I85PREP
⌘ K
eAIS study materials
eAIS study resources

eAIS practice questions

One question at a time. Build your eAIS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Governance, Risk Management, and Compliance in eHealth

Under the GDPR, which party is primarily responsible for deciding why and how patient data is processed in an eHealth service?

  1. The data subject
  2. The data controller Correct answer.
  3. The data processor
  4. The supervisory authority

Explanation

The controller determines the purposes and means of processing, so accountability for lawful processing rests with it. A processor only acts on the controller's documented instructions. Supervisory authorities oversee compliance rather than decide processing purposes.

Question 2Security Governance, Risk Management, and Compliance in eHealth

A hospital wants to deploy an AI triage tool that processes patient records. Which governance artefact should document the necessity and risks of this processing before go-live?

  1. A business continuity plan
  2. A penetration test report
  3. A service level agreement
  4. A data protection impact assessment Correct answer.

Explanation

A DPIA is required where processing is likely to result in high risk to individuals, which large-scale health data processing with automated decision support typically is. It records necessity, proportionality, and mitigations before processing begins. Penetration tests and continuity plans address different risk areas.

Question 3Security Governance, Risk Management, and Compliance in eHealth

In eHealth risk management, what does the term 'residual risk' refer to?

  1. The risk caused by external attackers only
  2. The total risk before any mitigation is considered
  3. The risk remaining after controls have been applied Correct answer.
  4. The risk that has been fully transferred to an insurer

Explanation

Residual risk is what remains once existing or planned controls are in place, and it must be compared against the organisation's risk acceptance criteria. Inherent risk is the pre-control exposure. Transferring risk does not eliminate accountability for it.

Question 4Security Governance, Risk Management, and Compliance in eHealth

Which principle of the GDPR limits collection of patient data to what is adequate, relevant, and necessary for the stated purpose?

  1. Lawfulness and fairness
  2. Storage limitation
  3. Data minimisation Correct answer.
  4. Integrity and confidentiality

Explanation

Data minimisation requires that personal data be adequate, relevant, and limited to what is necessary for the purposes. Storage limitation concerns retention periods, while integrity and confidentiality concerns security safeguards.

Question 5Security Governance, Risk Management, and Compliance in eHealth

What is the primary purpose of the ISO/IEC 27001 information security management system in a health organisation?

  1. To replace clinical quality management standards
  2. To certify that no security incidents can occur
  3. To establish a systematic, continually improved process for managing information security risk Correct answer.
  4. To provide a fixed checklist of technical controls for every system

Explanation

An ISMS is a management framework for identifying, treating, and continually improving information security risk. Certification confirms the management system conforms, not that incidents are impossible. It complements rather than replaces clinical quality standards.

Question 6Security Governance, Risk Management, and Compliance in eHealth

Which access control principle grants staff only the permissions needed to perform their current clinical duties?

  1. Mandatory access control
  2. Privilege creep
  3. Separation of duties
  4. Least privilege Correct answer.

Explanation

Least privilege limits permissions to the minimum required for the role, reducing exposure of patient records. Separation of duties prevents one person completing a sensitive transaction alone. Privilege creep is the accumulation of unneeded rights, which least privilege counters.

Question 7Security Governance, Risk Management, and Compliance in eHealth

A ransomware attack encrypts a clinic's electronic health record system. Which plan should define how clinical services continue and data is restored?

  1. The business continuity and disaster recovery plan Correct answer.
  2. The procurement policy
  3. The data retention schedule
  4. The consent management policy

Explanation

Business continuity and disaster recovery planning defines how critical clinical services keep running and how systems and data are restored after disruption. Retention schedules govern how long records are kept, and consent policy governs lawful processing.

Question 8Security Governance, Risk Management, and Compliance in eHealth

In health information security, what does the 'availability' objective of the CIA triad protect?

  1. The confidentiality of communications between clinicians
  2. The accuracy and completeness of stored records
  3. The legal basis for processing health data
  4. Timely and reliable access to patient information by authorised users Correct answer.

Explanation

Availability ensures that authorised users can access information and systems when needed, which is critical for safe care delivery. Accuracy and completeness relate to integrity. Confidentiality concerns preventing unauthorised disclosure.

