Binding Corporate Rules

The Binding Corporate Rules Processor and Controller Policies establish the approach taken by Verizon Business Group (previously referred to as Verizon Enterprise Solutions) (“Verizon”) in accordance with the GDPR and the UK Data Protection Act 2018.

The lead supervisory authority for Verizon's EU Binding Corporate Rules policies is the Irish Data Protection Commission.  The UK Information Commissioner's Office is the supervisory authority for Verizon's UK Binding Corporate Rules policies.

In July 2020 the CJEU passed judgment on the “Schrems II” case which, amongst other things, requires companies to assess whether transfers of personal data out of the EU are adequately protected in accordance with the EU General Data Protection Regulation and to put in place such additional safeguards they consider necessary.  

In response to these developments, Verizon has undertaken a review of its Binding Corporate Rules (BCRs) and the transfers of personal data that are made under the protection of the BCRs. Verizon evaluated whether additional safeguards are required to protect the personal data when it is transferred out of the EU and UK under the BCRs.

A component of the evaluation involved Verizon’s assessment of the legal regimes in the countries to which it transfers personal data and is using transfer impact assessments to quantify the risks involved in transfers of personal data out of the EU/UK which are protected by the BCRs. Appropriate steps, such as additional safeguards set out by the European Data Protection Board (EDPB), will be taken to minimise any identified risks.

Verizon’s EU BCRs are reviewed annually by the Irish Data Protection Commission (DPC) as part of the established review cycle.  Verizon has acted on guidance from the DPC on changes to Verizon's EU BCR's to take account of the Schrems II ruling and DPC has approved the 2022 update to Verizon's EU BCRs, available below. In its role as the lead supervisory authority for Verizon’s EU BCRs, the DPC acts on behalf of the EU data protection authorities.

Verizon awaits guidance from the ICO on how UK BCRs should be reviewed following the CJEU ruling, as well as EBPB guidance on changes to EU BCRs, and will act accordingly when these guidance notes are issued. Existing provisions in the UK BCRs state that "Verizon will ensure that any transfers of customer personal information under this Policy that it makes to a public authority are not massive, disproportionate or indiscriminate in a manner that would go beyond what is necessary in a democratic society.'' which addresses the core of the issue raised in the CJEU ruling. Verizon is satisfied that the BCRs meet the current requirements.

¹Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, Appendix 2.

²Rule 12A and 12B  in the BCR Processor Policy (2022 version) and Rule 15A and 15B of the BCR Controller Policy (2022 version).

³Rule 12B in the BCR Processor Policy (2021 version) and Rule 15C of the BCR Controller Policy (2021 version).

June 2022

The Binding Corporate Rules Processor Policies (“Policies”) establish the approach taken by Verizon to the protection and management of personal information¹ globally by Verizon group members ("Group Members") when processing² that information on behalf of a third party or another Group Member, and where such personal information originates from Europe or the UK except where your contract states otherwise.

The Policies apply to all personal information originating from Europe and the UK when collected and processed as part of the regular business activities of Verizon in the course of providing services to a third party orto another Group Member (equally referred to as the "customer" in the Policies) Group Members and their employees must comply with and respect the Policies when collecting and processing personal information in their capacity as service providers. The EU Policies relate to personal data originating in the EU and the UK Policies relate to personal data originating in the UK.

The Policies do not replace any specific data protection requirements that might apply to a business area or function.

Download the Full UK Binding Corporate Rules Processor Policy

Download the Full EU Binding Corporate Rules Processor Policy

Download the updated UK Binding Corporate Rules Processor Policy as notified to the ICO, February 2022

¹ Personal information means any information relating to an identified or identifiable natural person in line with the definition of “personal data” in EU Directive 95/46/EC.

² For the purposes of this Policy reference to the 'processing' of personal information is as defined in EU Regulation 2016/679 GDPR and the UK Data Protection Act 2018, and references to 'collection' 'use' and 'transfer' are all elements of the definition of processing.

The Binding Corporate Rules Controller Policies (“Policy”) establish the approach taken by Verizon Business Group (previously referred to as Verizon Enterprise Solutions) ('Verizon') to the protection and management of personal information¹ globally by Verizon group members ("GroupMembers") when processing² that information for their own purposes.

The Policies apply to all personal information that is processed in Europe and the UK (which means that it will also include personal information collected by Group Members outside Europe and sent to Group Members in Europe and the UK ) which is then transferred from Group Members within Europe and the UK to Group Members outside Europe.³ The EU Policies relate to personal data originating in the EU and the UK Policies relate to personal data originating in the UK.

The Policies apply to all such personal information processed by Verizon; (i) in the course of customer and supplier management, and (ii) which relates to employees and contractors.

Group Members must comply with and respect the Policies when collecting and using personal information for their own purposes.

The Policies do not replace any specific data protection requirements that might apply to a business area or function.

Download the full UK Binding Corporate Rules Controller Policy

Download the full EU Binding Corporate Rules Controller Policy

Download the updated UK Binding Corporate Rules Controller Policy as notified to the ICO, February 2022

¹ Personal information means any information relating to an identified or identifiable natural person in line with the definition of “personal data” in EU regulation 2016/679 and the UK Data Protection Act 2018.

² For the purposes of this Policy reference to the 'processing' of personal information is as defined in EU Regulation 2016/279 and the UK Data Protection Act 2018, and references to 'collection' 'use' and 'transfer' are all elements of the definition of processing.

³ For the purpose of this Policy reference to Europe means the EEA and Switzerland.

Below is a list of the participants of Verizon’s Binding Corporate Rules, which also provides the participants’ contacts details. Additional information is available in the International Privacy Centre.

The email address for all participants is emeadataprotection@intl.verizon.com