A MoFo Privacy Minute Q&A: UK BCRs; Is the ICO Making Good on Its Promise?

This is A MoFo Privacy Minute, where we will answer the questions our clients are asking us in sixty seconds or less.

Question: The UK Information Commissioner’s Office (ICO) is taking a long time to approve our UK Binding Corporate Rules (UK BCRs) for cross-border data transfers under the UK GDPR, even though our company has approved EU Binding Corporate Rules (EU BCRs).

Will the ICO develop a more efficient way to approve these types of UK BCRs?

Answer:

Yes. The ICO has recently created a self-certification system for UK BCR applicants who had their EU BCRs approved prior to the GDPR entering into force. Companies that self-certify their compliance with the UK BCR requirements will receive certification promptly. The ICO is also preparing a template UK Addendum for holders of an approved EU BCR (UK BCR Addendum), which will allow for the UK BCRs to be appended to the EU BCRs, rather than these having to be stand alone. The ICO has not provided details on what the UK Addendum will look like yet but has indicated that it intends to publish an amendable template UK BCR Addendum as soon as this autumn of this year.

Following Brexit, the ICO developed its own approval regime for UK BCRs, requiring companies to create standalone UK BCRs and file them with the ICO. Companies whose EU BCRs were authorized by the ICO before the GDPR entered into force on May 25, 2018 were automatically eligible for UK BCRs after Brexit. However, companies who had EU BCRs approved by a lead supervisory authority other than the ICO needed to proactively create standalone UK BCRs and seek the ICO’s approval (see our Client Alert).

In July 2022, the ICO issued new guidance and approval requirements for UK BCRs in an effort to make them less prescriptive and principles-based; however, this has required that companies with existing EU BCR approval prepare a separate set of UK BCRs tailored for the UK. While the ICO intended to fast-track applications from entities with approved EU BCRs, in practice, the process has taken many companies a long time and approvals have been slow (see our Article).

In a change of approach, the ICO is now providing companies with approved EU BCRs and active UK BCR applications the option of submitting their amended UK BCR documents to the ICO and self-certifying their compliance with the UK BCR requirements. The ICO has stated that self-certified companies will receive UK BCR certification promptly but that the ICO will aim to review or audit any self-certified UK BCRs within three years of approval.

Companies still have the option of asking the ICO to continue their review of their UK BCRs and provide approval, but the ICO notes that it may take up to 18 months for approval (assuming prompt replies to feedback) and that this option would be preferable for applications that are at an advanced stage.

The ICO has also indicated that companies could switch to the UK BCR Addendum once it is available, even if it has decided to proceed with one of the two other options mentioned above.

The change in course is welcomed, as it will allow certain companies to indeed “fast-track” their UK BCRs where they are confident they meet the UK BCR requirements.