Question 9Security Governance, Risk Management, and Compliance in eHealth

A hospital's risk register lists a threat to its patient portal with a likelihood of 4 and an impact of 5 on a 1-5 scale. What is the risk score under a simple multiplicative method?

  1. 45
  2. 9
  3. 20 Correct answer.
  4. 1.25

Explanation

A simple likelihood-times-impact method gives 4 x 5 = 20, which is then compared against defined risk thresholds. Adding the values would misrepresent the model, and the other values are not products of the two factors.

Question 10Security Governance, Risk Management, and Compliance in eHealth

A national eHealth agency shares patient data with a research partner. Which GDPR mechanism best supports lawful transfers of personal data to a country without an adequacy decision?

  1. Standard contractual clauses with a transfer impact assessment Correct answer.
  2. An internal email approving the transfer
  3. A verbal assurance from the partner's chief executive
  4. Publication of the data on an open portal

Explanation

Where no adequacy decision exists, appropriate safeguards such as standard contractual clauses are needed, supported by an assessment of the destination's legal environment. Informal assurances and internal emails do not constitute valid transfer safeguards.

Question 11Security Governance, Risk Management, and Compliance in eHealth

During an audit, a reviewer finds that nurses can view records of patients outside their ward. Which control failure does this most directly indicate?

  1. Insufficient data backup frequency
  2. Incomplete incident response testing
  3. Inadequate role-based access enforcement Correct answer.
  4. Missing encryption of data at rest

Explanation

Access should be scoped to the clinical relationship and role, so viewing out-of-ward records indicates role-based access controls are not properly enforced. Backup frequency, encryption at rest, and incident response testing address different control objectives.

Question 12Security Governance, Risk Management, and Compliance in eHealth

A patient requests a copy of their electronic health record from a hospital. Under the GDPR right of access, what must the controller generally provide?

  1. Only a verbal summary given during a clinic visit
  2. The internal audit reports of the hospital
  3. The source code of the record system
  4. A copy of the personal data undergoing processing together with information about the processing Correct answer.

Explanation

The right of access entitles the data subject to a copy of their personal data and information such as purposes, categories, and recipients. Internal audit reports and system source code are not personal data owed to the subject.

Question 13Security Governance, Risk Management, and Compliance in eHealth

Which activity best demonstrates that an eHealth organisation is monitoring the effectiveness of its security controls?

  1. Listing controls in a spreadsheet without owners
  2. Adopting a security policy without measuring implementation
  3. Purchasing cyber insurance for financial protection
  4. Reviewing key performance indicators for patch latency and access review completion Correct answer.

Explanation

Monitoring requires measurable indicators that show whether controls operate as intended, such as patch latency and completion of access reviews. Merely adopting policies or buying insurance does not evidence control effectiveness.

Question 14Security Governance, Risk Management, and Compliance in eHealth

A software vendor processing patient data for a hospital suffers a personal data breach. Under the GDPR, what is the processor's obligation toward the controller?

  1. Notify affected patients before informing the controller
  2. Notify the controller without undue delay after becoming aware of the breach Correct answer.
  3. Wait until the annual audit to disclose the incident
  4. Report directly to the press within 24 hours

Explanation

A processor must notify the controller without undue delay after becoming aware of a personal data breach, enabling the controller to meet its own 72-hour notification duty where required. The processor does not manage subject or media communications itself.

Question 15Security Governance, Risk Management, and Compliance in eHealth

What distinguishes a threat from a vulnerability in an eHealth risk assessment?

  1. A threat is a legal obligation, while a vulnerability is a contractual term
  2. A threat is a potential cause of harm, while a vulnerability is a weakness that can be exploited Correct answer.
  3. A threat is an internal weakness, while a vulnerability is an external actor
  4. A threat is a control, while a vulnerability is a risk score

Explanation

Threats are potential sources of harm such as attackers or natural events, whereas vulnerabilities are weaknesses in assets or controls that a threat can exploit. Confusing the two leads to misdirected controls.

