I85PREP
⌘ K
CIPP/E study materials
CIPP/E study resources

CIPP/E practice questions

One question at a time. Build your CIPP/E understanding.

First 50 of 198 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to European Data Protection

Which instrument is widely regarded as the first legally binding international treaty dedicated to the protection of personal data?

  1. Council of Europe Convention 108 Correct answer.
  2. The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data
  3. The Charter of Fundamental Rights of the European Union
  4. Directive 95/46/EC

Explanation

Convention 108, opened for signature in 1981 within the Council of Europe, was the first legally binding international instrument devoted to data protection. Its principles strongly influenced the later EU regime, including Directive 95/46/EC and the GDPR.

Question 2Introduction to European Data Protection

What was the principal mechanism by which Directive 95/46/EC took effect in the Member States?

  1. It applied directly, without any national implementing measure
  2. It was given effect solely through decisions of the European Court of Justice
  3. It was ratified by each national parliament as a treaty
  4. It required each Member State to transpose its provisions into national law Correct answer.

Explanation

A directive binds Member States as to the result to be achieved while leaving them the choice of form and methods, so Directive 95/46/EC had to be transposed into national law. Divergent national implementations produced the fragmentation that the GDPR later set out to remove.

Question 3Introduction to European Data Protection

From which date did the General Data Protection Regulation become applicable?

  1. 24 May 2016
  2. 1 January 2021
  3. 25 May 2018 Correct answer.
  4. 25 January 2012

Explanation

The GDPR entered into force on 24 May 2016 but applied only from 25 May 2018, after a two-year transitional period during which organisations and Member States could prepare.

Question 4Introduction to European Data Protection

Which provision of the Charter of Fundamental Rights of the European Union specifically guarantees the protection of personal data?

  1. Article 7
  2. Article 16
  3. Article 52
  4. Article 8 Correct answer.

Explanation

Article 8 of the Charter creates a distinct fundamental right to the protection of personal data, separate from the right to respect for private and family life. It requires that data be processed fairly, for specified purposes and on a legitimate basis or with consent, and that an independent authority supervise compliance.

Question 5Introduction to European Data Protection

Which Treaty provision gives the EU its specific competence to adopt legislation on the protection of personal data?

  1. Article 29 of Directive 95/46/EC
  2. Article 8 of the European Convention on Human Rights
  3. Article 16 TFEU Correct answer.
  4. Article 5 TEU

Explanation

Article 16(1) TFEU establishes the right to the protection of personal data and Article 16(2) empowers the European Parliament and the Council to lay down rules on the subject by the ordinary legislative procedure. The GDPR was adopted on that legal basis.

Question 6Introduction to European Data Protection

Article 8 of the European Convention on Human Rights principally protects which of the following?

  1. The right to an effective remedy before a national court
  2. The right to respect for private and family life, home and correspondence Correct answer.
  3. The right to freedom of expression
  4. The right to protection of personal data held by private companies

Explanation

Article 8(1) ECHR guarantees respect for private and family life, home and correspondence, and interferences must be in accordance with law and necessary in a democratic society. European data protection law developed largely as an outgrowth of that guarantee.

Question 7Introduction to European Data Protection

Which body is responsible for supervising the processing of personal data carried out by EU institutions, bodies, offices and agencies?

  1. The European Data Protection Supervisor Correct answer.
  2. The Fundamental Rights Agency
  3. The Article 29 Working Party
  4. The European Data Protection Board

Explanation

The European Data Protection Supervisor is an independent supervisory authority that monitors how EU institutions and bodies process personal data. Its powers and the applicable rules are now set out in Regulation (EU) 2018/1725.

Question 8Introduction to European Data Protection

How does a European Union regulation differ from a directive?

  1. It is directly applicable in every Member State without transposition Correct answer.
  2. It sets minimum standards that Member States may supplement or exceed
  3. It binds only those Member States to which it is specifically addressed
  4. It must be ratified by each national parliament before it takes effect

Explanation

Under Article 288 TFEU a regulation is binding in its entirety and directly applicable in all Member States, whereas a directive binds as to the result to be achieved and requires transposition. The GDPR was cast as a regulation precisely to secure uniform application.

