GDPR practice question 14 of 15

Scenario 4: Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want…

Full set: 80 questions
Scenario 4: Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social medi a. Berc requested that Berc’s and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Questio n: Questio n: Based on scenario 4, Berc shared personal information of its clients with an international marketing company even though an adequacy decision was absent. Which of the following is a valid reason to do so?
Answer options
A: The transfer of data does not depend on the adoption of an adequacy decision by the country where the company is located.
B: Authorization for data transfer from Berc's Chief Information Security Officer (CISO) is obtained.
C: The controller or processor provides appropriate safeguards for data protection. Correct answer
D: The marketing company’s reputation ensures compliance with data protection standards.
Correct Answer:
C. The controller or processor provides appropriate safeguards for data protection.
Explanation

Under the General Data Protection Regulation (GDPR), the transfer of personal data to a third country (a country outside the European Economic Area) is restricted. The primary basis for such a transfer is an "adequacy decision" from the European Commission (Article 45), which the scenario states is absent. In the absence of an adequacy decision, Article 46 of the GDPR permits the transfer if the controller (Berc) has provided "appropriate safeguards." These safeguards, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), ensure that data subjects' rights are protected and that they have effective legal remedies. Therefore, implementing such safeguards is a valid legal reason for the transfer.

Why Incorrect

A. This is incorrect. The transfer of data to a third country is strictly conditional and fundamentally depends on mechanisms like an adequacy decision or, alternatively, appropriate safeguards as per GDPR Chapter V.
B. Internal authorization from a CISO is a good security practice but does not constitute a legal basis for international data transfers under GDPR. The requirements are mandated by the regulation itself.
D. A company's reputation is not a legally recognized mechanism under GDPR for ensuring an adequate level of data protection for international transfers. Legally binding and enforceable safeguards are required.

References

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, L 119/1.

Article 45, "Transfers on the basis of an adequacy decision": Paragraph 1 states that a transfer may take place where the Commission has decided that the third country ensures an adequate level of protection. The scenario negates this.

Article 46, "Transfers subject to appropriate safeguards": Paragraph 1 explicitly states, "In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country... only if the controller or processor has provided appropriate safeguards..."

2. Stanford University, GDPR: An Overview. Stanford University Office of the General Counsel.

In the section on "International Transfers," it is explained that if there is no adequacy decision, a transfer can occur if appropriate safeguards are in place, listing Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs) as primary examples. This directly supports option C as the correct alternative mechanism.

3. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Chapter 11, "Data Transfers," pp. 299-305: This chapter details the hierarchical structure for legitimizing data transfers. It clarifies that after checking for an adequacy decision (Art. 45), the next step is to implement one of the appropriate safeguards listed in Article 46. This confirms that providing such safeguards is the valid procedure when an adequacy decision is absent. (DOI: https://doi.org/10.1007/978-3-319-57959-7)

Keep practicing

Take the free GDPR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other GDPR practice questions

Scroll to Top