Question 16Security Governance, Risk Management, and Compliance in eHealth

An eHealth provider plans to use cloud hosting for a patient portal. Which governance step best addresses supplier risk before contract signature?

  1. Relying on the provider's marketing claims about security
  2. Conducting due diligence on the provider's security certifications and data processing terms Correct answer.
  3. Deferring risk assessment until after the first incident
  4. Assuming the cloud provider is responsible for all compliance obligations

Explanation

Supplier due diligence examines independent evidence such as certifications, audit reports, and data processing agreements, and clarifies shared responsibilities. Marketing claims and assumptions of full supplier responsibility leave the controller's obligations unmet.

Question 17Security Governance, Risk Management, and Compliance in eHealth

Which measure best supports accountability for GDPR compliance in a multi-site eHealth organisation?

  1. Relying on staff memory of privacy rules
  2. Removing documentation to reduce storage costs
  3. Maintaining processing records and assigning named owners for each processing activity Correct answer.
  4. Delegating all privacy decisions to the IT helpdesk

Explanation

Accountability requires demonstrable records of processing and clear ownership so responsibilities can be evidenced and reviewed. Informal reliance on memory or undocumented delegation cannot demonstrate compliance.

Question 18Security Governance, Risk Management, and Compliance in eHealth

An eHealth app collects precise location data alongside health readings. Which governance question is most important before adding this feature?

  1. Whether the location data is necessary and proportionate for the stated health purpose Correct answer.
  2. Whether the marketing team prefers daily or weekly reports
  3. Whether the app's colour scheme meets branding guidelines
  4. Whether the feature can be built within the current sprint

Explanation

Combining location with health data raises privacy risk, so necessity and proportionality must be justified against the purpose, often through a DPIA. Branding, reporting cadence, and sprint planning are delivery concerns rather than data protection governance.

Question 19Security Governance, Risk Management, and Compliance in eHealth

A hospital adopts the principle of 'privacy by design' for a new patient app. Which action best reflects this principle?

  1. Adding privacy notices only after the app is launched
  2. Embedding data minimisation and default privacy settings into the system design from the outset Correct answer.
  3. Collecting all available data in case it becomes useful later
  4. Restricting privacy review to the legal department after release

Explanation

Privacy by design requires privacy protections to be built into systems and defaults from the start, including data minimisation. Retrospective notices, speculative over-collection, and post-release review contradict the principle.

Question 20Security Governance, Risk Management, and Compliance in eHealth

Which statement best describes the role of a Data Protection Officer (DPO) under the GDPR?

  1. The DPO must approve all marketing campaigns
  2. The DPO is personally liable for every data breach
  3. The DPO decides the clinical treatment of patients
  4. The DPO monitors compliance and advises on obligations while acting independently Correct answer.

Explanation

The DPO informs and advises the controller, monitors compliance, and cooperates with supervisory authorities, exercising independence in those tasks. Clinical decisions and blanket personal liability for breaches fall outside the DPO role.

Question 21Security Governance, Risk Management, and Compliance in eHealth

A threat actor exfiltrates a database of 5,000 patients and demands payment. Which factor most affects whether the controller must notify the supervisory authority within 72 hours?

  1. Whether the database was hosted on-premises or in the cloud
  2. Whether the attacker used ransomware rather than another method
  3. Whether the breach is likely to result in a risk to the rights and freedoms of the individuals Correct answer.
  4. Whether the organisation has cyber insurance in place

Explanation

The notification trigger is the likelihood of risk to individuals' rights and freedoms, assessed from the nature and consequences of the breach. The attack method, insurance status, and hosting location do not determine the obligation.

Question 22Security Governance, Risk Management, and Compliance in eHealth

An organisation applies a risk treatment that accepts a high residual risk to keep a legacy record system running. What governance condition should accompany this decision?

  1. Transfer of accountability to the software vendor
  2. Silent acceptance without recording the rationale
  3. A documented, time-bound acceptance by an accountable owner with compensating controls Correct answer.
  4. Immediate deletion of the risk from the register

Explanation

Accepting high residual risk requires formal, documented sign-off by an accountable owner, a review date, and compensating controls to reduce exposure. Removing the risk from the register or shifting accountability to a vendor obscures governance.