Question 9Introduction to European Data Protection

In Case C-362/14 Schrems (2015), what was the outcome of the Court's judgment?

  1. It invalidated the Commission's Safe Harbour adequacy decision Correct answer.
  2. It held that standard contractual clauses are unlawful
  3. It upheld the Safe Harbour framework but required an annual review
  4. It invalidated the EU-US Privacy Shield framework

Explanation

The Court annulled Decision 2000/520/EC because the Safe Harbour arrangement did not ensure an adequate level of protection: US surveillance was not limited to what was strictly necessary and data subjects lacked effective remedies. The judgment illustrated that adequacy findings are subject to full judicial review.

Question 10Introduction to European Data Protection

Following the Schrems II judgment of 2020, what is the position of standard contractual clauses as a transfer tool?

  1. They were annulled by the Court together with the Privacy Shield decision
  2. They may be relied on only where the destination country already benefits from an adequacy decision
  3. They remain valid, but exporters must assess protection and add safeguards where needed Correct answer.
  4. They were validated by the Court as automatically sufficient in every transfer

Explanation

The Court upheld the SCC decision but held that controllers and processors relying on the clauses must verify, case by case, that the law of the destination country ensures protection essentially equivalent to that in the EU. Where it does not, supplementary measures must be adopted or the transfer suspended.

Question 11Introduction to European Data Protection

What did the Court of Justice establish in Google Spain (C-131/12) regarding search engine results?

  1. Data subjects may never object to search results that mention them
  2. Individuals may under certain conditions request de-listing of links from search results Correct answer.
  3. Adequacy decisions bind national supervisory authorities absolutely
  4. Search engine operators are not controllers for the purposes of EU data protection law

Explanation

The Court held that a search engine operator is a controller and that individuals may, in specified circumstances, require links to be removed from results obtained by searching their name. That possibility must be balanced against the legitimate interest of the public in accessing information.

Question 12Introduction to European Data Protection

What became of the Article 29 Working Party once the GDPR became applicable?

  1. It was reconstituted as a committee of the European Parliament
  2. It was replaced by the European Data Protection Board Correct answer.
  3. It was abolished without any successor body
  4. It was absorbed into the European Data Protection Supervisor

Explanation

The GDPR created the European Data Protection Board, composed of the heads of the national supervisory authorities and the EDPS. It inherited the Working Party's advisory function and gained additional tasks, including issuing guidelines and adopting binding decisions in consistency cases.

Question 13Introduction to European Data Protection

When did the Charter of Fundamental Rights of the European Union acquire binding legal force?

  1. When the Treaty of Nice was signed in 2001
  2. When the Treaty of Lisbon entered into force in 2009 Correct answer.
  3. When it was solemnly proclaimed in 2000
  4. When the GDPR became applicable in 2018

Explanation

The Charter was proclaimed in 2000 but was not then legally binding. Article 6 TEU, as amended by the Lisbon Treaty, gave it the same legal value as the Treaties with effect from 1 December 2009.

Question 14Introduction to European Data Protection

Under the GDPR, which body adopts a decision that a third country ensures an adequate level of data protection?

  1. The European Data Protection Board
  2. The supervisory authority of the Member State where the exporter is established
  3. The European Commission Correct answer.
  4. The Court of Justice of the European Union

Explanation

Article 45 GDPR empowers the Commission to adopt adequacy decisions by means of an implementing act after assessing the third country's legislation, judicial redress and supervisory practice. Findings are subject to periodic review and can be annulled by the Court.

Question 15Introduction to European Data Protection

What is the legal status of the 1980 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data?

  1. A binding EU regulation
  2. A binding Council of Europe treaty
  3. A directive requiring transposition into national law
  4. A non-binding recommendation Correct answer.

Explanation

The OECD Guidelines are a recommendation that does not create legally enforceable obligations. Their principles nevertheless influenced later instruments, including Convention 108 and Directive 95/46/EC.

