Please use the following to answer the next question:
Jane starts her new role as a Data Protection Officer (DPO) at a Malta-based
company that allows anyone to buy and sell cryptocurrencies via its online platform.
The company stores and processes the personal data of its customers in a
dedicated data center located in Malta (EU).
People wishing to trade cryptocurrencies are required to open an online account on
the platform. They then must successfully pass a Know Your Customer (KYC) due
diligence procedure aimed at preventing money laundering and ensuring
compliance with applicable financial regulations.
The non-European customers are also required to waive all their GDPR rights by
reading a disclaimer written in bold and ticking a checkbox on a separate page in
order to get their account approved on the platform.
All customers must likewise accept the terms of service of the platform. The terms
customer fails the KYC process, its KYC data will be automatically shared with the
national anti-money laundering agency.
The KYC procedure requires customers to answer many questions, including
whether they have any criminal convictions, whether they use recreational drugs or
have problems with alcohol, and whether they have a terminal illness. While
providing this data, customers see a conspicuous message saying that this data is
meant only to prevent fraud and account takeover, and will be never shared with
private third parties.
The company regularly conducts external security testing of its online systems by
independent cybersecurity companies from the EU. At the final stage of testing, the
company provides cybersecurity assessors with access to its central database to
review security permissions, roles and policies. Personal data in the database is
encrypted; however, cybersecurity assessors usually have access to the decryption
keys obtained while running initial security testing. The assessors must strictly
follow the guidelines imposed by the company during the entire testing and auditing
All customer data, including trading activities and all internal communications with
technical support, are permanently stored in a secured AWS S3 Glacier cloud data
storage, located in Ireland, for backup and compliance purposes. The data is
securely transferred to the cloud and then is properly encrypted while at rest by
using AWS-native encryption mechanisms. These mechanisms give AWS the
necessary technical means to encrypt and decrypt the data when such is required
by the company. There is no data processing agreement between AWS and the
Should Jane modify the required GDPR rights waiver for non-European residents?
The GDPR applies to the processing of personal data of data subjects who are in the EU, regardless of their nationality or residence. This means that non-EU residents who are physically located in the EU are protected by the GDPR, and EU residents who are outside the EU are not. However, this does not mean that non-EU residents who are outside the EU can be asked to waive their GDPR rights by a company that is subject to the GDPR. The GDPR does not allow such waivers, as they would undermine the essence of the fundamental rights and freedoms of data subjects. The GDPR also requires that data subjects are provided with clear and transparent information about the processing of their personal data, and that they give their consent freely, specifically, informedly and unambiguously. A blanket waiver of GDPR rights does not meet these criteria, and would therefore be invalid and unenforceable.
* GDPR Article 3 - Territorial scope1
* GDPR Article 7 - Conditions for consent2
* GDPR Article 25 - Data protection by design and by default3
* GDPR Recital 171 - Relationship with previously concluded agreements4
A company wishes to transfer personal data to a country outside of the European Union/EEA In order to do so, they are planning an assessment of the country's laws and practices, knowing that these may impinge upon the transfer safeguards they intend to use
All of the following factors would be relevant for the company to consider EXCEPT'?
Since blockchain transactions are classified as pseudonymous, are they considered to be within the material scope of the GDPR, or outside of it?
According to the GDPR, the material scope of the regulation covers the processing of personal data wholly or partly by automated means, or by non-automated means if the data forms part of a filing system or is intended to form part of a filing system (Article 2(1)). Personal data is defined as any information relating to an identified or identifiable natural person (data subject) (Article 4(1)). An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 4(1)). Therefore, pseudonymous data, such as blockchain transactions that use public keys or other identifiers, may still fall within the definition of personal data if the data subject can be identified or re-identified by using additional information or means (Recital 26).
The GDPR also applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the European Union, regardless of whether the processing takes place in the European Union or not (Article 3(1)). The GDPR also applies to the processing of personal data of data subjects who are in the European Union by a controller or processor not established in the European Union, where the processing activities are related to the offering of goods or services to such data subjects in the European Union or the monitoring of their behaviour as far as their behaviour takes place within the European Union (Article 3(2)). Therefore, the territorial scope of the GDPR covers both controllers and processors established in the European Union, and controllers and processors not established in the European Union but targeting or monitoring data subjects in the European Union.
In this scenario, blockchain transactions are classified as pseudonymous data, which may still be considered as personal data under the GDPR if the data subjects can be identified or re-identified. Therefore, such transactions are within the material scope of the GDPR, as they involve the processing of personal data by automated means. However, the GDPR only applies to such transactions to the extent that they include data subjects in the European Union, either by having a controller or processor established in the European Union, or by offering goods or services to or monitoring the behaviour of such data subjects. Therefore, the answer is C.
Which of the following is NOT recognized as a common characteristic of cloud computing services?
cloud computing services are defined as the on-demand availability of computing resources (such as storage and infrastructure), as services over the internet. Cloud computing services share certain characteristics, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service, multi-tenancy, virtualization, resilient computing, flexible pricing models, security, automation, and sustainability234.
One of the characteristics that is not recognized as a common characteristic of cloud computing services is that the supplier assumes the vendor's business risk associated with data processed by the supplier. This is not a characteristic of cloud computing services, but rather a contractual or legal issue that depends on the agreement between the supplier and the vendor. The supplier and the vendor may have different roles and responsibilities regarding the data processed by the supplier, such as controller, processor, or sub-processor, and they may have different obligations and liabilities under the applicable data protection laws, such as the GDPR. Therefore, the supplier does not necessarily assume the vendor's business risk associated with data processed by the supplier, unless it is explicitly agreed by the parties or required by the law.