DPL-1-3 – AllNet Law

This multiple choice assessment focuses on the new General Data Protection Regulation (GDPR).

The purpose of the assessment is to enable you to assess the extent and depth of your knowledge of the Data Protection Law in preparation for the DPL.

Format: Multiple Choice

Time: 90 minutes

The result will be provided immediately, with details on all questions.

Full Name

Email

1) Under which circumstances may a data subject request be refused:

Releasing the data could be damaging to the business.

It involves disclosing personal information about other people.

The data subject is under the age of 14.

The data subject has refused to pay the fee.

2) When processing personal data under the authority of the controller or processor, a processor may process data on instructions from the controller and also:

Under Legitimate Interests.

For business to business marketing.

Where required to do so by an EU or Member State law.

For service messages only.

3) What is the purpose of Pseudonymisation?

It makes it impossible to attribute a piece of data to a specific person without additional information.

It mitigates the requirement for consent.

It encrypts data so it cannot be read if accessed by hackers.

It negates the requirement to fulfil a data subject request.

4) Company X is looking to carry out new clinical trials and is considering using study subjects from another research that they previously carried out.

Identify the MOST appropriate lawful basis for processing:

Public interest.

Business to business.

Explicit consent.

Contract

5) A data subject makes a subject access request (SAR) to an online retail company for their personal data. The data subject states that they are making a SAR in accordance with the GDPR; however, if the company credits the data subject’s online account with a specified sum of money, the data subject will withdraw their request. The company has not had any previous access requests by other individuals. Which of the following would be legitimate grounds for the company to refuse to comply with the access request?

The request is manifestly unfounded or excessive.

The request is frivolous and will be time consuming.

No other individual has made a similar request for access.

The company has a policy in place rejecting all access requests.

6) Which of the following Article 9 (GDPR) conditions of processing may be used to store health data after the completion of the study?

Legitimate interests.

Public health.

Contract

Profiling.

7) What does Data Minimisation mean?

Only processing data, which is adequate, relevant, and limited to what is necessary.

Compressing digital data files.

Writing people's data down in shorthand.

Using and storing only electronic files.

8) "It's not enough to just follow the Regulation, you also need to PROVE that you're following the Regulation". Which Principle of the GDPR does this apply to?

Accountability

Storage Limitation

Integrity and Confidentiality

Accuracy

10) Based on Article 5(1)(b) of the GDPR, what is the impact of the interpretation of the word 'incompatible'?

Dictates level of security a processor must follow when using and storing personal data for two different purposes B. sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data as you can only further process for compatible reasons to the original reason you give for processing....) C. Indicates the degree of flexibility a controller has in using personal data in ways that vary from the original purpose D. Indicates the authority the Data Protection Authority has over the use of the personal data

Sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data as you can only further process for compatible reasons to the original reason you give for processing....)

Indicates the degree of flexibility a controller has in using personal data in ways that vary from the original purpose

Indicates the authority the Data Protection Authority has over the use of the personal data

9) A research company has an email subscription scheme which allows study subjects to provide their name and email address in order to receive news about a study. Unknown to the subjects the company also sells this data to other organisations who develop medical apps. This is a breach of which Principle of the GDPR?

Storage Limitation

Purpose Limitation

Accuracy

Data Minimisation