CIPP/A: Certified Information Privacy Professional/AsiaDemo

By IAPP · Question Mode

QuestionQ6

Common Themes

Under the General Data Protection Regulation (GDPR), European Union member states can be permitted to transfer personal data to the United States in certain circumstances.

Which of the following could NOT serve as a legitimate means of doing so?

  • A A consent derogation.
  • B A certification mechanism.
  • C Privacy Shield.
  • D Ad-hoc contractual clauses.
Explanation

A consent-based derogation, a certification mechanism with the required enforceable commitments, and authorised ad-hoc contractual clauses can support particular GDPR transfers. The EU–U.S. Privacy Shield was invalidated in Schrems II and has been replaced by the separate EU–U.S. Data Privacy Framework; therefore, Privacy Shield cannot be used as a valid transfer mechanism.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!