Binding Corporate Rules for Cross-border Data Flows in GDPR Era

Abstract

Binding Corporate Rules (‘BCRs’) are the internal data protection policies of multinational companies (‘MNCs’) that do business both within and outside the EEA. This paper addresses the strengths and weaknesses of BCR regulation in the approval process, content requirements and implementation mechanisms, and propose recommendations to enhance the uptake and effectiveness of BCRs. This paper primarily takes the theoretical legal research method, focusing on analyzing the related EU laws, working documents issued by A29WP and EDPB, and make reference to related legal literatures. Empirical research is adopted to compare some statements in the publicly available BCRs or BCR-relation information of several MNCs.