Question 16Introduction to European Data Protection

Which instrument governs processing of personal data by police and judicial authorities for law enforcement purposes in the European Union?

  1. Regulation (EU) 2016/679
  2. Directive (EU) 2016/680 Correct answer.
  3. Directive 2002/58/EC
  4. Regulation (EU) 2018/1725

Explanation

Directive (EU) 2016/680, the Law Enforcement Directive, was adopted alongside the GDPR to cover competent authorities processing data for the prevention, investigation, detection or prosecution of criminal offences. Because it is a directive, it required transposition into national law.

Question 17Introduction to European Data Protection

A company established only in Canada offers a symptom-tracking app in French, priced in euros and supported by a French-language helpline, to users in France. Does the GDPR apply to this processing?

  1. Yes, because the company is targeting data subjects in the Union Correct answer.
  2. No, unless the European Commission has adopted an adequacy decision for Canada
  3. No, because the company has no establishment in the European Union
  4. Yes, but only if the data are subsequently transferred to the European Union

Explanation

Article 3(2) GDPR applies to a controller not established in the Union that offers goods or services to data subjects in the Union. Language, currency and local customer support are among the factors indicating that such an offer is being made.

Question 18Introduction to European Data Protection

What is the legal status of the recitals in the GDPR?

  1. They are not binding but assist in interpreting the articles Correct answer.
  2. They take effect only after ratification by the Member States
  3. They are binding provisions that themselves create obligations
  4. They prevail over the articles of the Regulation in the event of conflict

Explanation

Recitals set out the context, objectives and intention behind the operative provisions but have no independent binding force. Courts and regulators use them as interpretative aids when construing the articles, which contain the enforceable rules.

Question 19Introduction to European Data Protection

What did the Court of Justice decide in Digital Rights Ireland (Joined Cases C-293/12 and C-594/12)?

  1. That national data retention laws cannot be examined under EU law
  2. That the Data Retention Directive was invalid Correct answer.
  3. That the Safe Harbour adequacy decision was lawful
  4. That the GDPR was incompatible with the Charter of Fundamental Rights

Explanation

The Court annulled Directive 2006/24/EC because the general retention of communications data that it required was not limited to what was strictly necessary and lacked sufficient safeguards. It found breaches of Articles 7 and 8 of the Charter that were not justified under Article 52(1).

Question 20Introduction to European Data Protection

Which instrument lays down the data protection rules applicable to EU institutions, bodies, offices and agencies following the 2018 reform?

  1. Regulation (EU) 2018/1725 Correct answer.
  2. Regulation (EU) 2016/679
  3. Directive (EU) 2016/680
  4. Directive 95/46/EC

Explanation

Regulation (EU) 2018/1725 replaced Regulation (EC) 45/2001 and aligned the regime applicable to EU institutions with the GDPR. It also entrusts supervisory duties over those institutions to the European Data Protection Supervisor.

Question 21Introduction to European Data Protection

What did the Court of Justice conclude in Opinion 2/13 on the draft agreement for EU accession to the European Convention on Human Rights?

  1. That the draft agreement was incompatible with EU law in several respects Correct answer.
  2. That accession required no changes because the Charter already mirrored the Convention
  3. That the EU had already acceded by virtue of the Treaty of Lisbon
  4. That accession was a matter exclusively for the Council of Europe

Explanation

The Court found the draft agreement incompatible with Article 6(2) TEU and with the autonomy of EU law, for instance because it did not sufficiently preserve the CJEU's role in the preliminary reference procedure and the co-respondent mechanism. Accession therefore required renegotiation.

Question 22Introduction to European Data Protection

What was the purpose of the 2018 amending protocol to Council of Europe Convention 108?

  1. To repeal Convention 108 and replace it with the GDPR
  2. To restrict the Convention's application to Council of Europe member states
  3. To modernise it to address new risks and strengthen its safeguards Correct answer.
  4. To convert the Convention into a non-binding recommendation

Explanation

The amending protocol, known as Convention 108+, updates the treaty in light of technological change, reinforces the conditions for legitimate processing and enhances cooperation between supervisory authorities. It adapts the Convention rather than replacing it.

