If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?

The EU-U.S. Privacy Shield's Accountability for Onward Transfer Principle requires organizations to ensure third-party agents provide the same level of protection as the Principles. This includes contracts that limit the purpose of processing and require notification if the agent can no longer comply. While processing must be consistent with the individual's consent, the contractual obligation is to bind the agent to the Privacy Shield Principles themselves, not to a specific, separate "consent agreement" between the individual and the original organization. The other options are explicit requirements of the Onward Transfer principle.

A. This is incorrect. The Onward Transfer Principle explicitly requires that data be transferred only for limited and specified purposes.
B. This is incorrect. The principle's core requirement is that the agent is obligated to provide at least the same level of privacy protection as required by the Principles.
C. This is incorrect. The organization must require the agent to notify it if the agent determines it can no longer meet its obligation for protection.

1. U.S. Department of Commerce. (2016). EU-U.S. Privacy Shield Framework Principles. "Accountability for Onward Transfer," Section 3(a). Available from the International Trade Administration, U.S. Department of Commerce.

2. Swire, P., & Kennedy-Mayo, D. (2018). U.S. Private-Sector Privacy: Law and Regulation for the 21st Century (3rd ed.). IAPP. Chapter on "The EU-U.S. Privacy Shield." (Note: Specific page numbers vary by printing, but the content is standard in the relevant chapter).