Question 23Security Governance, Risk Management, and Compliance in eHealth

A researcher proposes reusing clinical records for secondary research without consent. Which governance analysis is most appropriate under the GDPR?

  1. Rely solely on the absence of patient complaints
  2. Proceed because research is exempt from all data protection rules
  3. Assess whether a compatible purpose or a specific research derogation provides a lawful basis Correct answer.
  4. Assume secondary use is always permitted because the data is already held

Explanation

Secondary use requires a lawful basis, and organisations must assess whether the new purpose is compatible with the original or whether a research-related derogation and safeguards apply. Prior possession of data and absence of complaints do not create a lawful basis.

Question 24Security Governance, Risk Management, and Compliance in eHealth

A hospital's audit log shows a clinician accessed a celebrity patient's record without a treatment relationship. Which governance response is most appropriate?

  1. Treat it as a potential personal data breach, investigate, and apply sanctions and controls Correct answer.
  2. Delete the audit log to protect the clinician's reputation
  3. Ignore it because the clinician had system access
  4. Publish the clinician's name on the hospital website

Explanation

Access without a legitimate purpose is unauthorised processing that may require breach assessment, investigation, and disciplinary or technical measures. Having system credentials does not authorise access, and destroying logs or publicly naming staff would be improper.

Question 25Security Governance, Risk Management, and Compliance in eHealth

A multi-country eHealth platform must satisfy both GDPR and a national health records law that imposes stricter consent rules. Which compliance approach is most defensible?

  1. Apply only the GDPR because it is supranational
  2. Apply only the national law and ignore GDPR obligations
  3. Alternate between the two frameworks depending on the auditor
  4. Apply the stricter requirement where laws overlap while maintaining a documented mapping of obligations Correct answer.

Explanation

Where several regimes apply, organisations should map obligations and meet the stricter standard for overlapping requirements, documenting the rationale. Ignoring either framework or switching positions by auditor creates legal exposure.

Question 26Security Governance, Risk Management, and Compliance in eHealth

An eHealth provider must demonstrate that its security programme is aligned with recognised international good practice for information security management. Which standard is designed specifically for establishing, implementing, maintaining and continually improving an information security management system?

  1. HL7 FHIR
  2. ISO 13606
  3. ISO/IEC 27001 Correct answer.
  4. DICOM PS3

Explanation

ISO/IEC 27001 specifies the requirements for an information security management system, including risk-based planning, operation, monitoring and continual improvement. It is the reference standard organisations certify against to evidence governance of information security. The other listed items are health data interoperability or imaging standards, not management system standards.

Question 27Security Governance, Risk Management, and Compliance in eHealth

A hospital group is appointing a Data Protection Officer. Which arrangement best preserves the independence the GDPR requires of that role?

  1. The DPO is an external lawyer who also manages breach notification decisions for the hospital.
  2. The DPO reports to the Chief Information Security Officer and follows IT operational priorities.
  3. The DPO role is combined with the head of marketing so privacy advice reflects business goals.
  4. The DPO reports directly to top management and is not instructed on how to exercise the role. Correct answer.

Explanation

The GDPR requires the DPO to be involved properly and early, to report to the highest management level, and not to be instructed regarding the exercise of the role. Direct reporting to top management with no direction on outcomes preserves that independence. Combining the role with operational or commercial duties that create conflicts undermines it.

Question 28Security Governance, Risk Management, and Compliance in eHealth

An eHealth organisation wants assurance that a cloud vendor hosting its patient portal meets agreed security expectations. Which contract mechanism most directly gives the organisation a right to verify the vendor's security posture over time?

  1. A service level agreement covering portal uptime percentages only
  2. A marketing agreement permitting use of the vendor's certification logo
  3. A software licence stating the number of permitted named users
  4. A data processing agreement with a right to audit and defined security obligations Correct answer.

Explanation

A data processing agreement that sets out security obligations and grants the controller audit or inspection rights creates enforceable means to verify the processor's controls throughout the relationship. Uptime commitments, branding permissions and user counts do not address security assurance. The organisation should also define breach notification and sub-processor terms in the same agreement.

