Locations
European law firm Fieldfisher has advised Align Technology, Inc. on its successful application for Binding Corporate Rules (BCRs) for both the controller and processor sides of its business.
San Jose-headquartered Align is a NASDAQ listed company specialising in modern clear aligner orthodontics that designs, manufactures and markets the Invisalign® system, which provides dental professionals with a range of teeth straightening options for adults and teenagers.
Align’s application was led through the Dutch data protection authority and closed on 3 June 2014. To date, only 53 entities have had BCRs approved, and Align is one of the very first ever to secure "dual" controller and processor BCRs.
The European Union’s Data Protection Directive (95/46/EC) only permits the transfer of personal data to non-European Union countries under certain defined standards. BCRs are an advantageous cross-border transfer mechanism as they provide a harmonised solution to the issue of personal data protection within companies. BCRs also reduce risks arising from third-country data transfers, provide strong frameworks for employees' management of personal data, and place data protection at the centre of a company's business practices.
Originally a solution only for data controlling businesses looking to transfer their own internal data from the EU to international destinations, BCRs have since 2012 also been recognised as a solution for service providers (or "data processors") wanting to export their customers' data internationally. This, combined with the current regulatory pressure facing other solutions like the EU-US Safe Harbor framework, has resulted in more businesses turning to BCRs for their international data transfers.
The Fieldfisher team advising Align was led by Phil Lee, Head of Fieldfisher's Palo Alto Office and a Partner in its Privacy and Information Law Group. Phil Lee said: "In supporting Align throughout its 'dual' controller and processor BCRs application, we were very conscious of the fact that we were breaking new legal ground. The success of this dual application highlights that BCRs have really come of age as a solution for multinational businesses that want to adopt a global data governance program not only for their own data, but also for their customers' data. The successful closure of this application is a testament to Align's strong commitment to privacy and also to the strength and depth of expertise in the Fieldfisher Privacy and Information Law team."
Align Technology's privacy counsel K Royal added: "Undertaking the BCR process was initially quite daunting, but having the right partner in Fieldfisher really made a difference. From the early decisions through the final closure, it was clear we had made the right choice not only in choosing to implement BCRs, but in choosing this firm to guide us through the process."