According to Article 45 of the GDPR, the European Commission has the power to determine, on the basis of an assessment, whether a non-EU country, a territory or a sector within that country, or an international organisation ensures an adequate level of data protection. This means that the data protection rules and standards in that country or organisation are equivalent to those in the EU. The effect of an adequacy decision is that personal data can flow freely from the EU to that country or organisation without any further safeguards or authorisations. The European Commission has adopted adequacy decisions for several countries and organisations, such as Japan, Canada, and the EU-US Data Privacy Framework.  References:   Data protection adequacy for non-EU countries ,  Adequate Level of Protection

 According to the ICO guidance on the use of cookies and similar technologies 1 , browser settings and other control mechanisms can be relied upon for the lawful application of cookies only if they meet the following conditions:

They are designed to protect users’ privacy and provide them with control over the use of cookies and similar technologies;

They are prominent and easy to use, and do not require users to take unnecessary steps or provide unnecessary information;

They are specific and granular enough to allow users to express their preferences for different types and purposes of cookies and similar technologies;

They are sufficiently informed and clear about the cookies and similar technologies that will be set or accessed, and the purposes for which they will be used;

They are regularly reviewed and updated to reflect any changes in the cookies and similar technologies that are used or the purposes for which they are used;

They are not overridden or circumvented by other software or settings that may interfere with users’ choices;

They provide an effective means of withdrawing consent at any time.

Therefore, browser settings and other control mechanisms can be a valid way of obtaining consent for cookies and similar technologies, but only if they meet these high standards and ensure that users have a real and meaningful choice over the use of cookies and similar technologies on their devices.  References:   1  How do we comply with the cookie rules? | ICO. Available at:  4  (Accessed: 11 December 2023).

Article 82 of the GDPR 1 2 3 4  regulates the right to compensation and liability for any person who has suffered material or non-material damage as a result of an infringement of the GDPR.

Paragraph 4 of Article 82 1 2 3 4  states that a controller or processor shall be exempt from liability under paragraph 2 (which holds them liable for the damage caused by processing which infringes the GDPR) if it proves that it is not in any way responsible for the event giving rise to the damage.

Therefore, the right to compensation and liability under the GDPR provides for an exemption from liability if the data controller (or data processor) proves that it is not in any way responsible for the event giving rise to the damage.

According to the GDPR, any transfer of personal data to a third country or an international organisation must be based on an adequacy decision by the Commission, appropriate safeguards by the data exporter and importer, or derogations for specific situations 1 . In this scenario, InstaHR is an Australian based company that processes personal data on behalf of ProStorage, a Dutch based company.  Australia is not recognised by the Commission as a country that provides an adequate level of data protection 2 , so the adequacy option is not available.  Binding corporate rules (BCRs) are internal rules adopted by multinational groups of companies or organisations that define their global policy with regard to the international transfers of personal data within the same corporate group to entities located in countries that do not provide an adequate level of protection 3 . However, BCRs are not applicable in this case, as InstaHR is not part of the same corporate group as ProStorage.  Explicit consent of employees is a possible derogation for specific situations, but it is not a reliable or practical transfer mechanism, as it must be freely given, specific, informed and unambiguous, and it can be withdrawn at any time 4 . Therefore, the most suitable transfer mechanism for using InstaHR is standard contractual clauses (SCCs). SCCs are contractual clauses that have been pre-approved by the Commission and that provide appropriate safeguards for data protection when transferring personal data from the EU/EEA to third countries. SCCs are legally binding and enforceable by data subjects, and they impose obligations on both the data exporter and the data importer.  SCCs are widely used by data controllers and processors as a transfer mechanism under the GDPR.  References:   1 : Art.  44 GDPR - General principle for transfers 2 2 : Adequacy decisions - European Commission 1 3 : Binding corporate rules - European Commission 1 4 : Article 7 of the GDPR.  : Standard Contractual Clauses (SCC) - European Commission 1 .

The GDPR is the EU’s general data protection regulation that applies to the processing of personal data by controllers and processors in the EU, regardless of whether the processing takes place in the EU or not. The GDPR also applies to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities are related to the offering of goods or services to data subjects in the EU or the monitoring of their behaviour as far as their behaviour takes place within the EU. The GDPR sets out the principles, rights and obligations for the protection of personal data, as well as the enforcement and cooperation mechanisms among the data protection authorities and the European Data Protection Board.

The Digital Services Act (DSA), the Data Governance Act (DGA) and the Digital Markets Act (DMA) are part of the EU’s digital strategy that aims to create a single market for data and digital services, by supporting responsible access, sharing and re-use of data, while respecting the values of the EU and in particular the protection of personal data. These legal acts do not change or replace the GDPR, but rather complement and reinforce it, by addressing specific issues and challenges related to the digital economy and society. The DSA, the DGA and the DMA explicitly state that they apply without prejudice to the GDPR and that they respect and uphold the fundamental rights and freedoms of individuals, including the right to the protection of personal data.

The DSA is a proposal for a regulation that seeks to harmonise the rules and responsibilities of online intermediaries, such as platforms, hosting services, cloud providers and online marketplaces, in order to ensure a safe and trustworthy online environment for users and businesses. The DSA introduces a set of obligations for online intermediaries, such as transparency, accountability, due diligence, cooperation and reporting, depending on their size, role and impact. The DSA also establishes a new governance and cooperation system among the national authorities and the European Commission, as well as a mechanism for out-of-court dispute resolution.

