DPL

"It's not enough to just follow the Regulation, you also need to PROVE that you're following the Regulation". Which Principle of the GDPR does this apply to?

Deselect Answer

Integrity and Confidentiality

Storage Limitation

Accuracy

Accountability

Which of the following Article 9 (GDPR) conditions of processing may be used to store health data after the completion of the study?

Deselect Answer

Legitimate interests.

Profiling.

Public health.

Contract

What is the purpose of Pseudonymisation?

Deselect Answer

It negates the requirement to fulfil a data subject request.

It makes it impossible to attribute a piece of data to a specific person without additional information.

It encrypts data so it cannot be read if accessed by hackers.

It mitigates the requirement for consent.

Company X is looking to carry out new clinical trials and is considering using study subjects from another research that they previously carried out.

Identify the MOST appropriate lawful basis for processing:

Deselect Answer

Public interest.

Contract

Business to business.

Explicit consent.

Please use the following information to answer the below question

Michael is a member of the golf club, Potters Bar. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in Spain.

Michael lives in Derry, Northern Ireland (part of the U.K.), and commutes across the border to work in Lough Foyle, Ireland. Two years ago while on a business trip, Michael was photographed during a Potters Bar golf tournament in Stockholm, Sweden. At the time, Michael gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only.

Since then the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the golf club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states.

As a result, Michael no longer feels comfortable with his photograph being associated with the golf club.

After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Michael sends a letter to Potters Bar requesting that his image be removed from the website and all promotional materials.

Months pass and Michael, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact Potters Bar through alternate channels, he decides to take action against the company.

Michael reports to a Data Protection Authority.

Question:
Under the cooperation mechanism, what should the lead authority do after it has formed its view on the matter?

Deselect Answer

Request that members of the seconding supervisory authority and the host supervisory authority co-draft a decision.

Request that the other supervisory authorities provide the lead authority with a draft decision for its consideration.

Submit a draft decision directly to the Commission to ensure the effectiveness of the consistency mechanism.

Submit a draft decision to other supervisory authorities for their opinion.

Which of the following describes a country which has similar data protection standards as the EU GDPR and has received approval from the European Commission?

Deselect Answer

Compliance.

Adequacy.

Privacy Shield.

Derogations.

20) Which of these is not Personal Data?

Deselect Answer

IP Address

Fingerprints

adam.smith@aol.com.

info@aloula.sa

Which BEST describes the purpose of a Data Protection Impact Assessment (DPIA)?

Deselect Answer

To assist in effectively tracking consent.

To ensure personal data is encrypted.

To help you identify and minimise the data protection risks of a project.

To help you decide if you can use legitimate interests as a lawful basis.

What does Data Minimisation mean?

Deselect Answer

Writing people's data down in shorthand.

Using and storing only electronic files.

Compressing digital data files.

Only processing data, which is adequate, relevant, and limited to what is necessary.

Please use the following information to answer the below question

Michael is a member of the golf club, Potters Bar. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in Spain.

Michael lives in Derry, Northern Ireland (part of the U.K.), and commutes across the border to work in Lough Foyle, Ireland. Two years ago while on a business trip, Michael was photographed during a Potters Bar golf tournament in Stockholm, Sweden. At the time, Michael gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only.

Since then the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the golf club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states.

As a result, Michael no longer feels comfortable with his photograph being associated with the golf club.

After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Michael sends a letter to Potters Bar requesting that his image be removed from the website and all promotional materials.

Months pass and Michael, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact Potters Bar through alternate channels, he decides to take action against the company.

Michael reports to a Data Protection Authority.

Question:
Assuming that multiple Potters Bar branches across the UK and several EU countries are acting as separate data controllers, and that each of those branches were responsible for mishandling Michael's request, how may Michael proceed in order to seek compensation?

Deselect Answer

He will have to sue Potters Bar’s head office in Spain, where Potters Bar's has its main establishment.

He will be able to sue any one of the relevant Potters Bar branches, as each one may be held liable for the entire damage.

He will have to sue each Potters Bar's branch so that each branch provides proportionate compensation commensurate with its contribution to the damage or distress suffered by Michael.

He will be able to apply to the European Data Protection Board in order to determine which particular Potters Bar branch is liable for damages, based on the decision that was made by the board.

19) A research company has an email subscription scheme which allows study subjects to provide their name and email address in order to receive news about a study. Unknown to the subjects the company also sells this data to other organisations who develop medical apps. This is a breach of which Principle of the GDPR?

Deselect Answer

Storage Limitation

Purpose Limitation

Data Minimisation

Accuracy

When processing personal data under the authority of the controller or processor, a processor may process data on instructions from the controller and also:

Deselect Answer

Under Legitimate Interests.

Where required to do so by Kingdom or Member State law.

For service messages only.

For business to business marketing.

9) Which of the following statements regarding Data Protection Officers (DPOs) is FALSE?

Deselect Answer

A DPO's role has a protected status.

A DPO may perform additional job roles.

The DPO must be a permanent employee.

The DPO must report to the highest management level.

Which of the following would not be defined as special category data, under the EU GDPR?

Deselect Answer

A hospital record holding the medical cause of death of an identified individual.

A list of Trade Union members who work for a public sector organisation.

A voice recording used to identify and validate people who ring into a contact centre.

A mobile app which stores individuals Covid test results.

Under which circumstances may a data subject request be refused:

Deselect Answer

Releasing the data could be damaging to the business.

The data subject has refused to pay the fee.

The data subject is under the age of 14.

It involves disclosing personal information about other people.

Which of the following is NOT one of the GDPR data protection principles?

Deselect Answer

Data encryption.

Storage limitation.

Purpose imitation.

Data minimisation.

Under which circumstances are personal data breaches NOT reportable to an independent supervisory authority?

Deselect Answer

The data was breached by a third-party data processor.

There is an unlikely risk to the data subject.

The company does not conduct large-scale, systematic processing of data.

It could make the company liable to legal action by the data subject.

Which BEST describes data protection by ‘design and default’?

Deselect Answer

Deploying appropriate technical and organisational measures to meet the GDPR principles.

Always using the best available security solution for any personal data.

Employing a dedicated Data Protection Officer to ensure policies are in place.

Ensuring consent is always obtained when processing personal data.

Please use the following information to answer the below question

Michael is a member of the golf club, Potters Bar. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in Spain.

Michael lives in Derry, Northern Ireland (part of the U.K.), and commutes across the border to work in Lough Foyle, Ireland. Two years ago while on a business trip, Michael was photographed during a Potters Bar golf tournament in Stockholm, Sweden. At the time, Michael gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only.

Since then the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the golf club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states.

As a result, Michael no longer feels comfortable with his photograph being associated with the golf club.

After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Michael sends a letter to Potters Bar requesting that his image be removed from the website and all promotional materials.

Months pass and Michael, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact Potters Bar through alternate channels, he decides to take action against the company.

Michael reports to a Data Protection Authority.

Question:
Which area of privacy is a lead supervisory authority's (SA) MAIN concern?

Deselect Answer

Cross border processing

Data access disputes

Special categories of data

Data subject rights

Which of the following is used to best demonstrate transparency, by explaining how Company X uses personal data?

Deselect Answer

Retention Policy

Data Protection Policy

Privacy Notice.

BYOD Policy

DPL

About Us

Services

General