Amidst the headlines about standard clauses post-Schrems II, there are a number of other practical issues to remember about international data transfers. In particular, if you are relying on binding corporate rules where your chosen supervisory authority is the ICO in the UK. The EDPB has published an Information Note reminding controllers that before the end of the transition period, they need to have identified and chosen a new EU supervisory authority AND to have obtained an approval decision from that new authority in respect of the BCRs before the end of the transition. So don’t delay. Supervisory authorities are not renowned for their administrative speed.

The EDPB rightly notes that the new lead authority is entitled to require changes to be made to the BCRs, regardless of ICO approval, but clearly one would hope that there is sufficient uniformity of approach that such changes will be rare. (Perhaps a triumph of hope over experience.)

And the other note of caution? The Information Note’s very first line is that it is issued without prejudice to the ongoing consideration of the consequences of Schrems II for BCRs…