Cross-Border Data Transfers

Question 1

Options for cross-border data transfers as defined in the GDPR

Answer 1

(1) Adequacy decisions
(2) Appropriate safeguards
(3) Derogations

Question 2

Which body makes adequacy decisions?

Answer 2

European Commission

Question 3

Canada is deemed adequate under what provision?

Answer 3

Data protected by PIPEDA

Question 4

The USA is deemed adequate under what provision?

Answer 4

EU-US Privacy Shield

Question 5

Privacy Shield Requirements include:

Answer 5

• Commit to the Privacy Shield Principles
• Publicize that commitment
• Publicly disclose the orgs privacy policy
• Implement the Principles
• Annually renew the certification

Question 6

Privacy Shield Principles include:

Answer 6

• Notice
• Choice
• Accountability for onward transfers
• Security
• Data integrity and purpose limitation
• Access
• And recourse, enforcement, and liability

Question 7

Appropriate safeguards include:

Answer 7

• Binding Corporate Rules (BCRs)
• Standard contractual clauses
• Approved codes of conduct or cert. mechanisms
• Ad hoc contractual clauses
• Reliance on international agreements