CIPP/E: Certified Information Privacy Professional/EuropeDemo

By IAPP · Question Mode

QuestionQ205

Compliance with European Data Protection Law and Regulation

To comply with the GDPR and the EU Court of Justice’s Schrems II decision, the European Commission issued the provisions commonly called the new standard contractual clauses (SCCs). As a result, businesses must do all of the following EXCEPT?

  • A Consider the new optional docking clause, which expressly permits adding new parties to the SCCs.
  • B Migrate all contracts entered into before September 27, 2021, that use the old SCCs to the new SCCs by December 27, 2022.
  • C Take steps to flow down the new SCCs to relevant parts of their supply chain using the new SCCs as of September 27, 2021, if the business is a data importer.
  • D Implement the new SCCs in the U.K. following Brexit, as the U.K. Information Commissioner's Office does not have the authority to publish its own set of SCCs.
Explanation

The UK ICO issued its own transfer-contract tools after Brexit: the International Data Transfer Agreement (IDTA) and the International Data Transfer Addendum. EU SCCs are not valid by themselves for restricted transfers under the UK GDPR; the Addendum enables their use in that context. Therefore, it is incorrect to say that the ICO lacked authority to publish its own SCC-type clauses.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!