DPL-1-4 – AllNet Law

This multiple choice assessment focuses on the new General Data Protection Regulation (GDPR).

The purpose of the assessment is to enable you to assess the extent and depth of your knowledge of the Data Protection Law in preparation for the DPL.

Format: Multiple Choice

Time: 90 minutes

The result will be provided immediately, with details on all questions.

Full Name

Email

1) Which of the following is NOT one of the GDPR data protection principles?

Data minimisation.

Purpose limitation.

Data encryption.

Storage limitation.

2) When processing personal data under the authority of the controller or processor, a processor may process data on instructions from the controller and also:

Under Legitimate Interests.

For business to business marketing.

Where required to do so by an EU or Member State law.

For service messages only.

3) What is the purpose of Pseudonymisation?

It makes it impossible to attribute a piece of data to a specific person without additional information.

It mitigates the requirement for consent.

It encrypts data so it cannot be read if accessed by hackers.

It negates the requirement to fulfil a data subject request.

4) Company X is looking to carry out new clinical trials and is considering using study subjects from another research that they previously carried out.

Identify the MOST appropriate lawful basis for processing:

Public interest.

Business to business.

Explicit consent.

Contract

5) Which of the following Article 9 (GDPR) conditions of processing may be used to store health data after the completion of the study?

Legitimate interests.

Public health.

Contract

Profiling.

6) Which of the following would definitely not be special category data?

A mobile app which stores individuals Covid test results.

A list of Trade Union members who work for a public sector organisation.

A voice recording used to identify and validate people who ring into a contact centre.

A hospital record holding the medical cause of death of an identified individual.

7) What does Data Minimisation mean?

Only processing data, which is adequate, relevant, and limited to what is necessary.

Compressing digital data files.

Writing people's data down in shorthand.

Using and storing only electronic files.

8) "It's not enough to just follow the Regulation, you also need to PROVE that you're following the Regulation". Which Principle of the GDPR does this apply to?

Accountability

Storage Limitation

Integrity and Confidentiality

Accuracy

9) Based on Article 5(1)(b) of the GDPR, what is the impact of the interpretation of the word 'incompatible'?

Dictates level of security a processor must follow when using and storing personal data for two different purposes.

Sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data as you can only further process for compatible reasons to the original reason you give for processing....)

Indicates the degree of flexibility a controller has in using personal data in ways that vary from the original purpose

Indicates the authority the Data Protection Authority has over the use of the personal data

10) A research company has an email subscription scheme which allows study subjects to provide their name and email address in order to receive news about a study. Unknown to the subjects the company also sells this data to other organisations who develop medical apps. This is a breach of which Principle of the GDPR?

Storage Limitation

Purpose Limitation

Accuracy

Data Minimisation