First Data wins BCR approval by mutual recognition

First Data (a leading e-commerce and payment card processor) received approval from the UK’s ICO on 14th November for its Binding Corporate Rules application, the 11th to be approved in the UK, and the first to have been started under the Mutual Recognition Procedure. This approval will enable the company to export personal data freely outside the European Economic Area.

This was a complex process as it involves a company which processes over 50 billion transactions every year worldwide and the approval extends to 18 countries in the European Union. The Mutual Recognition Procedure means that two other Data Protection Authorities (DPAs), in this case France and Ireland, review the application in detail in addition to the lead authority. Other Data Protection Authorities can make comments if they do so within a short time frame. This technique was adopted to ensure that no application was delayed while it was reviewed by many countries’ national DPAs.