The EDPB has adopted an information note outlining the actions that need to be taken by supervisory authorities, the holders of approved BCRs and organisations that have BCRs pending with the ICO, to ensure that these BCRs can still be used as a valid transfer tool, following the end of the Brexit transition period.
As the ICO will no longer qualify as a competent supervisory authority under the GDPR at the end of the transition period, its approval decisions will no longer have legal effect in the EEA. In addition, the content of the BCRs in question may need to be amended before the transition period ends, as these BCRs generally contain references to the UK legal order. This also applies to BCRs already approved under Directive 94/46/EC.
BCR holders who have the ICO as their BCR lead authority need to put in place organisational arrangements to identify a new lead authority in the EEA. The change of lead authority will have to take place before the end of the transition period.
Current BCR applicants are encouraged to put in place organisational arrangements to identify a new BCR lead authority in the EEA well in advance of the end of the transition period, including contacting the supervisory authority in question to provide all necessary information as to why this supervisory authority is being considered as the new BCR lead authority. The latter will then take over the application and formally initiate an approval procedure subject to an EDPB opinion. Any BCR approved by the ICO under the GDPR will require the new EEA BCR lead authority to issue a new approval decision before the end of the transition period, following an opinion from the EDPB.
The EDPB also has adopted an annex containing a checklist of elements to be amended in BCR documents in the context of Brexit.
The EDPB says that this guidance is without prejudice to the analysis currently undertaken by the EDPB on the consequences of the CJEU judgment DPC v Facebook Ireland and Schrems for BCRs as transfer tools.
