GDPR GDPR International Data Transfers

Question 1

Which GDPR mechanism allows personal data to be transferred to a third country that the European Commission has deemed to provide adequate protection?

Accepted Answer

Adequacy Decision

Answer

An adequacy decision by the European Commission certifies that a third country offers a level of data protection essentially equivalent to the EU's, allowing free data flows.

Question 2

What are Standard Contractual Clauses (SCCs) under GDPR?

Accepted Answer

Pre-approved contractual templates adopted by the European Commission to safeguard cross-border data flows

Answer

SCCs are standardized contract clauses pre-approved by the European Commission that organizations can adopt to ensure adequate safeguards when transferring data outside the EEA.

Question 3

Under GDPR Article 47, Binding Corporate Rules (BCRs) must be approved by:

Accepted Answer

The relevant national supervisory authority and recognized by other EEA authorities

Answer

BCRs must be approved by the lead supervisory authority of the organization and are then mutually recognized by other EEA supervisory authorities through a consistency mechanism.

Question 4

Following the Schrems II ruling (C-311/18), what happened to the EU-US Privacy Shield?

Accepted Answer

It was invalidated by the Court of Justice of the EU

Answer

The CJEU invalidated the EU-US Privacy Shield in July 2020, finding that US surveillance laws did not provide equivalent protection to EU data subjects' rights.

Question 5

What supplementary measure might organizations adopt when SCCs alone are insufficient after a Schrems II transfer impact assessment?

Accepted Answer

Applying end-to-end encryption so that data is unintelligible to the importing country's authorities

Answer

Encryption that renders data unintelligible to third-country authorities is a recognized technical supplementary measure that can shore up inadequate SCC protections.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR GDPR International Data Transfers