A European city migrates citizen casework systems to a US public cloud region without SCCs, adequacy reliance, or other transfer tools, assuming the cloud brand's security brochure is enough. What is missing?
Select an answer to reveal the explanation.
Short Explanation
Moving city case files to a US cloud is still an international transfer wearing a hoodie. Brand trust and a SOC report do not replace Chapter V tools. The city stays on the hook as controller for contracts, safeguards, and a real transfer mechanism.
Full Explanation
When EEA personal data are transferred to the United States, GDPR Chapter V requires an adequacy decision, appropriate safeguards such as SCCs (often with transfer assessments), or a valid derogation. Cloud computing does not erase controller accountability: the public body typically remains controller for citizen casework purposes, must bind the provider contractually (often as processor), and must implement suitable technical and organisational measures. Marketing security claims are not a transfer tool.