Summary

  • The EDPB found no Article 47 GDPR concern requiring the French draft decision on Michelin Group’s controller Binding Corporate Rules to be changed; the French lead authority may adopt its draft as submitted.
  • That opinion does not amount to final CNIL approval and does not clear any particular transfer. The GDPR exporter still has to assess the circumstances and protection available for each transfer.

Analysis

Opinion 24/2026 is a procedural milestone, not a blanket transfer permit. The French Supervisory Authority sent its draft decision to the European Data Protection Board under the GDPR consistency mechanism. The Board reviewed whether the proposed controller Binding Corporate Rules (BCR-C) contained the elements required by Article 47 and the relevant EDPB guidance. It reported no concerns that needed to be resolved and said the draft decision could be adopted as submitted.

The distinction between the Board’s opinion and the authority’s decision matters. The EDPB does not issue the national approval. The French lead authority must respond to the Board within two weeks of receiving the opinion and communicate its final decision for the consistency-mechanism register. The public record reviewed for this report contains the opinion dated 13 October; it does not establish that a later final decision has been issued.

The draft framework concerns transfers from an EEA Michelin group company acting as controller to a Michelin group company outside the EEA acting as controller or processor, as well as onward transfers to other group entities outside the EEA. The opinion names categories of people whose data may be covered, including employees and former employees, contractors, clients, end-users, stakeholders and suppliers. It does not identify destination countries, volumes, datasets or operating routes, and the underlying draft rules are not attached to the public opinion.

That limit is central to the governance question. Binding Corporate Rules set enforceable protections across a corporate group and can support recurring intra-group transfers. They do not replace the exporter’s transfer-specific assessment. The EDPB reiterates that the exporter, with the importer’s assistance where needed, must examine whether the law of the destination country allows the promised protection to work in practice. If it does not, the exporter must consider supplementary measures. A group rule approval cannot validate a transfer for which essentially equivalent protection cannot be ensured.

The result is a division of responsibility: the supervisory authority tests the group framework, while the exporter remains accountable for the circumstances of each route. The opinion identifies that boundary; it does not show whether any particular Michelin transfer passes or fails it.

Sources