DPL – AllNet Law

This multiple choice assessment focuses on the new General Data Protection Regulation (GDPR).

The purpose of the assessment is to enable you to assess the extent and depth of your knowledge of the Data Protection Law in preparation for the DPL.

Format: Multiple Choice

Time: 90 minutes

The result will be provided immediately, with details on all questions.

Full Name

Email

Which of the following is NOT one of the GDPR data protection principles?

Data minimisation.

Purpose imitation.

Data encryption.

Storage limitation.

Which of the following is used to best demonstrate transparency, by explaining how Company X uses personal data?

BYOD Policy

Retention Policy

Data Protection Policy

Privacy Notice.

What is the purpose of Pseudonymisation?

It makes it impossible to attribute a piece of data to a specific person without additional information.

It mitigates the requirement for consent.

It encrypts data so it cannot be read if accessed by hackers.

It negates the requirement to fulfil a data subject request.

Company X is looking to carry out new clinical trials and is considering using study subjects from another research that they previously carried out.

Identify the MOST appropriate lawful basis for processing:

Public interest.

Business to business.

Explicit consent.

Contract

Which of the following Article 9 (GDPR) conditions of processing may be used to store health data after the completion of the study?

Legitimate interests.

Public health.

Contract

Profiling.

Which BEST describes the purpose of a Data Protection Impact Assessment (DPIA)?

To ensure personal data is encrypted.

To assist in effectively tracking consent.

To help you identify and minimise the data protection risks of a project.

To help you decide if you can use legitimate interests as a lawful basis.

What does Data Minimisation mean?

Only processing data, which is adequate, relevant, and limited to what is necessary.

Compressing digital data files.

Writing people's data down in shorthand.

Using and storing only electronic files.

Which BEST describes data protection by ‘design and default’?

Employing a dedicated Data Protection Officer to ensure policies are in place.

Always using the best available security solution for any personal data.

Deploying appropriate technical and organisational measures to meet the GDPR principles.

Ensuring consent is always obtained when processing personal data.

9) Which of the following statements regarding Data Protection Officers (DPOs) is FALSE?

The DPO must report to the highest management level.

A DPO may perform additional job roles.

The DPO must be a permanent employee.

A DPO's role has a protected status.

When processing personal data under the authority of the controller or processor, a processor may process data on instructions from the controller and also:

Under Legitimate Interests.

For business to business marketing.

Where required to do so by Kingdom or Member State law.

For service messages only.

Which of the following describes a country which has similar data protection standards as the EU GDPR and has received approval from the European Commission?

Privacy Shield.

Adequacy.

Derogations.

Compliance.

Under which circumstances may a data subject request be refused:

Releasing the data could be damaging to the business.

It involves disclosing personal information about other people.

The data subject is under the age of 14.

The data subject has refused to pay the fee.

"It's not enough to just follow the Regulation, you also need to PROVE that you're following the Regulation". Which Principle of the GDPR does this apply to?

Accountability

Storage Limitation

Integrity and Confidentiality

Accuracy

Under which circumstances are personal data breaches NOT reportable to an independent supervisory authority?

There is an unlikely risk to the data subject.

It could make the company liable to legal action by the data subject.

The data was breached by a third-party data processor.

The company does not conduct large-scale, systematic processing of data.

Which of the following would not be defined as special category data, under the EU GDPR?

A mobile app which stores individuals Covid test results.

A list of Trade Union members who work for a public sector organisation.

A voice recording used to identify and validate people who ring into a contact centre.

A hospital record holding the medical cause of death of an identified individual.

Please use the following information to answer the below question

Michael is a member of the golf club, Potters Bar. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in Spain.

Michael lives in Derry, Northern Ireland (part of the U.K.), and commutes across the border to work in Lough Foyle, Ireland. Two years ago while on a business trip, Michael was photographed during a Potters Bar golf tournament in Stockholm, Sweden. At the time, Michael gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only.

Since then the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the golf club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states.

As a result, Michael no longer feels comfortable with his photograph being associated with the golf club.

After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Michael sends a letter to Potters Bar requesting that his image be removed from the website and all promotional materials.

Months pass and Michael, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact Potters Bar through alternate channels, he decides to take action against the company.

Michael reports to a Data Protection Authority.

Question:
Under the cooperation mechanism, what should the lead authority do after it has formed its view on the matter?

Submit a draft decision to other supervisory authorities for their opinion.

Request that the other supervisory authorities provide the lead authority with a draft decision for its consideration.

Submit a draft decision directly to the Commission to ensure the effectiveness of the consistency mechanism.

Request that members of the seconding supervisory authority and the host supervisory authority co-draft a decision.

Please use the following information to answer the below question

Michael is a member of the golf club, Potters Bar. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in Spain.

Michael lives in Derry, Northern Ireland (part of the U.K.), and commutes across the border to work in Lough Foyle, Ireland. Two years ago while on a business trip, Michael was photographed during a Potters Bar golf tournament in Stockholm, Sweden. At the time, Michael gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only.

Since then the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the golf club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states.

As a result, Michael no longer feels comfortable with his photograph being associated with the golf club.

After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Michael sends a letter to Potters Bar requesting that his image be removed from the website and all promotional materials.

Months pass and Michael, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact Potters Bar through alternate channels, he decides to take action against the company.

Michael reports to a Data Protection Authority.

Question:
Assuming that multiple Potters Bar branches across the UK and several EU countries are acting as separate data controllers, and that each of those branches were responsible for mishandling Michael's request, how may Michael proceed in order to seek compensation?

He will have to sue Potters Bar’s head office in Spain, where Potters Bar's has its main establishment.

He will be able to sue any one of the relevant Potters Bar branches, as each one may be held liable for the entire damage.

He will have to sue each Potters Bar's branch so that each branch provides proportionate compensation commensurate with its contribution to the damage or distress suffered by Michael.

He will be able to apply to the European Data Protection Board in order to determine which particular Potters Bar branch is liable for damages, based on the decision that was made by the board.

Please use the following information to answer the below question

Michael is a member of the golf club, Potters Bar. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in Spain.

Michael lives in Derry, Northern Ireland (part of the U.K.), and commutes across the border to work in Lough Foyle, Ireland. Two years ago while on a business trip, Michael was photographed during a Potters Bar golf tournament in Stockholm, Sweden. At the time, Michael gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only.

Since then the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the golf club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states.

As a result, Michael no longer feels comfortable with his photograph being associated with the golf club.

After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Michael sends a letter to Potters Bar requesting that his image be removed from the website and all promotional materials.

Months pass and Michael, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact Potters Bar through alternate channels, he decides to take action against the company.

Michael reports to a Data Protection Authority.

Question:
Which area of privacy is a lead supervisory authority's (SA) MAIN concern?

Data subject rights

Cross border processing

Data access disputes

Special categories of data

19) A research company has an email subscription scheme which allows study subjects to provide their name and email address in order to receive news about a study. Unknown to the subjects the company also sells this data to other organisations who develop medical apps. This is a breach of which Principle of the GDPR?

Storage Limitation

Purpose Limitation

Accuracy

Data Minimisation

20) Which of these is not Personal Data?

adam.smith@aol.com.

Fingerprints

info@aloula.sa

IP Address