Certified Information Privacy Professional – Europe (CIPP/E) — Question 224

To comply with the GDPR and the EU Court of Justice's decision in Schrems II, the European Commission issued what are commonly referred to as the new standard contractual clauses (SCCs). As a result, businesses must do all of the following EXCEPT?

Answer options

• A. Consider the new optional docking clause, which expressly permits adding new parties to the SCCs.
• B. Migrate all contracts entered into before September 27, 2021, that use the old SCCs to the new SCCs by December 27, 2022.
• C. Take steps to flow down the new SCCs to relevant parts of their supply chain using the new SCCs as of September 27, 2021, if the business is a data importer.
• D. Implement the new SCCs in the U.K. following Brexit, as the U.K. Information Commissioner's Office does not have the authority to publish its own set of SCCs.

Correct answer: D

Explanation

The correct answer is D because the U.K. has its own mechanisms for data transfer post-Brexit, and the Information Commissioner's Office has the authority to publish its own set of SCCs. Options A, B, and C are all actions that businesses must take to comply with the new SCCs as mandated by the GDPR and the implications of the Schrems II ruling.