Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP-E > Chapter 4 (Data Protection Concepts) > Flashcards

Chapter 4 (Data Protection Concepts) Flashcards

1
Q

Is the concept of personal data broader under the GDPR or US state data breach laws?

A

It is broader under the GDPR.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Under the GDPR what is the definition of personal data?

A

Any info relating to an identified or identifiable natural person (data subject).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Under the GDPR, who qualifies as an identifiable natural person?

A

One who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, id number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identify of that natural person.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

According to the Article 29 Working Party (WP29) what are the 4 building blocks that comprise the meaning of personal data?

A
  1. Any information
  2. Relating to
  3. An identified or identifiable
  4. Natural person
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What 3 aspects of the concept of information help define what info will be considered personal data?

A

Its
1. Nature
2. Content
3. Format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Does info need to be true to be considered personal data?

A

No.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The content of personal data can include what type of info?

A
  1. Info about individual’s private life
  2. Info about an activity taken by an individual (whether related to professional, public, or private life)
  3. Online identifiers like IP address, cookies, or radio frequency identification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Under the GDPR, personal data can come in what form?

A

Includes personal data processed by automotive means as well as data processed by manual means if the data from part of a filing system (e.g. paper patient records at a hospital).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

For personal data to relate to an individual one of the following 3 elements must apply.

A
  1. Content element
  2. Purpose element
  3. Result element
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain the content element for determining whether information “relates” to an individual.

A

Present when the info is about an individual in the most common sense of the word. E.g. the result of a test clearly relates to a student.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Explain the purpose element for determining whether information “relates” to an individual.

A

Depends on whether the info is processed to evaluate, consider, or analyze the individual in a certain way.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Explain the result element for determining whether information “relates” to an individual.

A

Exists when the processing of certain info has an impact on the individual’s rights and interests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When is a natural person identifiable?

A

When although the person has not been identified yet, it is possible to do so.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Is a hypothetical possibility of identification sufficient to make info identifiable?

A

No. There must be a reasonable likelihood of identification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

In Patrick Breyer v. Bundesrepublik Deutschland what did the CJEU find?

A

That dynamic IP addresses could constitute personal data on the grounds that a person could be indirectly identified if the ip addresses were combined with data held by the ISPs, such as time of connection and pages visited on the website.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Does the GDPR apply to anonymized data?

A

No.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How does the GDOR define anonymized data?

A

Info which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How does the GPDR define pseudonymisation?

A

Processing personal data in such a manner that it can no longer be attributed to a specific data subject without the use of additional info (provided that the info is kept separately and protected).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Does having pseudonymised data remove an org’s obligations under the GDPR?

A

No.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Pseudonymisation is an important safeguard to achieve what?

A

Data minimization requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Are the terms deidentified data, indirectly identifiable data, and pseudoanonymised data defined under the GDPR?

A

No.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Does the GDPR apply to deceased persons’ personal data?

A

No.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Under the GDPR, what info qualifies as special categories of personal data that merit specific protections?

A

Personal data revealing:
1. Racial or ethnic origins
2. Political opinions
3. Religious or philosophical beliefs
4. Trade Union membership
5. Processing of genetic data
6. Biometric data for the purpose of uniquely identifying a natural person
7. Data concerning health
8. A natural person’s sex life or sexual orientation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Under the GDPR, how is genetic data defined?

A

Personal data relating to inherited or acquired genetic characteristics on a natural person which give unique info about the physiology or the health of that natural person and which result, in particular, from analysis of a biological sample from the person in question.

25
Q

How does the GDPR define personal data that relates to health?

A

Data related to the physical or mental health of a person including
1. Provision of health care services (reveals info on health status)
2. All data pertaining to the health status of a data subject which reveal info relating to the past, current, or future physical or mental health status of the data subject.

26
Q

What type of info relates to the past, current, or future physical or mental health status of the data subject.

A
  1. Info about the natural person collected in the course of registration for or the provision of health care services.
  2. A number, symbol, or other identifier assigned to a natural person to uniquely identify the natural person for health purposes.
  3. Info derived from the testing or examination of a body part or bodily substance, including from genetic or biological samples.
  4. Any info on, for example, a disease, disability, disease risk, medical history, clinical treatment, or the physiological or biomedical state of the data subject independent of its source, for example from a physician or other health professional, a hospital, a medical device.
27
Q

Under the GDPR what is a data controller?

A

The natural or legal person, public authority, agency, or any other body which alone or jointly with others determines the purpose and means of processing personal data.

28
Q

Under the GDPR, what are some of the responsibilities of data controllers?

A
  1. Providing info to data subjects.
  2. Ensuring processing has a legit basis and data subjects’ rights are honored.
  3. Carrying out Data Protection Impact Assessments (DPIA) in the case of high risk processing
  4. Ensuring there is appropriate security for data
  5. Determining whether notification to Data Protection Authorities (DPAs) or data subjects is necessary in the case of personal data breach.
29
Q

The first and foremost role of a data controller is what?

A

Determining who shall be responsible for compliance with data protection law and how individuals can exercise their rights (i.e. allocating responsibility).

30
Q

What are the 5 building blocks identified in the EDPB’s
Guidelines on the concepts of controller and processor?

A
  1. The natural or legal person, public authority, agency, or other body
  2. Determines
  3. Alone or jointly with others
  4. The purpose and means
  5. Of the processing of personal data
31
Q

When an individual within an org or body is appointed to ensure compliance with data protection law or process personal data does this appointment turn them into a data controller?

A

No, because they will be acting on behalf of the legal entity in carrying out their role.

32
Q

Is the contractual designation of parties roles decisive in determining who is a controller or processor under the GDPR?

