Certified Information Privacy Professional CIPPE · Free Practice Question Medium
Question 5
Connect Corp, a global social networking platform requires individuals to provide their email address, names and mailing address before they create an account.
Connect Corp transfers EU user data to the United States for storage and individuals are informed in the Privacy Policy that:
“Personal Data may be stored and processed in any country where we do business or our service providers do business. We may transfer your Personal Data to countries other than your own country, including to the United States. These countries may have data protection rules that are different from your country. When transferring data across borders, we take measures to comply with applicable data protection laws related to such transfer.”
Connect Corp also has a loyalty program for its customers. To sign up a customer has to tick a box which provides: "I accept that Connect Corp communicates to Market LLC my surname, first name and email”.
However Connect Corp transmits Market LLC the following information: postal address, and the telephone numbers, provided by the subscribers.
Before transmitting user’s personal information to the United States for processing, Connect Corp will need to complete: (Choose the Best answer)
-
A
A Data Protection Impact Assessment
- B A Privacy Impact assessment
-
C
A Transfer Impact Assessment
-
D
A Legitimate Interest Assessment
Reveal correct answer
Correct answer: C
Explanation
The Court of Justice of the EU (CJEU) in July 2020 invalidated the EU-US Privacy Shield.
It also clarified that the use of standard contractual clauses (SCCs) requires data controllers to conduct a case-by-case assessment of the level of data protection that SCCs can provide, taking into account the nature of the personal data transfer(s) and the country of destination.
Therefore, a personal data transfer impact assessment (TIA) is now necessary after the Schrems II case when organizations are exporting data from the European Union to non-EU countries that do not provide an adequate level of protection.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
