Certified Information Privacy Professional – Europe (CIPP/E) — Question 88

Under the GDPR, which of the following is true in regard to adequacy decisions involving cross-border transfers?

Answer options

• A. The European Commission can adopt an adequacy decision for individual companies.
• B. The European Commission can adopt, repeal or amend an existing adequacy decision.
• C. EU member states are vested with the power to accept or reject a European Commission adequacy decision.
• D. To be considered as adequate, third countries must implement the EU General Data Protection Regulation into their national legislation.

Correct answer: B

Explanation

The correct answer is B because the European Commission indeed has the authority to adopt, repeal, or amend adequacy decisions regarding data transfers. Option A is incorrect as adequacy decisions are not issued for individual companies but rather for countries. Option C is wrong because EU member states do not have the power to accept or reject these decisions, and option D is misleading since adequacy does not require full implementation of the GDPR but rather a level of protection that is deemed sufficient.