white_paper_on_data_protection_in_india_171127_final_v2

(ii)
Binding Corporate Rules
BCR are internal rules (such as codes of conduct) which are adopted by a multi-national
group of companies. BCRs define the global policy of the multi-national group of companies
with regard to the international transfers of personal data within the same corporate group, to
entities located in countries, which do not provide an adequate level of protection. 343
Multinational companies use BCRs in order to adduce adequate safeguards for the protection
of the privacy and fundamental rights and freedoms of individuals within the meaning of
Article 47 of the EU GDPR. 344
(iii) Model Contractual Clauses
The European Commission has the power to decide that certain standard contractual clauses
offer sufficient safeguards with respect to data protection while undertaking transfer of data to
non-EU/EEA countries. 345 As of date, the European Commission has issued two sets of
standard contractual clauses: one for transfers from data controllers to data controllers
established outside the EU/EEA; and one set for the transfer to processors established outside
the EU/EEA. 346 Transfers of data made under these contracts are deemed to be protected
under the EU GDPR. Since it is often difficult for stakeholders to comply with the ‗adequate
level‘ of protection for cross-border data transfers, alternatives such as Model Contract
Clauses may play a crucial role in practice. The use of these alternatives should be facilitated
for data controllers in any Member State.
data in Jersey‘, European Commission (17 November 2007), available at: http://ec.europa.eu/justice/dataprotection/article-29/documentation/opinion-recommendation/files/2007/wp141_en.pdf
(last accessed 30
October 2017).
341 Commission Decision dated 19 December 2012 on the level of protection of personal data by New Zealand,
notified under document C (2012) 9557, available at: http://eur-lex.europa.eu/legalcontent/EN/TXT/?qid=1415703506367&uri=CELEX:32013D0065
(last accessed 30 October 2017); Article 29
Data Protection Working Party, ‗Opinion 11/2011 on the level of protection of personal data in New Zealand‘,
European Commission (4 April 2011), available at: http://ec.europa.eu/justice/data-protection/article-
29/documentation/opinion-recommendation/files/2011/wp182_en.pdf (last accessed 30 October 2017).
342 Commission Decision dated 21 August 2012, on the level of protection of personal data by the Eastern
Republic of Uruguay, notified under document C (2012) 5704, available at: http://eur-lex.europa.eu/legalcontent/EN/TXT/?qid=1417090893822&uri=CELEX:32012D0484
(last accessed 30 October 2017); Article 29
Data Protection Working Party, ‗Opinion 6/2010 on the level of protection of personal data in the Eastern
Republic of Uruguay‘, European Commission (12 October 2010), available at: http://ec.europa.eu/justice/dataprotection/article-29/documentation/opinion-recommendation/files/2010/wp177_en.pdf
(last accessed 30
October 2017).
343 European Commission, ‗Overview on Binding Corporate Rules‘, available at: http://ec.europa.eu/justice/dataprotection/international-transfers/binding-corporate-rules/index_en.htm
(last accessed 30 October 2017).
344 European Commission, ‗Overview on Binding Corporate Rules‘, available at: http://ec.europa.eu/justice/dataprotection/international-transfers/binding-corporate-rules/index_en.htm
(last accessed 30 October 2017).
345 European Commission, ‗Frequently Asked Questions Relating to Transfers of Personal Data From The
EU/EEA To Third Countries‘, 11, (2009), available at:
http://ec.europa.eu/justice/policies/privacy/docs/international_transfers_faq/international_transfers_faq.pdf (last
accessed 29 October 2017).
346 European Commission, ‗Model Contracts for the Transfer of Personal Data to Third Countries‘, available at:
http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm (last accessed 30
October 2017).
65