An organization transfers personal data of EU residents to a US-based cloud provider after the invalidation of the EU-US Privacy Shield. Which mechanism provides a valid legal basis for this transfer?
-
A
Relying on the expired Privacy Shield certification
-
B
Using Standard Contractual Clauses (SCCs) approved by the European Commission
-
C
Obtaining a one-time verbal consent from data subjects
-
D
Filing a notice with the US Federal Trade Commission