A tourism app stores EU travellers’ photos only on servers in a country covered by a Commission adequacy decision. How does that destination choice affect the transfer analysis?
Select an answer to reveal the explanation.
Short Explanation
Parking the photo vault in an adequate country is like shipping to a destination the EU already trusts. You typically skip bolting on SCCs or BCRs just for that hop. It simplifies Chapter V—it doesn’t mean the images stopped being personal data.
Full Explanation
Where the Commission has found a third country adequate under Article 45, transfers to that country may take place without additional Article 46 tools such as SCCs or BCRs for that transfer. Adequacy does not depend on collecting Article 49 consent for the same path, and image data relating to identifiable individuals remain personal data. Controllers must still meet other GDPR requirements for the processing itself.