Free PLC Cross-Border Data Transfers & Compliance Questions and Answers

Question 1

What mechanism is commonly used under GDPR for lawful data transfers outside the EU?

Accepted Answer

Standard Contractual Clauses

Answer

Standard Contractual Clauses (SCCs) are pre-approved model clauses provided by the European Commission that organizations can use to legally transfer personal data from the EU/EEA to countries not deemed to offer adequate data protection. They impose contractual obligations on both the data exporter and importer to ensure appropriate safeguards for the transferred data. SCCs are a widely used mechanism to comply with GDPR's requirements for international data transfers.

Question 2

What did the Schrems II ruling invalidate?

Accepted Answer

Privacy Shield

Answer

The Schrems II ruling by the Court of Justice of the European Union (CJEU) invalidated the EU-U.S. Privacy Shield framework. The court found that the protections offered by the Privacy Shield for EU data subjects' data transferred to the U.S. were insufficient, particularly concerning U.S. government surveillance programs. This decision significantly impacted transatlantic data transfers and emphasized the need for robust safeguards.

Question 3

Which entity evaluates whether a non-EU country provides adequate protection?

Accepted Answer

European Commission

Answer

The European Commission is the executive arm of the European Union and is responsible for assessing whether a non-EU country provides an "adequate level of data protection." An adequacy decision means that personal data can flow from the EU/EEA to that third country without needing additional safeguards. This assessment considers the country's domestic law, international commitments, and the existence of independent supervisory authorities.

Question 4

Which is a lawful basis for data transfer under GDPR when no adequacy decision exists?

Accepted Answer

Binding Corporate Rules

Answer

Binding Corporate Rules (BCRs) are internal codes of conduct approved by data protection authorities that allow multinational companies to transfer personal data internationally within their corporate group. They provide a robust legal framework for data transfers to countries without an adequacy decision, ensuring all entities within the group adhere to the same high standards of data protection. BCRs are a complex but effective mechanism for intra-group transfers.

Question 5

What must organizations do before transferring data using SCCs?

Accepted Answer

Conduct a Transfer Impact Assessment

Answer

Following the Schrems II ruling, organizations using Standard Contractual Clauses (SCCs) are now required to conduct a Transfer Impact Assessment (TIA). This assessment evaluates whether the laws and practices of the recipient country might undermine the protections guaranteed by the SCCs, particularly regarding government access to data. If risks are identified, supplementary measures must be implemented to ensure an equivalent level of protection for the transferred data.

PLC - Privacy Law Certification Practice Test

PLC - Privacy Law Certification Practice Test

Free PLC Cross-Border Data Transfers & Compliance Questions and Answers