party, sets out principles for cooperation between the various DPAs involved, which facilitates the overall procedure and limits the amount of time that is needed for the approval of the transfer of personal data. Multinational companies would perhaps otherwise end up negotiating BCRs separately with several DPAs, each having somewhat different opinions regarding to the relevant documents and information required.

To facilitate the authorisation process it is important for the applicant and its legal advisers to understand the process that is taking place. They should have a set of applications for various DPAs that are well structured and harmonised as well as a good understanding of the working processes.

In GE's case, the UK Information Commissioner acted as lead authority and applications were submitted to the DPAs in every member state with a GE presence. As the GE application was the first of its kind in Scandinavia, the local DPAs commented that the procedure can be expected to run more smoothly in the future now there is a precedent in place.

GE's BCRs have had a number of positive effects for its Scandinavian companies. Personal integrity aspects are major issues that are discussed and justified, especially in Scandinavia. GE's approach to data protection compliance and efforts to create consistent practices has become well known across Scandinavia and brought about a good reputation among employees, customers and business partners alike. The group has proved itself to be a very good role model within Scandinavia.

In practice, the BCR implementation has given GE the opportunity to have close contact with DPA officials. The project has resulted in the authorities gaining a good understanding and a positive attitude towards the group, meaning that possible pitfalls in the future could be avoided. The Swedish DPA has also commented on the positive effects an implemented BCR project has on compliance and encourages similar projects within other groups.

BCRs are innovative tools that may be used to protect the privacy of the individuals the data refers to while, at the same time, facilitating the international transfer of personal data. They allow data transfer around the world using one single set of rules, at the same time enabling the individuals to have confidence in the process because their personal data is being processed using a binding and enforceable set of rules.

Accordingly, BCRs increase the compliance with data protection legislation within the group, at the same time making it less costly and time-consuming. These effects would be desirable for many multinational companies that have complex global information sharing structures.

Caroline Olstedt Carlstrom is a senior associate at DLA Nordic in Stockholm.