{"id":3013,"date":"2016-03-22T08:55:00","date_gmt":"2016-03-22T14:55:00","guid":{"rendered":"https:\/\/trustarc.com\/?post_type=resource&p=3013"},"modified":"2024-12-23T14:06:56","modified_gmt":"2024-12-23T20:06:56","slug":"merck-successfully-concludes-first-apec-based-bcr-approval","status":"publish","type":"resource","link":"https:\/\/trustarc.com\/resource\/merck-successfully-concludes-first-apec-based-bcr-approval\/","title":{"rendered":"Merck Successfully Concludes First APEC-based BCR Approval"},"content":{"rendered":"\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t\tArticles<\/strong>\n\t\t\t\t\t\t\t\t\t\t

Merck Successfully Concludes First APEC-based BCR Approval<\/h1>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\n\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

How did Merck successfully achieve the first APEC-based BCR approval?<\/h2>\n

On March 1st<\/sup>, Merck & Co. Inc. formally concluded their Binding Corporate Rules (BCR) approval process with the Belgian Data Protection Authority, becoming the\u00a082nd<\/sup>\u00a0company<\/a>\u00a0to achieve the compliance landmark. But in a global first,\u00a0Merck based its BCR application on its\u00a0APEC Cross Border Privacy Rules (CBPR) certification<\/a><\/strong>.<\/p>\n

This work was facilitated by Merck\u2019s use of a\u00a0common referential\u00a0<\/a>developed by the Article 29 Working Party and APEC\u2019s Data Privacy Sub Group in 2014 to facilitate interoperability between companies seeking certification under both systems.<\/p>\n

In October 2013, TRUSTe certified Merck as the first healthcare company and the second multinational company under the CBPR system.<\/p>\n

\u201cThe value of this approach is that we obtained both CBPR and BCR approvals while maintaining the substance and structure of our existing global privacy program.<\/em><\/strong><\/p>\n

The practical effect is that we gained greater efficiency in how we manage cross-border data transfer and global data processing without adding complexity to how we operate,\u201d<\/em>\u00a0said Hilary Wandall, Chief Privacy Officer.<\/strong><\/p>\n

A faster BCR approval process<\/h2>\n

As was reported in\u00a0a recent review of CBPR benefits<\/a>\u00a0by Information Integrity Solutions, the first phase of Merck\u2019s BCR approval took less than three months. In comparison, the mutual recognition phase took an additional nine months.<\/p>\n

In addition to the time to complete the EU cooperation procedure and transition between the approval phases, the entire approval process was approximately three months faster than the 18-month average.<\/p>\n

Most importantly, because Merck based its BCR approval on its previously-approved CBPR certification, a broadly BCR-compliant global privacy program was already in place.\u00a0As a result, according to Merck\u2019s internal estimates, the total cost of its BCR was approximately 90% less than it would have otherwise been.<\/strong><\/p>\n

Future BCR-CBPR project<\/h3>\n

When\u00a0announcing<\/a>\u00a0the referential\u2019s endorsement in March 2014, Isabelle Falque-Pierrotin, Chairwoman of the French Data Protection Authority (CNIL) and president of the Article 29 Working Party called it a \u201cvery political and symbolic act\u201d for companies seeking to obtain both BCR and CBPR certification.<\/p>\n

FTC Chairwoman Edith Ramirez noted that\u00a0\u201c[i]nteroperability is absolutely critical,\u201d<\/strong><\/em>\u00a0adding that\u00a0\u201c[w]ithout the ability to work across systems, we simply can\u2019t effectively protect the privacy of consumer data, and that\u2019s why as part of the U.S. delegation to the APEC data privacy subgroup, the FTC has been actively involved, along with the Department of Commerce, in developing the CBPRs and also working on this referential.\u201d<\/strong><\/em><\/p>\n

Earlier this month, Article 29\u00a0affirmed<\/a>\u00a0that work on the BCR-CBPR project would be a key component of its 2016-2018 work plan.<\/p>\n

The CBPR system was endorsed by APEC member economies in 2012 for businesses established in the APEC region that collect and transfer personally identifiable information from consumers.<\/p>\n

TrustArc TRUSTe was named the first accountability agent for the system in June 2013.<\/h3>\n

Gain trust and credibility with leading privacy certifications from unbiased experts, backed by technology for unmatched privacy compliance assurance.<\/p>\nAssurance Services Overview<\/span><\/a>\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\t

\n\t\t\t\t
\n\t\t\t\t\tFollow us<\/strong>\n\t\t\t\t\t
\n\t\t\t\t\t\t\"\"<\/a>\n\t\t\t\t\t\t\"\"<\/a>\n\t\t\t\t\t\t\"\"<\/a>\n\t\t\t\t\t\tLink Copied!<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\tKey Topics<\/strong>\n\t\t\t\t\t\t