Question 29Security Governance, Risk Management, and Compliance in eHealth

A national eHealth programme wants a structured way to record identified risks, their owners, treatment decisions and review dates so that governance bodies can track them. Which artefact is most appropriate?

  1. A privacy notice
  2. A risk register Correct answer.
  3. A business continuity plan
  4. A data retention schedule

Explanation

A risk register is the governance record that captures each risk, its assessment, assigned owner, chosen treatment and review date, enabling tracking and escalation. Business continuity plans describe response arrangements, privacy notices inform data subjects, and retention schedules define storage periods. None of those substitutes for a tracked risk record.

Question 30Security Governance, Risk Management, and Compliance in eHealth

A hospital plans to deploy an AI triage tool that processes patient records and proposes urgency rankings. Governance reviewers must decide what evidence is needed before go-live. Which approach best reflects proportionate risk management for this clinical decision-support system?

  1. Rely on the vendor's general claim that the model is accurate and proceed to pilot use.
  2. Complete a data protection impact assessment covering purpose, data flows, bias testing and human oversight, with clinical validation evidence. Correct answer.
  3. Restrict the assessment to server encryption settings because the model is hosted externally.
  4. Delay all documentation until the tool has been used for six months so real outcomes can be reported.

Explanation

A high-risk clinical tool warrants a data protection impact assessment that examines purpose limitation, data flows, accuracy and bias testing, and the human oversight arrangements that keep clinicians accountable for decisions. Clinical validation evidence should accompany it before deployment. Narrow technical reviews or vendor assurances alone do not address patient safety, fairness or legal accountability.

Question 31Health Information Privacy and Data Protection Law

Under the GDPR, which lawful basis requires a freely given, specific, informed and unambiguous indication of the data subject's wishes?

  1. Consent Correct answer.
  2. Contractual necessity
  3. Legitimate interest
  4. Legal obligation

Explanation

Consent under Article 6(1)(a) requires a freely given, specific, informed and unambiguous indication of the data subject's wishes by statement or clear affirmative action. The other Article 6 bases do not depend on the data subject's wishes but on the controller's circumstances or duties.

Question 32Health Information Privacy and Data Protection Law

A hospital in the EU processes patient records for treatment. Which GDPR provision most directly governs the handling of those health data?

  1. Article 9, which prohibits processing of special categories unless an exception applies Correct answer.
  2. Article 35, which concerns data protection impact assessments
  3. Article 30, which concerns records of processing activities
  4. Article 5, which governs only the principles of processing

Explanation

Health data are special category data under Article 9(1), so processing is prohibited unless one of the Article 9(2) exceptions applies, such as provision of health care under 9(2)(h). Article 5 principles and Article 30 records apply to all processing but do not themselves authorize special category processing.

Question 33Health Information Privacy and Data Protection Law

Which principle limits the collection of personal data to what is adequate, relevant and necessary for the stated purpose?

  1. Storage limitation
  2. Integrity and confidentiality
  3. Accountability
  4. Data minimisation Correct answer.

Explanation

Data minimisation in Article 5(1)(c) requires personal data to be adequate, relevant and limited to what is necessary in relation to the purposes. Storage limitation concerns retention periods, and integrity and confidentiality concerns security safeguards.

Question 34Health Information Privacy and Data Protection Law

A patient asks a clinic for a copy of their medical record. Under the GDPR, what is the clinic's primary obligation?

  1. Provide only a summary prepared by the treating physician
  2. Charge a standard administrative fee for every request
  3. Provide a copy of the personal data undergoing processing, free of charge in principle Correct answer.
  4. Refuse because medical records belong to the clinic

Explanation

Article 15 grants a right of access, and the controller must provide a copy of the personal data undergoing processing. Article 12(5) makes the first copy free of charge in principle, with fees possible only for further copies or manifestly unfounded or excessive requests.

Question 35Health Information Privacy and Data Protection Law

What is the default maximum period for responding to a data subject request under the GDPR?