Question 23Introduction to European Data Protection

Under Article 52(1) of the Charter of Fundamental Rights, any limitation on the right to the protection of personal data must satisfy which conditions?

  1. It must be provided for by law, respect the essence and be necessary and proportionate Correct answer.
  2. It must be approved by a unanimous vote of the Council of the European Union
  3. It must be reviewed each year by the European Parliament and by the Council of the European Union
  4. It must be authorised in advance by the European Data Protection Supervisor

Explanation

Article 52(1) permits limitations only where they are provided for by law, respect the essence of the right and, subject to proportionality, are necessary and genuinely meet objectives of general interest or protect the rights of others. The Court applies this framework when reviewing data retention and surveillance measures.

Question 24Introduction to European Data Protection

Which statement correctly classifies sources of EU data protection law?

  1. The Treaties and Charter are primary law; the GDPR is secondary law Correct answer.
  2. The GDPR is primary law because it is directly applicable
  3. Directives are primary law while regulations are secondary law
  4. The Charter is secondary law because it was proclaimed by the institutions

Explanation

Primary law comprises the Treaties, the general principles of law and the Charter, which ranks above legislation adopted on Treaty bases such as Article 16 TFEU. Regulations, directives and decisions are secondary law and must be interpreted consistently with primary law.

Question 25Introduction to European Data Protection

A company based in London processes personal data solely for its own UK customers. From 1 January 2021, which regime primarily governed that processing?

  1. The UK GDPR, as retained domestic law Correct answer.
  2. No data protection law applied pending an adequacy decision
  3. The ePrivacy Directive alone
  4. The EU GDPR, because the United Kingdom had been a Member State

Explanation

When the transition period ended on 31 December 2020, the EU GDPR ceased to apply in the United Kingdom and the retained version, known as the UK GDPR, took effect in domestic law. The Commission's adequacy decision for the UK was adopted separately in June 2021 and concerns transfers, not the existence of UK law.

Question 26Introduction to European Data Protection

Which instrument is widely regarded as the first legally binding international treaty devoted specifically to the protection of personal data?

  1. The Charter of Fundamental Rights of the European Union
  2. Directive 95/46/EC
  3. The OECD Guidelines on the Protection of Privacy (1980)
  4. Council of Europe Convention 108 (1981) Correct answer.

Explanation

Convention 108, opened for signature in 1981 within the Council of Europe, was the first legally binding international instrument dedicated to data protection. The OECD Guidelines are non-binding recommendations and the EU instruments were adopted later.

Question 27Introduction to European Data Protection

A marketing team argues that because privacy is protected by Article 7 of the Charter, no separate data protection analysis is needed for its profiling activities. Is that argument sound?

  1. Yes, because Article 7 covers every form of data processing, whether public or private.
  2. Yes, but only where the controller is a public body exercising official authority.
  3. No, because the Charter does not protect privacy or personal data at all.
  4. No, because Article 8 of the Charter creates a separate right to data protection. Correct answer.

Explanation

The Charter contains two distinct rights: Article 7 on respect for private and family life and Article 8 on protection of personal data. Article 8(2) requires a legitimate basis laid down by law or consent and grants data subjects specific rights of access and rectification.

Question 28Introduction to European Data Protection

Which Treaty provision now provides the general legal basis for EU legislation on the protection of personal data?

  1. Article 8 of the European Convention on Human Rights
  2. Article 114 of the Treaty on the Functioning of the European Union
  3. Article 7 of the Charter of Fundamental Rights
  4. Article 16 TFEU Correct answer.

Explanation

Article 16 TFEU, introduced by the Lisbon Treaty, gives the EU legislature a specific competence to adopt rules on the protection of individuals with regard to the processing of personal data. Article 114 is the internal market legal basis, and Article 8 ECHR binds Council of Europe states rather than the EU legislature.

Question 29Introduction to European Data Protection

What was the principal function of Directive 95/46/EC?