The DGA is a proposal for a regulation that aims to foster the availability of data for use by increasing trust in data intermediaries and by strengthening data-sharing mechanisms across the EU. The DGA introduces a new legal framework for data sharing services, such as data brokers, data marketplaces, data trusts and data cooperatives, that facilitate data exchange between data holders and data users. The DGA also sets out rules and requirements for data altruism, which is the voluntary consent of individuals or organisations to share data for the common good. The DGA also establishes a new governance model for data sharing in the EU, involving the European Data Innovation Board, the national competent authorities and the European Commission.

The DMA is a proposal for a regulation that intends to limit the power of large online platforms that act as gatekeepers in the digital market, by imposing a set of obligations and prohibitions to prevent unfair practices and ensure fair and open competition. The DMA defines the criteria and the procedure for identifying the gatekeepers, such as search engines, social networks, online marketplaces, app stores and cloud services, that have a significant impact and influence in the digital economy. The DMA also provides for the supervision and enforcement of the rules by the European Commission, as well as the possibility of imposing fines and sanctions for non-compliance.

 A data sharing agreement is a contract that documents what data is being shared and how it can be used. It can be used to make data sharing lawful and to demonstrate compliance with the accountability principle under the GDPR. A data sharing agreement is most likely to be needed when personal data is being shared between commercial organizations acting as joint data controllers, because they have to determine and agree on their respective roles and responsibilities, such as the purpose and legal basis of the data sharing, the rights of the data subjects, the security measures, and the liability for any breaches. A data sharing agreement is not mandatory, but it is good practice and can help to avoid disputes and confusion. A data sharing agreement may not be needed or may be less detailed in the other scenarios, depending on the circumstances and the nature of the data. For example, anonymized data is not personal data under the GDPR and does not require a data sharing agreement, although it may still be subject to other contractual or ethical obligations. Personal data that is proactively shared by a controller to support a police investigation may be covered by a legal obligation or a public interest, and the controller may not have much control over how the data is used by the police. Personal data that is shared with a public authority with powers to require the personal data to be disclosed may also be subject to a legal obligation or a public interest, and the controller may have to comply with the authority’s request without a data sharing agreement.  References:

Data sharing agreements | ICO , which provides guidance on the benefits and contents of a data sharing agreement.

Data Sharing Agreement - the Definition - GDPR Summary , which explains what a data sharing agreement is and when it can be used.

The role of data sharing and the GDPR | Data Republic , which discusses the impact of the GDPR on data sharing practices.

The GDPR (General Data Protection Regulation) has strict data breach response requirements , particularly for ransomware attacks that affect personal data. The appropriate next step after an internal investigation is to assess the risks associated with the breach and notify affected parties if necessary .

Key GDPR Breach Response Steps (Article 33 & 34):

Assess the risks to personal data

If the breach poses a risk to individuals’ rights and freedoms, the supervisory authority (DPA) must be notified within 72 hours ​.

If there is a high risk , affected individuals must also be informed without undue delay​.

Why Answer Choice A is Correct

Risk assessment is a critical first step after an internal investigation.

If the breach meets the risk threshold , notification to authorities and individuals is required under GDPR​.

Why Other Answer Choices Are Incorrect:

B (Notify Law Enforcement First) : While law enforcement may be involved, GDPR does not mandate consulting law enforcement before conducting a risk assessment or notifying individuals​.

C (Informing the Public Immediately) : Public disclosure via social media is not a GDPR requirement. Affected individuals and DPAs should be formally notified first .

D (Waiting for Law Enforcement) : GDPR does not allow waiting for law enforcement before fulfilling notification obligations . Controllers must act within 72 hours ​.

Conclusion: The correct next step after an internal investigation is to assess the risks and, if necessary, notify affected individuals and regulatory bodies as required under GDPR Articles 33 and 34 .

According to the EDPB Guidelines 01/2021 on Examples regarding Personal Data Breach Notification, a confidentiality breach occurs when personal data is disclosed or made available to unauthorized persons. This is the case when exfiltration of job application data from a website results in personal information being accessible to unauthorized persons, such as hackers or competitors. This type of breach may pose a high risk to the rights and freedoms of the data subjects, as it may lead to identity theft, fraud, discrimination, or reputational damage. Therefore, the data controller should notify the data subjects without undue delay, unless the data is encrypted or anonymized, or the controller has taken subsequent measures to ensure that the high risk is no longer likely to materialize.

The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980, revised 2013) established the eight foundational principles of data protection, which are part of the CIPP/E syllabus.

Purpose Specification Principle: The purposes for data collection must be specified at the time of collection.

Use Limitation Principle: Data should not be disclosed, made available, or otherwise used for purposes other than those specified, except with consent or by law.

Disclosure Limitation Principle: Disclosure of personal data to third parties should be controlled and limited to authorized recipients.

Openness Principle: Transparency obligations require openness about policies and practices.

In this case:

Plasmology does not even know which records relate to deceased patients vs. living patients . Therefore, disclosing all records to EaziDiagnoze would mean potentially handing over living patients’ records without a lawful basis or consent .

This violates the Disclosure Limitation Principle , which prevents the uncontrolled release of personal data to third parties.

The CIPP/E Textbook (3rd ed.) emphasizes that the OECD principles influenced modern EU data protection law and remain relevant for identifying privacy risks in cross-border data uses.

???? So, the key principle at risk is Disclosure Limitation (Option B) , since Plasmology would be improperly releasing personal data without certainty or safeguards.

???? Reference:

OECD Guidelines (1980/2013), Disclosure Limitation Principle.

CIPP/E Textbook (3rd ed.), Chapter 1 “Origins and Development of Data Protection Law” (coverage of OECD Guidelines and their eight principles).