Linklaters has advised Hyatt Hotels Corporation on its authorisation to transfer employee and guest data within the Hyatt Hotels & Resorts business worldwide.
The authorisation, by the UK’s Information Commissioner, was granted on the basis of a set of binding corporate rules or "BCRs". The application was the first to be completed entirely under the EU’s new mutual recognition procedure. Once a set of simple administrative steps are taken, Hyatt will receive automatic approvals in a number of other EU states. The mutual recognition procedure significantly speeds up the BCR application process; Hyatt’s application, which forms part of a compliance programme in 45 countries, took just 12 months from start to finish, significantly less than earlier applications conducted under the old "co-operation" procedure. The recent streamlining of the BCR application documents should now reduce that time still further.
BCRs are a means by which organisations can legitimise international transfer of personal data under the Data Protection Directive. Under Directive 95/46 personal data (i.e. any information regarding an identified or identifiable individual) cannot be transferred to third countries that do not ensure an adequate level of protection of personal data, even when such transfer takes place within a group of companies. Although not suitable for all organisations, BCRs are the most flexible means for multinationals to ensure that their intra-group transfers meet that "adequate level of protection" standard. BCRs requires that the group draft internal compliance rules and have these approved by the data protection authorities.
Linklaters TMT partner, Richard Cumbley, who led the Linklaters team, commented:
"The authorisation is a great achievement for Hyatt and demonstrates their commitment to protect the personal information of their guests and employees. It also shows that Binding Corporate Rules are now becoming a credible, quick and achievable means to legitimise international transfers of personal data. The mutual recognition procedure is a significant advance on the previous co-operation approach, and should mean new approvals will take a matter of months. We are working on a number of other binding corporate rules applications and expect further authorisations to be issued in the near future."
For further information, please contact:
Rupert Winlaw on (44 20) 7456 3219 / rupert.winlaw@linklaters.com
Sarah Peters on (44 20) 7456 2153 / sarah.peters@linklaters.com
