Attorney: Hungary DPA issues Guidance on BCR based data transfers
To date, the Hungarian data protection laws completely omitted Binding Corporate Rules (BCR) from the list of instruments guaranteeing adequate level of protection in the context of international data transfers, however, this is changing as of October 1, Ádám Liber, Attorney at Law of Baker & McKenzie Kajtár Takács Hegymegi-Barakonyi, told the Budapest Business Journal.
“Due to the recent amendment of the Hungarian Information Act, on 1 October 2015, an authorization procedure will apply for the implementation in and extension of BCRs to Hungary,” Liber, says. “In this context, the Hungarian Data Protection Agency (the Hungary DPA) has just released guidance (the Guidance) explaining the process to obtain formal authorization to use BCRs in Hungary,” Liber adds.
1. Extension of approved BCRs
As Liber explains, any company for which the EU BCR cooperation procedure is closed must file an application asking the Hungary DPA to recognize the use of its BCR in Hungary. In particular, the applicant must:
• complete the BCR application form published by the Hungary DPA and containing the description of the transfers, data categories, purposes and recipients;
• submit the BCRs’ English text with a Hungarian translation;
• provide details / copies of BCR approvals issued by other DPAs;
• pay the BCR approval fee of HUF 266,000.00.
“The Guidance explains that the Hungary DPA will make only a formal review of the BCR and the application form without any scrutiny/ comment of the BCRs themselves, as the subject BCRs are already approved by other DPAs,” the professional notes.
2. BCR approvals
“The Guidance confirms that the Hungary DPA participates in the mutual recognition procedure (MRP) relative to BCR approval procedures pending on 1 October 2015. The Hungary DPA may either act as a lead authority or act as a DPA not involved in the mutual recognition process as a "lead" (or "colead"). Under the EU co-operation (one-stop-shop) procedure, the applicant is in contact with the lead authority which liaises with fellow DPAs, who may comment on and ask for amendments to the BCR,” Liber says.
“Once the EU co-operation procedure and MRP are closed, the applicant must contact the Hungary DPA if the applicant wants to extends its BCR to Hungary,” Liber adds. “In that case, the applicant must complete the Hungary DPA’s application form (containing the description of the transfers, data categories, purposes and recipients), translate its BCR into Hungarian, pay the BCR approval fee and submit a completed WP133 application form (in English) to obtain national approval from the Hungary DPA,” the attorney notes.
“The Hungary DPA has 60 days to issue the approval of the BCR. Once the approval procedure is complete, the Hungary DPA will publish on its website the name of each applicant whose BCR authorization request has been approved,” Liber adds.
Kajtár Takács Hegymegi-Barakonyi Baker & McKenzie Legal Office is the member of Baker & McKenzie International.
SUPPORT THE BUDAPEST BUSINESS JOURNAL
Producing journalism that is worthy of the name is a costly business. For 27 years, the publishers, editors and reporters of the Budapest Business Journal have striven to bring you business news that works, information that you can trust, that is factual, accurate and presented without fear or favor.
Newspaper organizations across the globe have struggled to find a business model that allows them to continue to excel, without compromising their ability to perform. Most recently, some have experimented with the idea of involving their most important stakeholders, their readers.
We would like to offer that same opportunity to our readers. We would like to invite you to help us deliver the quality business journalism you require. Hit our Support the BBJ button and you can choose the how much and how often you send us your contributions.