  1. Forty-eight hours from receipt
  2. Six months from receipt
  3. One year from receipt
  4. One month from receipt, extendable by two further months for complex requests Correct answer.

Explanation

Article 12(3) requires the controller to provide information on action taken without undue delay and in any event within one month of receipt. That period may be extended by two further months where necessary, taking into account the complexity and number of requests.

Question 36Health Information Privacy and Data Protection Law

Which role does a processor play under the GDPR?

  1. It supervises compliance as an independent authority
  2. It acts as the data subject's representative
  3. It determines the purposes and means of processing
  4. It processes personal data on behalf of the controller Correct answer.

Explanation

Article 4(8) defines a processor as a natural or legal person that processes personal data on behalf of the controller. The controller, by contrast, determines the purposes and means of processing under Article 4(7).

Question 37Health Information Privacy and Data Protection Law

A company transfers personal data from the EU to a third country without an adequacy decision. Which mechanism can it validly use?

  1. Standard contractual clauses adopted by the European Commission Correct answer.
  2. A verbal assurance from the importer's IT manager
  3. A press release announcing the transfer
  4. An internal memo signed only by the exporter's CEO

Explanation

Article 46 permits transfers subject to appropriate safeguards, including standard data protection clauses adopted by the Commission. Informal assurances, internal memos and public announcements do not constitute a recognised transfer tool.

Question 38Health Information Privacy and Data Protection Law

Which statement best describes the GDPR's accountability principle?

  1. The controller must obtain consent for every processing activity
  2. The controller must delete all data after one year
  3. The controller must register every processing operation with the supervisory authority
  4. The controller must be able to demonstrate compliance with the data protection principles Correct answer.

Explanation

Article 5(2) makes the controller responsible for, and able to demonstrate compliance with, the principles in Article 5(1). Accountability is about demonstrable compliance, not universal consent, blanket registration or a fixed retention period.

Question 39Health Information Privacy and Data Protection Law

A marketing team wants to rely on legitimate interests to send promotional emails to existing customers. Which additional requirement most directly applies under the ePrivacy framework?

  1. The emails must be sent from a company domain
  2. No additional rule applies because legitimate interests suffice
  3. Prior consent is generally needed for unsolicited electronic marketing to individuals Correct answer.
  4. Only the customer's employer must be informed

Explanation

The ePrivacy Directive generally requires prior consent for unsolicited electronic marketing to natural persons, subject to limited soft opt-in exceptions for existing customers. A GDPR lawful basis such as legitimate interests does not displace the separate ePrivacy consent rule.

Question 40Health Information Privacy and Data Protection Law

A controller plans processing likely to result in a high risk to data subjects' rights. What does the GDPR require before processing begins?

  1. A public tender process
  2. A notification to every data subject's employer
  3. A transfer to a third country
  4. A data protection impact assessment Correct answer.

Explanation

Article 35 requires a DPIA where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons. The assessment should occur before the processing begins so risks can be mitigated.

Question 41Health Information Privacy and Data Protection Law

Under the GDPR, when must a controller notify a personal data breach to the supervisory authority?

  1. Within 30 days of the annual compliance review
  2. Without undue delay and where feasible within 72 hours of becoming aware, unless unlikely to result in a risk Correct answer.
  3. Only after the data subject files a complaint
  4. Only if the breach affects more than 10,000 individuals

Explanation

Article 33 requires notification to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless it is unlikely to result in a risk. There is no fixed headcount threshold in the GDPR.

Question 42Health Information Privacy and Data Protection Law

When must a controller communicate a personal data breach to affected data subjects?

  1. Whenever any personal data are involved, regardless of risk
  2. When the breach is likely to result in a high risk to their rights and freedoms Correct answer.
  3. Only when the supervisory authority orders it
  4. Only when the breach is reported in the media

Explanation

Article 34 requires communication to data subjects when the breach is likely to result in a high risk to their rights and freedoms. This threshold is higher than the risk threshold for notifying the supervisory authority under Article 33.

Question 43Health Information Privacy and Data Protection Law

A health app relies on consent to process health data. Which condition does the GDPR impose on that consent?

