The Tetra Pak group has obtained the approval of the binding corporate regulation by the Swedish Data Protection Inspectorate. The aim of the binding corporate legislation was to facilitate team groups the personal data transfer to societies out of the EU/EEA.

The Binding Corporate Rules (BCR) are rules that the multinational companies can develop in order to regulate their personal data process and guarantee appropriate protection measures when personal data are transferred to societies inside their own group but based out of the EU/EEA. The Binding Corporate Rules must be approved by the European Data Protection Supervisor.

For the first time, the Swedish Data Protection Inspectorate has, like a Data Protection Authority, approved Binding Corporate Rules in compliance with the General Data Protection Regulation of the UE, GDPR.
The approval was preceded by a wide review process.

Among the other things, the application and the proposal of binding corporate rules of the Tetra Pak Group were considered by the Swedish Data Protection Inspectorate joined with the Data Protection Authorities. In addition, it has also commented on the European Data Protection Board (EDPB), which includes all the Data Protection Authorities all over Europe/EEA.

The General Data Protection Regulation offers to all the EU member states the same personal data and privacy protection. This is the same also for EEA countries. So, personal data can be also transferred in a free way in this area without restrictions.

The rules which guarantee the protection of personal integrity during the personal data process do not exist in all the countries out of the EU/EEA, the so called third countries. The ordinance on personal data protection includes also legislations on conditions to whom is permitted to transfer personal data to third countries.

The Binding Corporate Rules are a usable tool.

– The approval of their Binding Corporate Rules makes it easier for multifunctional society guarantee the compliance with the personal data protection ordinance when personal data are shared to group companies out of the EU/EEA, affirmed Albin Brunskog, lawyer at the Personal Data Inspectorate Office.

edpb_opinion202025_bcr-c_tetrapak_en     SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DELLA SVEZIA