Binding Corporate Rules in the Light of the GDPR and the KVKK

2021Murat Volkan Dülger, Cansu Ceren KahramanArticle

Abstract

This work was written in Turkish. The summary on this page is a translation; the citation gives the original title in parentheses.

Under the European Union’s data protection rules, when group companies located in different countries shared data among themselves, the obligations under the personal data protection legislation of more than one country had to be fulfilled at the same time. Because multinational companies share data regularly in the course of their business processes, they began to look for easier ways of meeting these obligations. The solution they found was to draw up an almost worldwide data privacy policy that would cover the obligations in all the countries in which they shared data. For the companies that had drawn up their policies, one more step remained before everything went as they wished: having the Data Protection Authorities (DPO) accept the policies they had prepared.

To that end they began to put pressure on the data protection authorities. Once this pressure produced results, personal data began to be shared under company privacy policies that appeared to contain adequate safeguards (but in fact without adequate safeguards being taken). “Binding Corporate Rules” were created in order to prevent this. Today, although almost every company in the European Economic Area has a personal data protection policy, many data protection authorities state that companies’ information systems are inadequate for full protection.