CDPSE Cross-Border Data Transfers 2

Question 1

What did the Court of Justice of the EU (CJEU) determine in the Schrems II ruling regarding Privacy Shield?

Accepted Answer

Privacy Shield was invalidated due to inadequate US surveillance law protections

Answer

The CJEU invalidated Privacy Shield in 2020 because US surveillance laws did not provide EU residents with effective remedies equivalent to EU rights.

Question 2

When using SCCs for a data transfer, what additional step may be required following the Schrems II ruling?

Accepted Answer

Conducting a Transfer Impact Assessment to verify the SCCs remain effective

Answer

Post-Schrems II, organizations must conduct a TIA to determine whether local laws in the destination country could nullify SCC protections in practice.

Question 3

Which derogation under GDPR Article 49 permits a cross-border data transfer without an adequacy decision or appropriate safeguards?

Accepted Answer

Vital interests of the data subject

Answer

Article 49 allows transfers where necessary to protect the vital interests of the data subject or another person when the data subject cannot give consent, among other limited derogations.

Question 4

A cloud vendor stores EU customer data on US servers. Which document MUST exist to make this transfer lawful under GDPR?

Accepted Answer

A valid data transfer mechanism such as SCCs incorporated in the Data Processing Agreement

Answer

A valid transfer mechanism—most commonly SCCs incorporated into a DPA—is legally required for any transfer of EU personal data to a country lacking an adequacy decision.

Question 5

What is the role of supplementary measures in cross-border data transfers under SCCs?

Accepted Answer

To provide additional technical or contractual protections when the destination country's laws may undermine SCC guarantees

Answer

Supplementary measures—such as encryption, pseudonymization, or additional contractual commitments—strengthen SCC protections where destination country laws pose elevated risks.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Cross-Border Data Transfers 2