A startup relies on explicit consent under Article 49 as the standing basis for systematic daily bulk transfers of all EU user records to a non-adequate region. What is the main problem?
Select an answer to reveal the explanation.
Short Explanation
Article 49 is the emergency exit, not the main lobby. Using one-off-style consent derogations to feed a daily bulk pipeline turns an exception into business-as-usual. For systematic transfers, build a proper safeguard path instead of living in the derogation.
Full Explanation
Article 49 derogations—including explicit consent after informing the data subject of possible risks—are interpreted strictly and are generally unsuitable as the main mechanism for systematic, repetitive transfers. Controllers should prefer adequacy or Article 46 safeguards for ongoing bulk exports. Consent is not limited only to special-category data in this context, SCCs remain available in many cases, and Schrems II did not categorically outlaw all consent-based derogations—but it reinforced careful, narrow use.