EDPB Opinion on Dutch Authority's IBM Group BCR Draft Decision

The European Data Protection Board (EDPB) has published its opinion on a draft decision by the Dutch Supervisory Authority regarding the Binding Corporate Rules (BCRs) of the IBM Group. The opinion, issued under Article 64 of the GDPR, focuses on the international transfer of personal data by IBM and the assessment of its BCRs by the Dutch authority. This document signifies a critical step in the review process for IBM's BCRs, which are intended to legitimize cross-border data flows within the company.

Compliance officers should note that this opinion provides guidance on the adequacy of IBM's proposed data transfer mechanisms. While the EDPB's opinion is non-binding on the national supervisory authority, it carries significant weight in shaping the final decision. Companies utilizing or considering BCRs should review the EDPB's assessment for insights into supervisory expectations regarding international data transfers and the robustness of corporate compliance programs.