  1. Regulating processing by police and judicial authorities in criminal matters
  2. Approximating national laws to ensure an equivalent level of protection Correct answer.
  3. Setting maximum administrative fines for data protection breaches
  4. Creating a single EU supervisory authority for data protection

Explanation

The 1995 Directive aimed to remove obstacles to the free movement of data by approximating Member State laws while guaranteeing a high level of protection. It left implementation to national law, and police cooperation fell outside its scope; the GDPR later replaced it.

Question 30Introduction to European Data Protection

A controller follows the data protection principles but cannot show any records, policies or logs demonstrating how it does so. Which principle is most directly undermined?

  1. Storage limitation
  2. Accountability Correct answer.
  3. Accuracy
  4. Data minimisation

Explanation

Article 5(2) GDPR makes the controller responsible for, and able to demonstrate, compliance with the principles. Records, policies and logs are the practical expression of that accountability obligation.

Question 31Introduction to European Data Protection

Under the purpose limitation principle, personal data must be...

  1. deleted as soon as the data subject withdraws consent, in every case without exception
  2. stored only on servers located within the European Union
  3. processed exclusively by automated means
  4. specified, explicit and legitimate purposes with no incompatible further processing Correct answer.

Explanation

Purpose limitation, in Article 5(1)(b), ties processing to defined purposes and permits further processing only where it is compatible or covered by a specific legal basis such as Article 89. It does not impose a storage location rule or require deletion on every withdrawal of consent.

Question 32Introduction to European Data Protection

The data minimisation principle requires that personal data be...

  1. review of each use of the data by the data protection officer before it occurs
  2. encryption of the data both in transit and at rest, using state-of-the-art methods
  3. retention of the data for a maximum period of twelve months from collection
  4. adequate, relevant and limited to what is necessary in relation to the purposes Correct answer.

Explanation

Article 5(1)(c) requires data to be adequate, relevant and limited to what is necessary in relation to the purposes. Encryption and fixed retention periods are separate safeguards or principles and do not define minimisation.

Question 33Introduction to European Data Protection

A hospital uses a cloud provider to store patient records. The provider has no discretion over why or how the records are used and acts only on the hospital's instructions. How is the provider characterised?

  1. As a processor Correct answer.
  2. As a joint controller
  3. As a controller
  4. As a data subject

Explanation

A processor processes personal data on behalf of a controller. The hospital determines the purposes and means and is therefore the controller, while the provider's role is limited to processing on instructions under Article 28.

Question 34Introduction to European Data Protection

Which of the following is a special category of personal data under Article 9 GDPR?

  1. A bank account number
  2. A personal email address
  3. Trade union membership Correct answer.
  4. A job title

Explanation

Article 9 lists sensitive categories including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health data and data concerning sex life or sexual orientation. Ordinary identifiers such as email addresses or bank details fall outside the list.

Question 35Introduction to European Data Protection

An individual asks a retailer for a copy of the personal data held about her, together with information on the purposes of processing and the recipients of the data. Which right is she exercising?

  1. The right to erasure
  2. The right to object
  3. The right of access Correct answer.
  4. The right to data portability

Explanation

Article 15 gives data subjects the right to obtain confirmation of whether their data are processed, a copy of the data and information about purposes, recipients, retention and rights. Portability concerns receiving data in a structured machine-readable format, while erasure and objection concern other entitlements.

Question 36Introduction to European Data Protection

What is the principal role of the European Data Protection Board?

  1. It promotes consistent application of the GDPR, including through guidelines and opinions. Correct answer.
  2. It adopts adequacy decisions for third countries.
  3. It supervises processing carried out by EU institutions and bodies.
  4. It hears appeals against decisions of national supervisory authorities.

Explanation

The EDPB is a consistency body composed of the heads of national supervisory authorities and the EDPS. Adequacy decisions are adopted by the European Commission, supervision of EU institutions is the EDPS's task, and appeals go to national courts.

Question 37Introduction to European Data Protection

A company has its main establishment in Germany and processes personal data in several Member States. Which authority will generally act as lead supervisory authority under the one-stop-shop?

  1. The supervisory authority of the Member State where the main establishment is located. Correct answer.
  2. The supervisory authority of each Member State in which affected data subjects are resident.
  3. The European Data Protection Supervisor.
  4. The European Data Protection Board.

Explanation

Article 56 GDPR designates the supervisory authority of the Member State of the controller's main establishment as lead authority for cross-border processing. Other authorities act as concerned authorities, and the EDPB is involved only through the consistency mechanism.

Question 38Introduction to European Data Protection

Which instrument lays down specific rules for the processing of personal data in electronic communications and complements the GDPR?

  1. Directive 2002/58/EC (ePrivacy Directive) Correct answer.
  2. Directive 2016/680
  3. Regulation 2018/1725
  4. Convention 108

Explanation

The ePrivacy Directive particularises the GDPR for electronic communications services, covering matters such as cookies, traffic data and unsolicited communications. Regulation 2018/1725 applies to EU institutions, Directive 2016/680 to law enforcement, and Convention 108 is a Council of Europe treaty.

Question 39Introduction to European Data Protection

How does the ePrivacy Directive relate to the GDPR where both apply to the same processing?

  1. The GDPR prevails over the ePrivacy Directive in every case, because it is the more recent instrument.
  2. The ePrivacy Directive operates as lex specialis and prevails where it lays down more specific rules. Correct answer.
  3. The ePrivacy Directive replaces the GDPR entirely for all processing carried out by online service providers.
  4. The two instruments are mutually exclusive, so a controller can be subject to only one of them at a time.

Explanation

Article 95 GDPR provides that the GDPR imposes no additional obligations where the ePrivacy Directive imposes specific obligations on the same matter. The ePrivacy rules therefore particularise and, on those points, prevail over the general GDPR regime.

Question 40Introduction to European Data Protection

In Case C-434/16 Nowak, what did the Court of Justice decide about written examination scripts containing the candidate's answers and examiner comments?

  1. They were anonymous because examiners do not know the candidate.
  2. They constituted personal data relating to the candidate. Correct answer.
  3. They fell outside EU data protection law because education is a national competence.
  4. They became personal data only after the results were published.

Explanation

The Court held that the answers and the examiner's comments are information relating to an identified or identifiable candidate and therefore personal data. The fact that the information concerns the candidate's performance rather than private life is irrelevant.

Question 41Introduction to European Data Protection

In Case C-582/14 Breyer, what did the Court of Justice hold about dynamic IP addresses collected by a website operator?

  1. They are never personal data because they change over time.
  2. They are anonymous data because the operator itself cannot identify the user.
  3. They are personal data only when the user's name is recorded alongside the address by the operator.
  4. They are personal data for the operator if it has legal means to identify the user with additional data. Correct answer.

Explanation

The Court adopted a relative approach: data can be personal in the hands of a party that has a legal means reasonably likely to allow identification. A dynamic IP address is therefore personal data for an operator able to obtain identifying data from the internet service provider by lawful means.

Question 42Introduction to European Data Protection

A homeowner installs a camera that films both his front door and the public pavement, recording passers-by. Applying Case C-212/13 Ryneš, does the household exemption apply?

  1. No, because recording public space goes beyond purely personal or household activity. Correct answer.
  2. Yes, because only one household is involved and no commercial purpose exists.
  3. Yes, because the camera is installed on private property owned by the household.
  4. No, because all CCTV processing requires prior authorisation from a supervisory authority.

Explanation

The household exemption covers activities carried out in the course of purely personal or household activities with no connection to a professional or commercial activity. Filming public space and recording passers-by extends beyond that sphere, so the exemption does not apply.

Question 43Introduction to European Data Protection

A Slovak company runs a Hungarian-language property advertising website aimed at Hungarian clients but has no office in Hungary. Under Case C-230/14 Weltimmo, which factor is most relevant to whether it is established in Hungary?

  1. The physical location of the servers hosting the website and whether the domain name is registered in Hungary.
  2. The nationality of the shareholders and the language used in the company's internal documentation.
  3. The currency in which the company invoices its Hungarian customers and the place of its tax registration.
  4. Real and effective activity in Hungary through stable arrangements, including agents or representatives. Correct answer.