  1. It may be inferred from a pre-ticked box
  2. It may be implied from continued use of the app
  3. It must be explicit Correct answer.
  4. It may be bundled with unrelated terms of service

Explanation

Article 9(2)(a) requires explicit consent for processing special category data such as health data. Implied, bundled or pre-ticked forms of agreement do not meet the standard of explicit consent.

Question 44Health Information Privacy and Data Protection Law

Which right allows a data subject to receive their personal data in a structured, commonly used and machine-readable format?

  1. Data portability Correct answer.
  2. Right to restriction of processing
  3. Right to object
  4. Right to rectification

Explanation

Article 20 grants the right to data portability, allowing the data subject to receive personal data in a structured, commonly used and machine-readable format. Rectification, restriction and objection address accuracy, processing limits and objections rather than transmission of data.

Question 45Health Information Privacy and Data Protection Law

A data subject objects to processing based on legitimate interests. What is the controller's burden?

  1. It must demonstrate compelling legitimate grounds that override the data subject's interests, rights and freedoms Correct answer.
  2. It must transfer the data to a supervisory authority
  3. It must delete all data immediately without any assessment
  4. It may continue processing because legitimate interests were already assessed

Explanation

Article 21(1) requires the controller to stop processing unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the data subject. The controller bears the burden of showing those grounds.

Question 46Health Information Privacy and Data Protection Law

What does the GDPR require when a controller engages a processor?

  1. Only a verbal understanding between the parties
  2. A written contract binding the processor to the controller's instructions and specified obligations Correct answer.
  3. Approval from every data subject before processing
  4. That the processor become a joint controller

Explanation

Article 28 requires a contract or other legal act binding the processor to the controller, setting out the subject matter, duration, nature and purpose of processing and the processor's obligations. The relationship remains controller-processor rather than joint controllership.

Question 47Health Information Privacy and Data Protection Law

Which designation is mandatory under the GDPR for certain controllers and processors?

  1. A data protection officer where core activities involve large-scale systematic monitoring or special category data Correct answer.
  2. A data subject representative in every Member State
  3. An external auditor for every processing operation
  4. A chief marketing officer

Explanation

Article 37 requires designation of a DPO where processing is carried out by a public authority, where core activities require large-scale systematic monitoring, or where core activities involve large-scale processing of special category data. The other roles are not GDPR designations.

Question 48Health Information Privacy and Data Protection Law

A US-based online retailer offers goods to EU customers and monitors their behaviour. Which GDPR provision applies to it?

  1. Article 3(2), extending the GDPR to controllers outside the Union targeting EU data subjects Correct answer.
  2. Article 27, which exempts such controllers from the GDPR
  3. Article 3(1), which applies only to establishments in the Union
  4. Article 44, which prohibits all transfers

Explanation

Article 3(2) applies the GDPR to controllers and processors not established in the Union that offer goods or services to data subjects in the Union or monitor their behaviour. Such controllers must also designate a representative under Article 27.

Question 49Health Information Privacy and Data Protection Law

Which statement accurately contrasts the GDPR and the EU Data Protection Law Enforcement Directive (LED)?

  1. The GDPR governs general processing, while the LED governs processing by competent authorities for law enforcement purposes Correct answer.
  2. The LED replaced the GDPR in 2018
  3. The LED governs all commercial processing in the EU
  4. The GDPR applies only to criminal justice data

Explanation

The GDPR provides the general data protection framework, whereas the LED (Directive 2016/680) applies to processing by competent authorities for the prevention, investigation, detection or prosecution of criminal offences. The two instruments are complementary, not substitutes.

Question 50Health Information Privacy and Data Protection Law

A research institution wants to process health data for scientific research without consent. Which GDPR route is most relevant?

  1. Article 49 derogations for occasional transfers
  2. Article 15 access rights
  3. Article 6(1)(b) contractual necessity
  4. Article 9(2)(j) with Article 89 safeguards, subject to any Member State law Correct answer.

Explanation

Article 9(2)(j) permits processing for scientific research purposes with appropriate safeguards under Article 89(1) and subject to conditions in Member State law. Contractual necessity, transfer derogations and access rights do not authorize research processing of health data.