Under the GDPR, which of the following is true in regard to adequacy decisions involving cross- border transfers?

Question

Options

• AThe European Commission can adopt an adequacy decision for individual companies.
• BThe European Commission can adopt, repeal or amend an existing adequacy decision.
• CEU member states are vested with the power to accept or reject a European Commission
• DTo be considered as adequate, third countries must implement the EU General Data Protection

• B
  95% (37)
• C
  3% (1)
• D
  3% (1)

Explanation

According to Article 45 of the GDPR, the European Commission has the power to determine whether a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection of personal data. This means that personal data can flow from the EU and the EEA to that third country without any further safeguard being necessary. The adequacy decision is based on an assessment of the legal framework, the enforcement mechanisms, the access by public authorities, the international commitments and the cooperation with the EU of the third country or organisation. The European Commission also monitors the functioning of the adequacy decisions and can repeal, amend or suspend them if the level of protection is no longer ensured. The European Commission has so far recognised several countries and organisations as providing adequate protection, such as Japan, Canada, Switzerland, the UK and the EU-US Data Privacy Framework.

No community discussion yet for this question.