Which of the following is NOT an obligation of MessageSafe as the email continuity service provider for A&M LLP?

SCENARIO

Please use the following to answer the next QUESTION:

John is the new privacy officer at the prestigious international law firm C A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe.

During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm’s email continuity service to their existing email security vendor C MessageSafe. Being successful as an email hygiene vendor, MessageSafe is expanding its business by leasing cloud infrastructure from Cloud Inc. to host email continuity service for A&M LLP.

John is very concerned about this initiative. He recalled that MessageSafe was in the news six months ago due to a security breach. Immediately, John did a quick research of MessageSafe’s previous breach and learned that the breach was caused by an unintentional mistake by an IT administrator. He scheduled a meeting with Derrick to address his concerns.

At the meeting, Derrick emphasized that email is the primary method for the firm’s lawyers to communicate with clients, thus it is critical to have the email continuity service to avoid any possible email downtime. Derrick has been using the anti-spam service provided by MessageSafe for five years and is very happy with the quality of service provided by MessageSafe. In addition to the significant discount offered by MessageSafe, Derrick emphasized that he can also speed up the onboarding process since the firm already has a service contract in place with MessageSafe. The existing on-premises email continuity solution is about to reach its end of life very soon and he doesn’t have the time or resource to look for another solution. Furthermore, the off- premises email continuity service will only be turned on when the email service at A&M LLP’s primary and secondary data centers are both down, and the email messages stored at MessageSafe site for continuity service will be automatically deleted after 30 days.

Which of the following is NOT an obligation of MessageSafe as the email continuity service provider for A&M LLP?
A . Privacy compliance.
B . Security commitment.
C . Certifications to relevant frameworks.
D . Data breach notification to A&M LLP.

View Answer

Answer: C

Explanation:

An obligation that is not applicable to MessageSafe as the email continuity service provider for A&M LLP is obtaining certifications to relevant frameworks. Certifications are voluntary mechanisms that enable data controllers or processors to demonstrate their compliance with the GDPR or other standards by obtaining a certification issued by an accredited certification body7 Certifications can provide benefits such as enhancing transparency, accountability, trust, and competitive advantage for data controllers or processors. However, they are not mandatory under the GDPR or other laws and do not reduce or eliminate the legal obligations or liabilities of data controllers or processors8 Therefore, MessageSafe is not obliged to obtain certifications to relevant frameworks as the email continuity service provider for A&M LLP. However, it may choose to do so if it wishes to showcase its compliance efforts or gain a competitive edge in the market.

Reference: 7: Article 42 GDPR | General Data Protection Regulation (GDPR); 8: Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation 2016/679 | European Data Protection Board