Question 1

Article 29 Working Party has emphasized that the GDPR forbids “forum shopping”, which occurs when companies do what?

Accepted Answer

Correct answer: B

Question 2

In the event of a data breach, which type of information are data controllers NOT required to provide to either the supervisory authorities or the data subjects?

Accepted Answer

Correct answer: D

Question 3

In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?

Accepted Answer

Correct answer: B

Question 4

SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The
University maintains a number of types of records:
 Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of
special educational needs and financial information.
 Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
 Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees.
These records are available to former students after registering through Granchester’s Alumni portal. Department for Education records, showing how certain
demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification
numbers.
 Under their security policy, the University encrypts all of its personal data records in transit and at rest. In order to improve his teaching, Frank wants to
investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna’s data protection training
courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student
data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the
individual student level. Mindful of Anna’s training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He
uses the same algorithm on each occasion so that he can update each record over time.
One of Anna’s tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR.
After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects
that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after
she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the
laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security
incidents, so he decides to tell Anna about his lost laptop at the same time.
Before Anna determines whether Frank’s performance database is permissible, what additional information does she need?

Accepted Answer

Correct answer: D

Question 5

Which sentence best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?

Accepted Answer

Correct answer: C

Question 6

SCENARIO
Please use the following to answer the next question:
Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a few months ago. Although no one was hurt, Louis has been plagued by
texts and calls from a company called Accidentable offering to help him recover compensation for personal injury. Louis has heard about insurance companies
selling customers’ data to third parties, and he’s convinced that Accidentable must have gotten his information from Bedrock Insurance.
Louis has also been receiving an increased amount of marketing information from Bedrock, trying to sell him their full range of their insurance policies.
Perturbed by this, Louis has started looking at price comparison sites on the internet and has been shocked to find that other insurers offer much cheaper rates
than Bedrock, even though he has been a loyal customer for many years. When his Bedrock policy comes up for renewal, he decides to switch to Zantrum
Insurance.
In order to activate his new insurance policy, Louis needs to supply Zantrum with information about his No Claims bonus, his vehicle and his driving history. After
researching his rights under the GDPR, he writes to ask Bedrock to transfer his information directly to Zantrum. He also takes this opportunity to ask Bedrock to
stop using his personal data for marketing purposes.
Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Louis it cannot transfer his data directly
to Zantrum as this is not technically feasible. Bedrock also explains that Louis’s contract included a provision whereby Louis agreed that his data could be used for
marketing purposes; according to Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which
was filled with legal jargon and very confusing.
In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He writes to Accidentable to ask for the name of the organization that
supplied his details to them. He warns Accidentable that he plans to complain to the data protection authority, because he thinks their company has been using his
data unlawfully. His letter states that he does not want his data being used by them in any way.
Accidentable’s response letter confirms Louis’s suspicions. Accidentable is Bedrock Insurance’s wholly
owned subsidiary, and they received information about Louis’s accident from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis
that there has been no breach of the GDPR, as Louis’s contract included, a provision in which he agreed to share his information with Bedrock’s affiliates for
business purposes.
Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them insisting that all his information be erased from their computer system.
After Louis has exercised his right to restrict the use of his data, under what conditions would Accidentable have grounds for refusing to comply?

Accepted Answer

Correct answer: A

Question 7

Which of the following entities would most likely be exempt from complying with the GDPR?

Accepted Answer

Correct answer: C

Question 8

Please use the following to answer the next question:
WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of
their service, WonderKids will pass all personal data
provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person
booking the childcare, address and contact details, as well as information about the children to be cared for including name, age, gender and health information.
The privacy statement on Wonderkids’ website states the following:
“WonderkKids provides the information you disclose to us through this website to your childcare provider for scheduling and health and safety reasons. We may
also use your and your child’s personal information for our own legitimate business purposes and we employ a third-party website hosting company located in
Switzerland to store the data. Any data stored on equipment located in Switzerland meets the European Commission provisions for guaranteeing adequate
safeguards for you and your child’s personal information. We will only share you and your child’s personal information with businesses that we see as adding real
value to you. By providing us with any personal data, you consent to its transfer to affiliated businesses and to send you promotional offers.”
“We may retain you and your child’s personal information for no more than 28 days, at which point the data will be depersonalized, unless your personal
information is being used for a legitimate business purpose beyond 28 days where it may be retained for up to 2 years.”
“We are processing you and your child’s personal information with your consent. If you choose not to provide certain information to us, you may not be able to use
our services. You have the right to: request access to you and your child’s personal information; rectify or erase you or your child’s personal information; the right
to correction or erasure of you and/or your child’s personal information; object to any processing of you and your child’s personal information. You also have the
right to complain to the supervisory authority about our data processing activities.”
What direct marketing information can WonderKids send by email without prior consent of the person booking the childcare?

Accepted Answer

Correct answer: C

Question 9

When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?

Accepted Answer

Correct answer: C

Question 10

To provide evidence of GDPR compliance, a company performs an internal audit. As a result, it finds a data base, password-protected, listing all the social network
followers of the client.
Regarding the domain of the controller-processor relationships, how is this situation considered?

Accepted Answer

Correct answer: B