Discuss IAPP CIPP/E Exam Topic 6 Question 99

The European Data Protection Board (EDPB) recommends measures to supplement transfer tools, in order to ensure compliance with the European Union (EU) level of personal data protection. According to these recommendations, what additional actions should be taken when a transfer to a third country is based upon an adequacy decision?

AAdopt a supplementary data transfer mechanism.

BMonitor the ongoing validity of the data transfer mechanism.

CAdopt technical, contractual or organizational supplementary measures.

DMonitor changes in the law or practice of the third country that would tower the level of protection of personal data

Suggested Answer: D

An adequacy decision is a decision adopted by the European Commission, which determines that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection of personal data1.This means that the third country or organisation provides a level of protection that is essentially equivalent to that guaranteed within the European Union (EU), taking into account its domestic law and international commitments, as well as the respect for the rule of law, human rights and fundamental freedoms, relevant legislation, and the existence and effective functioning of independent supervisory authorities1.An adequacy decision is one of the transfer tools that can be used to transfer personal data to a third country or organisation without requiring any further authorisation1.However, an adequacy decision is not permanent and can be amended, suspended or repealed by the Commission at any time, if the conditions are no longer met1.Therefore, according to the recommendations of the European Data Protection Board (EDPB), the additional action that should be taken when a transfer to a third country is based upon an adequacy decision is to monitor changes in the law or practice of the third country that would lower the level of protection of personal data2.This means that the data exporter should stay informed of any developments in the third country or organisation that could affect the validity of the adequacy decision, and take appropriate measures if the level of protection is no longer adequate2.The data exporter should also cooperate with the competent supervisory authority and inform it of any issues that may affect the compliance with the adequacy decision2. Therefore, option D is the correct answer.Reference:Art. 45 GDPR -- Transfers on the basis of an adequacy decision,Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data

Get Premium CIPP/E Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

36 comments · newest first

Jerry 11 months ago

D is important, laws change all the time!

Mike 11 months ago

Wait, can we really trust adequacy decisions?

Margurite 12 months ago

C is definitely a must-have too.

Maybelle 12 months ago

Totally agree, monitoring is key!

Luisa 1 year ago

B seems crucial for ongoing compliance.

Odette 1 year ago

I’m a bit confused about whether we need to adopt a new mechanism or just monitor what's already in place. I guess it could be a mix of B and D?

Jeanice 1 year ago

I feel like we practiced a question similar to this, and I think monitoring changes in the law of the third country is really important, which makes me think option D is relevant.

Barbra 1 year ago

I’m not entirely sure, but I think adopting supplementary measures is crucial, especially if the adequacy decision could change. That makes me lean towards option C.

Jennie 1 year ago

I remember we discussed the importance of monitoring the ongoing validity of data transfer mechanisms, so I think option B might be key here.

Eden 1 year ago

I'm a bit confused by this question. The EDPB recommendations are not something I'm super familiar with, so I'm not sure I fully understand the context here. I'll have to make an educated guess, but I'm not feeling super confident about it.

Theodora 1 year ago

Okay, I think I've got this. The key is that the transfer is based on an adequacy decision, so the EDPB wants additional safeguards beyond just the adequacy decision itself. Option C seems to cover that by requiring supplementary measures, so I'll go with that.

Brianne 1 year ago

Hmm, this is a tricky one. I'm not entirely sure about the specifics of the EDPB recommendations and what exactly they require in this scenario. I'll need to re-read the question carefully and think through the options.

Leonora 1 year ago

I'm pretty confident about this one. The EDPB recommendations clearly state that additional actions should be taken when a transfer is based on an adequacy decision, and the correct answer is C - adopting technical, contractual or organizational supplementary measures.

Herman 2 years ago

Wait, there's a GDPB too? I thought the GDPR was complicated enough!

Kandis 2 years ago

↳ replying to Herman

It's important to stay informed and take necessary actions to ensure compliance with data protection regulations.

Rochell 2 years ago

↳ replying to Herman

One of the additional actions recommended by EDPB is to adopt a supplementary data transfer mechanism.

Blossom 2 years ago

↳ replying to Herman

I know, it can be overwhelming to keep up with all the regulations and recommendations.

Amber 2 years ago

↳ replying to Herman

Yes, there is also the European Data Protection Board (EDPB) that provides recommendations for data transfers.

Josphine 2 years ago

I believe option D) Monitor changes in the law or practice of the third country is also crucial to maintain compliance.

Harrison 2 years ago

I'm just glad we don't have to deal with the GDPR on Pluto. The third country there is really lax about data protection.

Clorinda 2 years ago

↳ replying to Harrison

D) Monitor changes in the law or practice of the third country that would lower the level of protection of personal data

Noel 2 years ago

↳ replying to Harrison

C) Adopt technical, contractual or organizational supplementary measures.

Eura 2 years ago

↳ replying to Harrison

B) Monitor the ongoing validity of the data transfer mechanism.

Ramonita 2 years ago

↳ replying to Harrison

A) Adopt a supplementary data transfer mechanism.

Lenna 2 years ago

B is also a good option. Regularly checking the validity of the transfer mechanism is a smart move.

Denae 2 years ago

↳ replying to Lenna

C) Adopt technical, contractual or organizational supplementary measures.

Mirta 2 years ago

↳ replying to Lenna

B) Monitor the ongoing validity of the data transfer mechanism.

Vincent 2 years ago

↳ replying to Lenna

A) Adopt a supplementary data transfer mechanism.

Belen 2 years ago

I agree with Vanda. It's important to take additional measures to ensure data protection.

Omer 2 years ago

D is important too. Monitoring changes in the third country's laws is crucial to ensure the level of protection remains adequate.

Vanda 2 years ago

I think the answer is C) Adopt technical, contractual or organizational supplementary measures.

Evan 2 years ago

C is the correct answer. The EDPB clearly states that supplementary measures should be taken in addition to the adequacy decision.

Azalee 2 years ago

↳ replying to Evan

D) Monitor changes in the law or practice of the third country that would lower the level of protection of personal data

Ernie 2 years ago

↳ replying to Evan

C) Adopt technical, contractual or organizational supplementary measures.

Rozella 2 years ago

↳ replying to Evan

B) Monitor the ongoing validity of the data transfer mechanism.

Miss 2 years ago

↳ replying to Evan

A) Adopt a supplementary data transfer mechanism.

IAPP CIPP/E Exam - Topic 6 Question 99 Discussion