UK Permits General Electric To Export Data Under Corporate Rules

by Robin Pilgrim, LawAndTax-News.com, London

10 January 2006

The UK's Information Commissioner has authorised General Electric to transfer personal information outside the European Economic Area under the company's own binding rules, rather than relying on the EU's 'safe harbour' provisions.

The 8th Principle of the Data Protection Act 1998 (which incorporated the Data Protection Directive into UK law) prohibits the transfer of personal data to a country or territory outside of the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

However the law permits a derogation where the Information Commissioner has authorised the transfer 'as being made in such a manner as to ensure adequate safeguards for the rights and freedoms of data subjects'. The 'binding corporate rules' applied by GE and approved by the Commissioner fall within the scope of this derogation.

Announced the Commissioner:

' For the first time the Information Commissioner has authorised the transfer of employees’ information outside the European Economic Area using binding corporate rules. Using procedures, known as binding corporate rules, General
Electric is now able to share information on its employees within the multinational company. The authorisation applies to information that comes within the Information Commissioner’s jurisdiction, namely data generally held in the UK.

' The Information Commissioner is satisfied that General Electric has the necessary procedures in place and that there is an adequate level of protection for individuals’ rights and freedoms across the group of companies.'

Boris Wojtan, Solicitor, said: “General Electric should be commended for its commitment to the concept of binding corporate rules and its responsible approach to data protection.”

Other European data protection authorities are said to be considering the adequacy of General Electric’s binding corporate rules and may in time give the company equivalent permissions covering data held outside the UK.

Recommended