The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63, provided that they:

(a) Are legally binding and apply to and are enforced by every member concerned of the group of undertakings, or group of enterprises engaged in a joint economic activity, including their employees;

(b) Expressly confer enforceable rights on data subjects with regard to the processing of their personal data; and

(c) Fulfil the requirements laid down in paragraph 2.