CIPP-E > Fair Processing Information & Third Country Data Transfers > Flashcards

Fair Processing Information & Third Country Data Transfers Flashcards

Learn the transparency obligations for fair processing and the mechanisms for transferring data outside the EEA. (53 cards)

Study These Flashcards
1
Q

What is fair processing information?

A

Information controllers provide to data subjects about how their personal data is processed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What legal effects can result from ADM?

A

Outcomes impacting rights or obligations.

Examples: credit scoring or benefits eligibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

When must notice be provided for secondary processing?

A
  • Before the new processing begins, and
  • With enough time for data subjects to object
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the controller’s obligations regarding notice?

A
  • To provide information
  • Explicitly bring processing activities to the data subject’s attention
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the qualities of fair processing information?

A
  • Concise
  • Transparent
  • Intelligible
  • Easily accessible
  • Plain language
  • Accurate
  • Up to date
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are acceptable mediums for providing notice?

A
  • Written
  • Electronic means (e.g., website)
  • Orally (e.g., phone at request)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are examples of excessive requests?

A
  • Repetitive
  • Abusive
  • Intended to disrupt the organization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What visual formats can be used in notices?

A
  • Diagrams
  • Cartoons
  • Graphics
  • Video
  • Audio
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the requirements for visual notices?

A

They must simplify communication and be machine readable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What must a user do before an organization stores or accesses data on their terminal equipment?

A

Provide consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does ‘similar technology’ include under the ePrivacy Directive?

A
  • Tracking pixels
  • Web beacons
  • Tracking links
  • Device fingerprinting
  • IP tracking
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a layered notice?

A
  • Top layer presents a summary of key info like controller, purpose, rights
  • Bottom layer provides legal details
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a just-in-time notice?

A

Provided at the point of collection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a dashboard notice?

A

Web-based interface allowing users to toggle privacy options, e.g., social media settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are key requirements for the Data Protection Officer (DPO)?

A
  • Involvement in privacy and related efforts
  • Independence
  • Direct access to top management
  • Access to processing operations
  • Technical expertise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Who must the DPO report to?

A

The highest management level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the role of the DPO in relation to supervisory authorities?

A
  • Cooperate
  • Serve as their point of contact
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is considered a ‘third country’ under the GDPR?

A

Any country outside the EU/EEA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is considered a ‘transfer’ under GDPR?

A

When personal data is intentionally sent or made accessible by a GDPR-subject organization to a third country or international organization.

Examples: using US-based cloud storage, outsourcing IT to Ukraine, using US email service for newsletters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is considered ‘transit’ under GDPR?

A

Passage of personal data through an intermediary without access or processing ability.

Example: email routed through US infrastructure with no access by intermediary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the 3 factors to consider for adequacy?

A
  1. Rule of law and human rights
  2. Independent supervisory authorities
  3. International commitments
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What framework guides the Commission’s adequacy decision?

Study These Flashcards
A

The WP29’s Adequacy Referential

23
Q

What is the designation procedure for adequacy?

Study These Flashcards
A
  • Commission drafts proposal
  • EDPB issues opinion
  • Member states approve
  • Commission adopts act
24
Q

How often are adequacy decisions reviewed?

Study These Flashcards
A

At least every 4 years.

25
What prompted **scrutiny** of **Safe Harbor**?
Edward **Snowden’s 2013 leaks** revealing NSA surveillance programs.
26
Who is **Max Schrems**?
An Austrian **privacy advocate** who filed a complaint that led to the **Schrems I** decision.
27
What **year** did the EU-US Privacy Shield go into effect?
2016
28
What was the **Privacy Shield** intended to ensure?
That EU individuals could **exercise privacy rights** when their data was processed in the US.
29
Which **agencies regulated businesses** under the Privacy Shield?
* FTC * Department of Transportation
30
What is **Executive Order 14086**?
Addressed Schrems II concerns and reformed US surveillance practices. ## Footnote Issued in October 2022
31
What **features** does the **EU-US Data Privacy Framework** introduce?
* Surveillance limited to necessity and proportionality * New data protection review court
32
What are **Standard Contractual Clauses** (SCCs)?
Standardized, pre-approved contractual terms **permitting lawful transfer** of personal data from EU/EEA to third countries
33
Who can **approve** a set of Standard Contractual Clauses?
* European Commission * A supervisory authority (subject to Commission approval)
34
What is the **purpose** of **modular SCCs**?
To allow organizations to choose modules based on their **specific transfer roles** and responsibilities.
35
What are the **4 SCC modules**?
1. Controller-to-controller 2. Controller-to-processor 3. Processor-to-processor 4. Processor-to-controller
36
What **assessment** must accompany SCC use?
Transfer Impact Assessment | (TIA)
37
What are the **steps** of a Transfer Impact Assessment? | (TIA)
* Know your transfer * Identify transfer tools * Assess tool’s efficacy * Adopt and implement supplementary measures * Re-evaluate periodically
38
What is a **code of conduct** under GDPR?
A **voluntary** set of **sector-specific rules** developed by associations to aid compliance and d**emonstrate accountability**.
39
Who must approve a GDPR **code of conduct**?
A competent **supervisory authority**
40
What is the **process** for developing **a code of conduct**?
* Drafted by associations * Submitted to supervisory authority * Recognized by the European Commission for EU-wide validity
41
What is the role of a **monitoring body** in a code of conduct?
**Ensure compliance oversight** and be accredited by the supervisory authority.
42
What is a **certification mechanism** under GDPR?
A **voluntary**, formal process for **demonstrating compliance** with GDPR criteria.
43
Who **assesses compliance** in a certification mechanism?
Accredited, **independent certification bodies**.
44
What are the **steps** in the **certification process**?
* Preparation and gap analysis * Select scheme * Apply * Audit * Certification decision * Monitoring and renewal
45
What are **examples** of well-known **certification schemes**?
* EuroPriSe * Europrivacy * EU GDPR Institute Certification
46
What are **Binding Corporate Rules** (BCRs)?
Legally binding data protection policies for **multinational organizations** allowing lawful **intra-organizational** data transfers. ## Footnote Key: intra-organizational
47
What is the '**consistency mechanism**' in BCRs?
A formal process where **DPAs cooperate** to ensure **GDPR is consistently applied** across the EU.
48
**Who** must approve BCRs before use?
Data Protection Authorities | (DPAs)
49
What is a **derogation** under GDPR?
An **exception** allowing personal data transfer to a third country **without adequacy decision or safeguards**.
50
What are the **permissible conditions** for using derogations?
* Consent * Contract performance * Substantial public interest * Legal claims * Vital interests * Public registers * Non-repetitive transfer
51
What qualifies as a **public register**?
Official record under EU/member state law accessible by the public. ## Footnote E.g., land titles, criminal records
52
What is a **non-repetitive transfer**? | (NRT)
A limited, **one-off transfer** supported by compelling legitimate interests not overridden by data subject rights.
53
What is the **objective** of **EDPB Guidelines 1/2024**?
To clarify **appropriate uses of legitimate interest** under Article 6(1)(f) GDPR and guide balancing assessments.
CIPP-E
flashcards
Decks in class (11)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions