Scenario 4:Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social medi
Answer(s): A
Under Article 45 of GDPR, data transfers to third countries are lawful if the European Commission has adopted an adequacy decision, meaning the country offers equivalent protection to GDPR. Switzerland has such an adequacy decision, making Berc's transfer lawful.Option A is correct because Switzerland meets GDPR adequacy standards.Option B is incorrect because having the same purpose does not automatically make the transfer lawful.Option C is incorrect because no supervisory authorization is needed when an adequacy decision exists.Option D is incorrect because a DPIA is not required for a GDPR-compliant transfer.
GDPR Article 45(1) (Adequacy decisions for third countries)European Commission Decision on Switzerland's adequacy
Answer(s): C
Under Article 44 of GDPR, the controller (Berc) is responsible for ensuring lawful data transfers. The DPO advises on compliance but does not make final decisions on data transfers.Option C is correct because the controller (Berc) must evaluate the legality of the transfer.Option A is incorrect because DPOs provide advice but do not evaluate data transfer legality.Option B is incorrect because DPOs do not have executive decision-making authority.Option D is incorrect because data protection rules vary by jurisdiction, making this assumption incorrect.
GDPR Article 44 (General principle for transfers)GDPR Article 39(1)(a) (DPO's advisory role)
Under Article 46 of GDPR, in the absence of an adequacy decision, controllers can transfer data only if appropriate safeguards (e.g., Standard Contractual Clauses, Binding Corporate Rules) are in place. Option C is correct because safeguards such as SCCs allow data transfers when no adequacy decision exists.Option A is incorrect because adequacy decisions are a legal requirement, not optional.Option B is incorrect because a CISO cannot authorize GDPR data transfers.Option D is incorrect because reputation does not ensure GDPR compliance.
GDPR Article 46(1) (Appropriate safeguards for data transfers)Recital 108 (Legally binding commitments for data protection)
Scenario 4:Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unity, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unity's customers, were not aware that there was an arrangement between Berc and Unity and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social medi
Under Article 13 of GDPR, data subjects must be informed about who processes their data, including joint controllers. This ensures transparency and accountability.Option A is correct because individuals have the right to know who processes their data.Option B is incorrect because controllers do not have the discretion to withhold this information.Option C is incorrect because data processing arrangements must be transparent.Option D is incorrect because organizations, not authorities, must ensure transparency.
GDPR Article 13(1)(a) (Identity of controllers must be disclosed)Recital 60 (Transparency in processing)
GDPR Article 26(3) (Joint controllers must ensure data subjects can exercise their rights).
Post your Comments and Discuss PECB GDPR exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the GDPR content, but please register or login to continue.