This week, the Article 29 Working Party (“WP29”) published their joint annual review of Privacy Shield and their long awaited (draft) guidance on Binding Corporate Rules (“BCR’s”).

Privacy Shield: The WP29 have identified a number of important unresolved issues and warn that if no remedy is brought within the next year, they will bring the Privacy Shield adequacy decision to the national courts for them to refer it to the ECJ for a preliminary ruling. The Opion can be foud here.

Binding Corporate Rules: The WP29 has amended their previous working documents, providing a table with the elements and principles to be found in BCR’s in order to reflect the (new) GDPR requirements. Any company with approved BCR’s should bring their BCR’s in line with the GDPR before 25 May 2018 in order to keep their certification. Comments on both controller and processor BCR working documents can be sent to the WP29 by 17 January 2018 at the latest. The content of the draft working documents can be found here

We will provide a more detailed update on the content of both documents next week.