As regras vinculativas para empresas (binding corporate rules) no novo Regulamento Geral de Proteção de Dados

• Autor(a) principal: Guerreiro, André Soares
• Data de Publicação: 2018
• Tipo de documento: Dissertação
• Idioma: por
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/10362/51015
• topic: Proteção de Dados Pessoais; Regras Vinculativas Aplicáveis às Empresas; Fluxos Internacionais de Dados Pessoais; Regulamento Geral de Proteção de Dados; Princípio da Responsabilidade; União Europeia; Data Protection; Binding Corporate Rules; International Data Transfers; General Data Protection Regulation; Accountability Principle; European Union; Direito

The constant and unpredictable changes in the technological landscape have determined that the list of potential dangers pertaining to the use of personal data of the data subject is ever-increasing. Furthermore, the personal data of citizens constitutes a de facto currency in the digital environment, with the companies shaping their business models with personal data as its core. The Directive 95/46/CE, for various reasons outlined in this thesis, can no longer be considered the appropriate normative instrument to meet the challenges emerging in the data protection field. The functional inadequacy of the Directive was particularly apparent in the international data transfers field: the prohibition of data transfers to a third country without an "adequate" level of protection, and without establishing appropriate alternative mechanisms, jeopardizes the principles and aims underlying the existence of the Directive. It is in this background that the new General Data Protection Regulation came into effect as of 25 May 2018, being one of its latent aims is the reduction of the chasm between normative reality and data protection on the field. One of the relevant legislative innovations of the GDPR regarding massive and systematic transfers of personal data to third countries is the legal recognition of the binding corporate rules. The existence of such rules, subject to approval by the competent control authority, allow the transfer of personal data between the undertakings of a corporate group. In this thesis it is sought to understand why and how the binding corporate rules can be considered a mechanism that guarantees the material protection of the personal data of the data subjects, materializing the relevant purposes of the current legislation on the data protection field. In this sense, it is studied the atributtes of this mechanism that qualifies it as a co-regulatory effort, as well as a relevant factor for compliance with the "accountability principle" established in the Regulation.