A travel platform uses an Article 49 contractual-necessity derogation for occasional transfers needed to complete a guest’s hotel booking abroad, then proposes the same derogation to justify building a permanent offshore analytics data lake. What distinction should counsel draw?
Select an answer to reveal the explanation.
Short Explanation
Using a narrow booking-necessity derogation for a one-off hotel handoff is different from pouring every guest into a forever offshore data lake. Exceptions are for specific situations—not a permanent architecture plan. Build proper safeguards if analytics will live abroad day after day.
Full Explanation
Article 49 contractual-necessity derogations can justify certain transfers that are necessary for the performance of a contract with the data subject—such as occasional transfers needed to complete a guest’s hotel booking abroad. They are not suited as the standing basis for building a permanent offshore analytics data lake that systematically exports personal data for secondary analysis. Derogations are exceptions; architecture for ongoing bulk processing should use Article 45 or 46 safeguards. Travel platforms serving the travelling public must keep that distinction bright.
Prior bookings do not stretch contractual-necessity into permanent offshore lakes. Article 49 is not reserved only to public authorities. Using a derogation once does not switch off Chapter V for later analytics exports.
Exam caveat: “necessary for the contract” is narrower than “useful for our business intelligence.” Analytics lakes usually fail necessity for Article 49 and need proper safeguards plus a lawful basis for the analytics purpose itself.
Operational check: allow Article 49 only on documented booking-fulfilment paths, move analytics to an adequate region or SCC/BCR-covered environment with a TIA, and update records so derogations never appear as the lake’s primary transfer story.