Explanation

The Court held that establishment requires the effective and real exercise of activity through stable arrangements, and that the degree of permanence can be modest. The presence of representatives or agents and actual targeting of the local market can support a finding of establishment.

Question 44Introduction to European Data Protection

In Case C-673/17 Planet49, what did the Court of Justice hold about consent obtained through a pre-ticked checkbox?

  1. It is not valid because a pre-ticked box does not constitute active behaviour by the user. Correct answer.
  2. It is valid as long as the user can untick the box before completing the purchase.
  3. It is valid if the privacy policy mentions the use of cookies.
  4. It is valid for cookies that are strictly necessary.

Explanation

Consent must be given by a clear affirmative act showing the user's agreement. A pre-ticked box is passive and does not demonstrate active consent, and the Court also required information about the duration of cookies and whether third parties may access them.

Question 45Introduction to European Data Protection

Article 8(3) of the Charter of Fundamental Rights requires that compliance with data protection rules be subject to control by...

  1. national courts only
  2. an independent authority Correct answer.
  3. the European Commission
  4. the controller's own internal auditors

Explanation

Article 8(3) states that compliance with the rules on data protection must be subject to control by an independent authority, reflected in the supervisory authorities established under the GDPR.

Question 46Introduction to European Data Protection

Under the GDPR, personal data means any information relating to...

  1. a public authority acting in its official capacity
  2. a legal person such as a company
  3. an anonymous individual whose identity cannot be recovered
  4. an identified or identifiable natural person Correct answer.

Explanation

Article 4(1) defines personal data by reference to an identified or identifiable natural person. Legal persons and genuinely anonymous information fall outside the definition, although limited national rules may protect legal persons in specific contexts.

Question 47Introduction to European Data Protection

Which of the following best describes 'processing' under the GDPR?

  1. Any operation performed on personal data, whether or not by automated means. Correct answer.
  2. Only the collection of personal data from data subjects.
  3. Only the disclosure of personal data to third parties.
  4. Only operations carried out by automated means on personal data held in electronic form.

Explanation

Article 4(2) defines processing broadly and non-exhaustively, covering collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure, erasure and destruction, whether automated or manual.

Question 48Introduction to European Data Protection

What is pseudonymisation?

  1. The irreversible destruction of personal data so that it can never be attributed to a person.
  2. The encryption of personal data in transit between two controllers.
  3. The transfer of personal data to a third country under an adequacy decision.
  4. Processing so data cannot be attributed to a person without separately kept additional information. Correct answer.

Explanation

Article 4(5) describes pseudonymisation: the additional information must be kept separately and be subject to technical and organisational measures. Pseudonymised data remain personal data, unlike anonymised data.

Question 49Introduction to European Data Protection

Article 25 GDPR requires data protection by design and by default. What does 'by default' require?

  1. That every new system is approved in advance by the supervisory authority.
  2. That all privacy settings are opt-out rather than opt-in for users.
  3. That the data protection officer signs off each processing operation.
  4. That only personal data necessary for each specific purpose are processed by default. Correct answer.

Explanation

By default, the controller must ensure that only data necessary for each specific purpose are processed, including limits on the amount, extent, storage period and accessibility. It is not a formal prior-authorisation requirement.

Question 50Introduction to European Data Protection

Which instrument is recognised as the first legally binding international treaty specifically protecting individuals against abuses in the automated processing of personal data?

  1. The Council of Europe Convention 108 Correct answer.
  2. Directive 95/46/EC of the European Parliament and of the Council
  3. The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data
  4. The Charter of Fundamental Rights of the European Union

Explanation

Convention 108, opened for signature within the Council of Europe in 1981, was the first international treaty to create binding legal obligations on the processing of personal data, and it was later modernised by an amending protocol. It predates both the EU's 1995 Data Protection Directive and the Charter, and unlike the OECD guidelines it is legally binding on the states that ratify it.