European Data Protection Board: approval of BCRs is not enough
Approved binding corporate rules for processors do not relieve transfer participants of the need to assess the compliance of each data transfer separately. The full text of the opinion in the Judykatura database sets out a new framework of requirements for groups using this transfer mechanism. The European Data Protection Board clearly distinguishes the assessment of the rules themselves from the assessment of specific processing operations and transfers.
The rest of this analysis, all theses and the full text of the ruling are available with an AKTUALNOŚCI PLUS subscription.
Find out how EU supervisory authorities, administrative and civil courts and the CJEU reason their decisions — and keep your organisation aligned with current case law.