Certified Information Privacy Professional – Europe (CIPP/E) — Question 78

Which of the following statements is inconsistent with the EDPB's position on qualifying a given processing as a “transfer” under Chapter V of the GDPR?

Answer options

• A. Transfers subject to the GDPR can only occur when two separate parties – each of them a controller, joint controller or processor – are involved.
• B. Transfers subject to the GDPR may involve data disclosures between entities belonging to the same corporate group (intra-group data disclosures).
• C. Transfers subject to the GDPR may involve remote access of personal data from a third country during a business trip of an employee of the controller for the given processing.
• D. Transfers in which a controller or processor makes personal data available to another controller, joint controller, or processor needs to be subject to the GDPR for the given processing.

Correct answer: A

Explanation

Option A is incorrect because the EDPB acknowledges that transfers can occur even when the parties involved are not separate entities, such as in cases of intra-group data disclosures. Options B, C, and D are consistent with the EDPB's position, as they describe scenarios where data transfers may legitimately occur under the GDPR, including intra-group disclosures and remote access during business activities.