IAPP Updated CIPP-E Exam Questions and Answers by cassie

According to Article 49 of the GDPR, transfers of personal data to third countries or international organisations may take place in the absence of an adequacy decision or appropriate safeguards, such as standard contractual clauses or binding corporate rules, only if one of the derogations listed in that article applies1. One of the derogations is when the transfer is necessary for the protection of the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent1. This derogation is intended to cover only urgent situations, such as medical emergencies, where the transfer is essential for the data subject’s life or health2.

In this scenario, ProStorage most likely relied on this derogation to transfer Ruth’s medical information to the hospital in India, where she suffered a medical emergency and was hospitalized. The transfer was necessary for the protection of Ruth’s vital interests, as she was in a critical condition and needed urgent medical care. Ruth was also physically or legally incapable of giving consent, as she was unconscious or incapacitated. Therefore, option B is the correct answer.

Option A is incorrect because Ruth’s implied consent is not a valid transfer mechanism under the GDPR. Consent must be explicit, informed, specific, and freely given for the transfer of personal data to third countries or international organisations1. Ruth did not give any explicit consent for the transfer of her medical information to the hospital, nor was she informed or asked about it. Moreover, consent cannot be relied on as a transfer mechanism when the data subject is in a situation of distress or dependence, such as a medical emergency, as it would not be considered freely given2.

Option C is incorrect because the performance of a contract with Ruth is not a valid transfer mechanism under the GDPR. The transfer of personal data to third countries or international organisations on the basis of a contract with the data subject is only allowed if the transfer is necessary for the performance of that contract or for the implementation of pre-contractual measures taken at the data subject’s request1. In this scenario, there is no contract between ProStorage and Ruth that requires or justifies the transfer of her medical information to the hospital. The transfer is not necessary for the performance of Ruth’s employment contract with ProStorage, nor for any pre-contractual measures taken by Ruth.

Option D is incorrect because the protection against legal liability from Ruth is not a valid transfer mechanism under the GDPR. The transfer of personal data to third countries or international organisations on the grounds of legal claims or defence is only allowed if the transfer is necessary for the establishment, exercise or defence of legal claims1. In this scenario, there is no legal claim or defence involved in the transfer of Ruth’s medical information to the hospital. The transfer is not necessary for the establishment, exercise or defence of any legal claim by or against ProStorage or Ruth.

References:

• Derogations for specific situations
• Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

The GDPR applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the EU, regardless of whether the processing takes place in the EU or not. The GDPR also applies to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities are related to the offering of goods or services to such data subjects in the EU or the monitoring of their behaviour as far as their behaviour takes place within the EU1. Therefore, after leaving the EU under the terms of Brexit, the UK became a third country for the purposes of the GDPR, meaning that personal data transfers from the EU to the UK are subject to the rules on international data transfers under Chapter V of the GDPR2. In order to ensure the continuity and stability of data flows between the EU and the UK, the UK sought an adequacy decision from the European Commission, which is a formal recognition that a third country provides an equivalent level of data protection to that of the EU3. On 28 June 2021, the European Commission adopted two adequacy decisions in respect of the UK: one for transfers under the GDPR and the other for transfers under the Law Enforcement Directive (LED)4. These decisions allow personal data to flow freely from the EU to the UK without any further safeguard being necessary, and are expected to last until 27 June 2025, unless they are amended, suspended or repealed earlier5. References:

• GDPR, Article 3
• GDPR, Chapter V
• Data protection adequacy for non-EU countries, section “Adequacy decisions”
• UK government welcomes the European Commission’s draft data adequacy decisions
• Adequacy, section “What does the EU GDPR adequacy decision say?”

 According to the UK GDPR, employees have the right to access and receive a copy of their personal data, and other supplementary information, from their employer. This is known as a data subject access request (DSAR). Employers must respond to a DSAR without delay and within one month of receipt of the request, unless the request is complex or excessive. Employers should perform a reasonable search for the requested information and provide it in an accessible, concise and intelligible format. Employers can only refuse to provide the information if an exemption or restriction applies, or if the request is manifestly unfounded or excessive. Some of the exemptions that may apply in the employment context are: legal privilege, management forecasting, confidential references, negotiations, regulatory functions, and criminal convictions and offences. Employers should disclose the information securely and inform the employee of their rights and the source of the data. References:

• Right of access | ICO
• Subject access request Q and As for employers | ICO
• Data Subject Access Request (Employers’ Guide) | DavidsonMorris

 According to Article 5 of the GDPR, personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)1. The company’s decision to install cameras in the entrance of the building, hallways and offices may violate this principle, as it may expose the personal data of the employees and visitors to unnecessary risks, such as hacking, misuse or disclosure. Moreover, the company must also comply with the other principles of data processing, such as lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy and storage limitation1. The company must have a legitimate and specific purpose for installing the cameras, and must inform the data subjects about the processing of their personal data. The company must also ensure that the cameras collect only the minimum amount of data necessary for the purpose, and that the data are accurate and kept for no longer than necessary. The company must also respect the rights and freedoms of the data subjects, and provide them with the means to exercise their rights, such as the right to access, rectify, erase, restrict, object or port2.

The most realistic step the company could take to address their security concerns and comply with the personal data processing principles set out in Article 5 of the GDPR is to restrict the camera placement to building entrances only. This would limit the scope and impact of the data processing, and reduce the risks to the personal data of the employees and visitors. The company would still need to inform the data subjects about the processing, and ensure that the footage is securely stored and transferred, especially if it is monitored by the home office in the United States, which is a third country that may not offer adequate protection for personal data3. The company would also need to consider the possibility of obtaining the consent of the data subjects, or relying on another legal basis for the processing, such as the legitimate interests of the company or the performance of a contract4. References:

• Article 5 of the GDPR
• [Article 12-23 of the GDPR]
• [Article 44-50 of the GDPR]
• [Article 6 of the GDPR]