CIPPE M4 – AllNet Law

This multiple choice assessment focuses on the new General Data Protection Regulation (GDPR).

The purpose of the assessment is to enable you to assess the extent and depth of your knowledge of the Data Protection Law in preparation for the DPL.

Format: Multiple Choice

Time: 90 minutes

The result will be provided immediately, with details on all questions.

Full Name

Email

1) Which of the following is NOT one of the GDPR data protection principles?

Data minimisation.

Purpose limitation.

Data encryption.

Storage limitation.

2) Company X is looking to carry out new clinical trials and is considering using study subjects from another research that they previously carried out.

Identify the MOST appropriate lawful basis for processing:

Public interest.

Business to business.

Explicit consent.

Contract

3) Which of the following Article 9 (GDPR) conditions of processing may be used to store health data after the completion of the study?

Legitimate interests.

Public health.

Contract

Profiling.

4) What does Data Minimisation mean?

Only processing data, which is adequate, relevant, and limited to what is necessary.

Compressing digital data files.

Writing people's data down in shorthand.

Using and storing only electronic files.

5) "It's not enough to just follow the Regulation, you also need to PROVE that you're following the Regulation". Which Principle of the GDPR does this apply to?

Accountability

Storage Limitation

Integrity and Confidentiality

Accuracy

6) Based on Article 5(1)(b) of the GDPR, what is the impact of the interpretation of the word 'incompatible'?

Dictates level of security a processor must follow when using and storing personal data for two different purposes.

Sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data as you can only further process for compatible reasons to the original reason you give for processing....)

Indicates the degree of flexibility a controller has in using personal data in ways that vary from the original purpose

Indicates the authority the Data Protection Authority has over the use of the personal data

7) A research company has an email subscription scheme which allows study subjects to provide their name and email address in order to receive news about a study. Unknown to the subjects the company also sells this data to other organisations who develop medical apps. This is a breach of which Principle of the GDPR?

Storage Limitation

Purpose Limitation

Accuracy

Data Minimisation

8) CleanAl is a start-up company developing an Al system that will be part of a medical device used to detect skin cancer. To ensure the system is free of racial or gender bias in its Al system, the IT Team collects features which include the individual's gender and ethnicity. Which of the following would be the most appropriate legal basis for this processing under the GDPR, Article 9 (Processing of special categories of personal data)?

Processing necessary for reasons of substantial public interest.

Processing necessary for scientific or statistical purposes.

Processing necessary for purposes of preventive or occupational medicine.

Processing necessary for the defense of legal claims in potential negligence cases.

9) According to the GDPR. Article 4(14). biometric data is defined as: 'Personal data resulting from specific technical processing relating to the_________, _______ or _______ characteristics of a natural person. Which term could NOT be placed in the above definition?

Physiological

Physical

Intellectual

Behavioural

10) Under what condition may the processing ‘sensitive employee data’ be acceptable?

The processing is necessary for the performance of a contract to which the individual is a party.

The processing is necessary for the data controller to carry out their obligation in the field of employment law.

The processing is necessary for the interest of both the data controller and the employee.

The processing is necessary for the interests pursued by the data controller.

11) Which of the following is not covered in the 3-part test of the Legitimate Interest Assessment?

Purpose Test

Complexity Test

Necessity Test

Balancing Test

12) An online furniture store requires customers to consent to their details being shared with other homeware stores as part of the checkout process. The store is making consent a condition of sale – in order to share the data with other stores, which is not necessary for that sale. Which of the below describes the above scenario?

Consent is freely given

Consent is not freely given

Consent is implied

Consent is valid

13) Which is NOT a compatible purpose for processing data beyond the purpose originally specified at the time of collection?

legitimate Interest of the Controller

transferring data to an archive for public interest

statistical purposes carried out by the Controller

historical or scientific research by the Controller