If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure…

According to the Privacy Shield Framework, an organization that transfers personal data to a third

party acting as an agent must ensure that the agent does all of the following1:

Uses the transferred data only for limited and specified purposes;

Provides the same level of privacy protection as is required by the Privacy Shield Principles;

Takes reasonable and appropriate steps to ensure that the agent effectively processes the personal

information transferred in a manner consistent with the organization’s obligations under the

Principles;

Requires the agent to notify the organization if it makes a determination that it can no longer meet

its obligation to provide the same level of protection as is required by the Principles;

Upon notice, takes reasonable and appropriate steps to stop and remediate unauthorized processing;

and

Provides a summary or a representative copy of the relevant privacy provisions of its contract with

that agent to the Department of Commerce upon request.

Therefore, the only option that is not required by the Privacy Shield Framework is D. Enters a

contract with the organization that states the third party will process data according to the consent

agreement. While the organization must obtain the individual’s consent for certain types of data

transfers, such as those involving sensitive data or onward transfers to controllers, the organization

does not have to include the consent agreement in the contract with the agent. The contract must,

however, ensure that the agent will process the data in accordance with the individual’s choices and

expectations, as well as the Privacy Shield Principles2.

Reference: 1: Privacy Shield Framework3, Section 3 (b); 2: Privacy Shield Framework3, Section 2 (b)

and ©; 3: Privacy Shield Framework.