To date, the Hungarian data protection laws completely omitted Binding Corporate Rules (BCR) from the list of instruments guaranteeing adequate level of protection in the context of international data transfers. This will change on 1 October 2015, however.
Due to the recent amendment of the Hungarian Information Act, on 1 October 2015, an authorization procedure will apply for the implementation in and extension of BCRs to Hungary. In this context, the Hungarian Data Protection Agency (the Hungary DPA) has just released guidance (the Guidance) explaining the process to obtain formal authorization to use BCRs in Hungary.
1. Extension of approved BCRs
Any company for which the EU BCR cooperation procedure is closed must file an application asking the Hungary DPA to recognize the use of its BCR in Hungary. In particular, the applicant must:
- complete the BCR application form published by the Hungary DPA and containing the description of the transfers, data categories, purposes and recipients;
- submit the BCRs’ English text with a Hungarian translation;
- provide details / copies of BCR approvals issued by other DPAs;
- pay the BCR approval fee of HUF 266,000.00.
The Guidance explains that the Hungary DPA will make only a formal review of the BCR and the application form without any scrutiny/ comment of the BCRs themselves, as the subject BCRs are already approved by other DPAs.
2. BCR approvals
The Guidance confirms that the Hungary DPA participates in the mutual recognition procedure (MRP) relative to BCR approval procedures pending on 1 October 2015. The Hungary DPA may either act as a lead authority or act as a DPA not involved in the mutual recognition process as a "lead" (or "co-lead"). Under the EU co-operation (one-stop-shop) procedure, the applicant is in contact with the lead authority which liaises with fellow DPAs, who may comment on and ask for amendments to the BCR.
Once the EU co-operation procedure and MRP are closed, the applicant must contact the Hungary DPA if the applicant wants to extends its BCR to Hungary. In that case, the applicant must complete the Hungary DPA’s application form (containing the description of the transfers, data categories, purposes and recipients), translate its BCR into Hungarian, pay the BCR approval fee and submit a completed WP133 application form (in English) to obtain national approval from the Hungary DPA.
The Hungary DPA has 60 days to issue the approval of the BCR. Once the approval procedure is complete, the Hungary DPA will publish on its website the name of each applicant whose BCR authorization request has been approved.