Privacy Concerns: Data Protection in Practice
Privacy concerns the fair handling of information about identifiable people. The exam tests data protection principles, individual rights, and the security controls that support them. Questions typically describe a collection or sharing practice and ask whether it is lawful, or which control reduces risk.
Core principles
- Lawfulness, fairness, and transparency: processing needs a legal basis and clear notice.
- Purpose limitation: data collected for one purpose should not be repurposed without a basis.
- Data minimisation: collect only what is necessary and proportionate.
- Accuracy, storage limitation, integrity and confidentiality, and accountability round out the standard set.
Legal bases and rights
- Consent must be freely given, specific, informed, and withdrawable; it is one basis among several, alongside contract, legal obligation, vital interests, public task, and legitimate interests.
- Individuals may request access, correction, erasure, restriction, portability, and objection.
- Breach notification to regulators is typically required within 72 hours where risk exists, and to affected people where risk is high.
Technical safeguards
- Encryption protects confidentiality in transit and at rest; hashing supports integrity checks and can obscure values but is not reversible protection.
- Pseudonymisation replaces identifiers but keeps re-identification possible with a key; anonymisation aims to make re-identification impossible.
- Least privilege, access logging, retention schedules, and privacy by design reduce exposure.
Cookies and monitoring
- Non-essential cookies generally need prior consent and clear information.
- Workplace monitoring must be proportionate, transparent, and justified by a legitimate business need.
Worked example
A retailer's loyalty app states that birth dates are collected to send birthday offers, but the data is also sold to insurers for risk scoring. Reasoning: the sale is incompatible with the stated purpose, so purpose limitation is breached, and the original consent does not cover the new use. The fix is either to stop the sale or to establish a valid basis with clear notice and, where required, fresh consent, plus a lawful transfer mechanism if data crosses borders. Minimisation also questions whether a full birth date is needed for a birthday offer.
Traps that cost marks
- Treating consent as the only lawful basis, or as valid when bundled into unrelated terms.
- Confusing privacy with security: security protects data, privacy governs whether collection is justified.
- Calling pseudonymised data anonymous.
- Assuming encryption removes the need for retention limits or access control.