Guidelines and basic content for the international transfer of personal data among companies of the same business group
The Bureau of Public Information Access issued Resolution 159/2018 which was published in the Official Gazette on December 7, 2018. The resolution approves the “Guidelines and basic content for Binding Corporate Rules” (“BCRs”), setting forth the basic rules governing the international transfer of personal data among companies of the same business group.
The Bureau of Public Information Access established the conditions that BCRs shall comply with in order to ensure the legality of the international transfer of personal data to countries that, according to our legal system, lack adequate legislation regarding personal data processing and protection. The BCRs shall be binding on every company within the same business group as well as on their employees, subcontractors and third party beneficiaries.
BCRs shall include data protection principles such as the legality conditions for a lawful processing, specific protections for sensitive matters, data owners’ rights, a joint liability provision applicable to all companies participating in the data treatment or processing and a provision establishing the application of the local law of the data owners, among others.
Those companies that effect an intragroup transfer of personal data to countries that do not provide adequate levels of protection under BCRs which differ from the guidelines set forth by this resolution, shall file the BCRs with the Bureau of Public Information Access for control and approval within thirty (30) days as from the date in which the transfer is performed.
For further information, do not hesitate to contact Adrián Furman, Francisco Zappa or Milagros González Vizcaino.
Click here to print this publication.