Exam CIPP-E topic 1 question 68 discussion

B. The European Commission can adopt, repeal or amend an existing adequacy decision. GDPR Article Reference: Article 45(3): The European Commission has the power to determine, by means of an implementing act, that a third country, a territory or one or more specified sectors within that third country, or an international organization, ensures an adequate level of protection. This implementing act can be repealed, amended or suspended.

Best answer is B. Countries do not have to implement GdPR to receive favorable adequacy decisions. The EU can always amend decisions they made about adequacy decisions.

D. To be considered as adequate, third countries must implement the EU General Data Protection Regulation into their national legislation. Adequacy decisions, as defined by the GDPR, involve the European Commission assessing whether a third country, territory, or specified sector within a third country ensures an adequate level of data protection. For an adequacy decision, the third country must provide a level of protection essentially equivalent to that within the EU, taking into account the rule of law, respect for human rights, and relevant legislation.