Cross-Border Data Transfers & Compliance Flashcards

According to EDPB Recommendations 01/2020, encryption fails as a supplementary measure in which scenario?

Answer: A cloud provider in a third country needs the data in the clear to process it and could be compelled by authorities

The EDPB found no effective technical measure when an importer subject to problematic surveillance law must access unencrypted data.

Which Article 46 GDPR safeguard requires specific authorization from the competent supervisory authority?

Answer: Ad hoc contractual clauses negotiated between the parties

Under Article 46(3), bespoke contractual clauses need SA authorization, unlike the pre-approved tools in Article 46(2).

Clause 7 of the 2021 SCCs is an optional 'docking clause.' What does it allow?

Answer: New parties to join the existing SCC agreement later

The docking clause lets more exporters or importers accede to the SCCs by completing the appendix.

A Quebec company plans to send personal information to a service provider outside Quebec. What does Law 25 require first?

Answer: A privacy impact assessment showing the information will get adequate protection

Since September 2023, Law 25 requires a PIA before personal information is communicated outside Quebec, considering the destination's legal framework.

Which EU-U.S. transfer framework did the CJEU invalidate in its 2015 Schrems I ruling?

Answer: Safe Harbor

Schrems I (C-362/14) struck down the 2000 Safe Harbor decision, which Privacy Shield later replaced.

Under Japan's APPI, which is NOT a valid basis for transferring personal data to a third party in a foreign country?

Answer: The data is anonymized only by removing names while keeping ID numbers

Removing names while keeping identifiers like ID numbers does not anonymize data, so APPI transfer rules still apply.

A U.S. company that self-certified under the DPF decides to leave the program. What must it do with personal data it received while participating?

Answer: Keep applying the DPF Principles to it, or return or delete it, and affirm this annually if it keeps the data

Departing organizations must keep protecting data received under the DPF or return or delete it, with annual affirmation for any data kept.