With respect to international transfers of personal data, the European Data Protection Board (EDPB) confirmed that derogations may be relied upon under what condition?

Question

Options

• AIf the data controller has received preapproval from a Data Protection Authority (DPA), after
• BWhen it has been determined that adequate protection can be performed.
• COnly if the Data Protection Impact Assessment (DPIA) shows low risk.
• DOnly as a last resort and when interpreted restrictively.

• A
  4% (1)
• B
  11% (3)
• C
  4% (1)
• D
  81% (22)

Explanation

The GDPR allows for derogations for specific situations when a transfer of personal data to a third country or an international organization cannot be based on an adequacy decision, appropriate safeguards, or binding corporate rules. However, these derogations are exceptions to the general rule and should not become the norm. The EDPB confirmed that derogations should only be used as a last resort and when interpreted restrictively, taking into account the nature of the data, the purpose and duration of the processing, the country of origin and destination, and the rights and freedoms of data subjects. The EDPB also stressed that the data exporter must assess the level of protection in the third country and ensure that the transfer does not undermine the essence of the fundamental rights and freedoms of data subjects.

No community discussion yet for this question.