A European city migrates citizen casework systems to a US public cloud region without SCCs, adequacy reliance, or other transfer tools, assuming the cloud brand's security brochure is enough. What is missing?
Select an answer to reveal the explanation.
Short Explanation
Moving city case files to a US cloud is still an international transfer wearing a hoodie. Brand trust and a SOC report do not replace Chapter V tools. The city stays on the hook as controller for contracts, safeguards, and a real transfer mechanism.
Full Explanation
A European city migrating citizen casework systems to a US public cloud region without SCCs, adequacy reliance, or other transfer tools, assuming the cloud brand’s security brochure is enough, is missing that the city remains accountable as controller: cloud use still requires appropriate TOMs, contracts, and a valid Chapter V transfer mechanism when personal data go to the US. Civic case files do not shed GDPR Chapter V by putting on a cloud hoodie. Claiming public-sector data may always leave the EEA without Chapter V tools fails. Saying cloud providers are sole controllers for all customer content by default, ending the city’s duties, fails typical role allocation for customer-content casework. Asserting security certifications alone replace SCCs and transfer impact analysis fails—certifications support TOMs but are not a transfer tool. Exam caveat: after Schrems-line case law, transfers to the US commonly need SCCs plus transfer assessments and supplementary measures where required, or another valid Chapter V path. Operational check: execute processor terms, select SCCs/adequacy path, complete transfer assessment, enable encryption and access controls, document residency choices, and reject brochure-only transfer justifications.