CIPPE Module 11 – AllNet Law

This multiple choice assessment focuses on the General Data Protection Regulation (GDPR).

Enforcement and Penalties

Format: Multiple Choice

Time: 15 minutes

The result will be provided immediately, with details on all questions.

Full Name

Email

1) Who does the GDPR task with promoting, monitoring and enforcing the GDPR?

A. Controllers

B. Processors

C. Supervisory authorities

D. The European Data Protection Supervisor

2) Which mechanism facilitates the provision of relevant information between supervisory authorities?

A. Cooperation

B. Mutual assistance

C. Consistency mechanism

D. Urgency procedure

3) Which mechanism facilitates a specific collaborative process between supervisory authorities, the Commission and the European Data Protection Board for adopting certain measures and ensuring consistent GDPR application?

A. Cooperation

B. Joint operations

C. Consistency mechanism

D. Dispute resolution

4) Which area of privacy is a lead supervisory authority's (SA) MAIN concern?

A. Data subject rights

B. Cross border processing

C. Data access disputes

D. Special categories of data

5) Read the scenario below and answer the following question:

Michael is a member of the golf club, Potters Bar. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in Spain.

Michael lives in Derry, Northern Ireland (part of the U.K.), and commutes across the border to work in Lough Foyle, Ireland. Two years ago while on a business trip, Michael was photographed during a Potters Bar golf tournament in Stockholm, Sweden. At the time, Michael gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the golf club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Michael no longer feels comfortable with his photograph being associated with the golf club.

After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Michael sends a letter to Potters Bar requesting that his image be removed from the website and all promotional materials.

Months pass and Michael, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact Potters Bar through alternate channels, he decides to take action against the company.

Michael reports to an SA.

Under the cooperation mechanism, what should the lead authority do after it has formed its view on the matter?

A. Submit a draft decision to other supervisory authorities for their opinion.

B. Request that the other supervisory authorities provide the lead authority with a draft decision for its consideration.

C. Submit a draft decision directly to the Commission to ensure the effectiveness of the consistency mechanism.

D. Request that members of the seconding supervisory authority and the host supervisory authority co-draft a decision.

6) Assuming that multiple Potters Bar branches across several EU countries are acting as separate data controllers, and that each of those branches were responsible for mishandling Michael's request, how may Michael proceed in order to seek compensation?

A. He will have to sue Potters Bar’s head office in Spain, where Potters Bar's has its main establishment.

B. He will be able to sue any one of the relevant Potters Bar branches, as each one may be held liable for the entire damage.

C. He will have to sue each Potters Bar's branch so that each branch provides proportionate compensation commensurate with its contribution to the damage or distress suffered by Michael.

D. He will be able to apply to the European Data Protection Board in order to determine which particular Potters Bar branch is liable for damages, based on the decision that was made by the board.

7) How many active participants will the European Data Protection Board have?

A. 30

B. 27

C. 21

D. 38

8) According to the GDPR, any administrative fine issued in an individual case shall:

A. Be at least two percent of the organisations’ worldwide turnover

B. Be no more than 10 million euros

C. Be effective, proportionate and dissuasive

D. Have regard to the controller or processor’s ability to pay the fine within a reasonable time period