A

No, because the legal designations may differ from what is happening in practice.

33
Q

What questions should be asked to assess who “determines” what data is processed and how it is used?

A
  1. Why is the processing taking place?
  2. Who initiated the processing?
34
Q

Explain how the concept of purpose relates to data controllers.

A

Data controllers determine the goal or anticipates outcome of processing (i.e. the reason the controller has decide to conduct processing).

35
Q

What are some of the essential means a controller must decide with regard to processing personal data?

A
  1. What data should be processed
  2. How long the data should be processed
  3. The categories of data recipients
  4. The categories of data subjects
36
Q

Is it necessary for a company to have actual contact with personal data to be the controller of that data?

A

No.

37
Q

What are the 3 reasons joint controllership has become more important under the GDPR than it was under the Directive?

A
  1. There is a greater emphasis on the concept in the GDPR, which introduced specific rules for joint controller relationships in Article 26.
  2. The increase in complex data-sharing arrangements between orgs, particularly in the online world.
  3. A series of decisions from the CJEU which brought clarifications on this concept and its implications.
38
Q

What is at the essence of joint controllership?

A

It’s about allocation of factual responsibilities for processing, i.e. assessing who determines the purposes and means of processing.

39
Q

What are the two types of decisions that underlie joint controllership?

A
  1. Decision that is made together (a common decision)
  2. Joint participation that stems from converging decsions
40
Q

What are converging decisions?

A

Relate to joint controllership and exist if they complement each other and have a tangible impact on the determination of the purposes and means of the processing.

41
Q

The CJEU has established that there may be joint controllership in what circumstance? What is one of the most high profile examples?

A

When there is a mutual benefit for both parties and they both participate in the means of the relevant processing operation.

Fashion ID case (online fashion shop places a social plug in, a Facebook like button, on its site that collected visitors info regardless of whether they interacted with the plug in). Facebook and Fashion ID held to be joint controllers re collection and onward transmission of data).

42
Q

Why is it important to separate the overall processing of personal data into its different elements?

A

Because not all entities will be involved equally at all stages of the processing chain.

43
Q

Does sharing data or infrastructure automatically equate to joint controllership?

A

No.

44
Q

How does the GDPR define processor?

A

A natural or legal person, public authority, agency, or other which processes personal data on behalf of the controller.

45
Q

What two building blocks must be present for a person to be a data processor?

A
  1. The person is a separate legal entity with respect to the controller.
  2. The person processes personal data on behalf of the controller.
46
Q

Can a subsidiary be a processor for another company in the same corporate group?

A

Yes, because the subsidiary is a separate legal entity.

47
Q

Can a department be a data processor for another department in the same company?

A

No, because a department isn’t a separate legal entity.

48
Q

Under the GDPR, processors focus on how data is processed. What are some of the responsibilities placed on processors relating to how they process data?

A
  1. Security requirements
  2. Record keeping requirements
  3. Notifying controllers of data breaches
  4. Ensuring compliance with the restrictions on international data transfers, outlined in Chapter 5 of the GDPR
49
Q

What happens if a processor goes beyond their mandate and decides on the purpose of the processing or the essential means of processing?

A

It will be considered a controller with regards to that processing.

50
Q

The GDPR restricts how processor processes personal data. What are 2 of these restrictions?

A
  1. May only process on the controllers’ instructions
  2. Must respect a contract or binding legal act regulating the relations between controller an processor
51
Q

What 8 details should be included in a processing contract?

A
  1. Process the personal data only on documented instructions from the controller, including transfers of data outside of the EEA.
  2. Ensure that persons authorized to process personal data have committed themselves to confidentiality
  3. Take all measures pursuant to Article 32 on security of processing
  4. Respect the conditions for enlisting another processor
  5. Assist the controller in responding to requests to exercise data subjects’ rights.
  6. Assist the controller in complying with the obligations in Articles 32-36 (security, DPIAs, and breach notification)
  7. At the choice of the controller, delete or return all personal data to controller after the end of services
  8. Make available to the controller all info necessary to demonstrate compliance with the obligations laid down in Article 28 and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
52
Q

Who is responsible for ensuring that there is a contract or other legal act to govern between controller and processor re how processing should be handled?

A

Both the processor and controller are responsible for making sure such a contract exists.

53
Q

Does a processing contract between controller and processor satisfying Article 28(1) of the GDPR if it restates the provisions of the GDPR?

A

No, it should include specific requirements of how the GDPR’s requirements will be met.

54
Q

What are 3 criteria Article 28 of the GDPR places on subcontracting processing?

A
  1. A processor may not engage another processor without prior authorization of the data controller.
  2. The contract between the initial processor and its subprocessors must include the mandatory provisions set out in original processing agreement.
  3. The initial processor remains fully liable to controller for the performance of its subprocessors.
55
Q

With regards to joint controllers what are 7 areas where there may be overlap or uncertainty re GDPR compliance?

A
  1. Implementation of general data protection principles in Article 5- who is determining retention periods or the legal basis of processing?
  2. Security measures
  3. Notification of personal data breaches- will one controller always take the lead in notifying DPA of data beaches?
  4. DPIAs
  5. Use of processors
  6. Transfers of data to third countries
  7. Communicating with DPAs
56
Q

Under the GDPR what conditions must exist in order for processing to occur?

A
  1. The processing must be wholly or partly carried out by automated means, or
  2. Where the processing is not by automated means, it must concern personal data that forms part of a filing system or is intended to form part of a filing system.
57
Q

Under the GDPR what qualifies as a filing system for purposes of determine whether processing occurs?

A

Refers to a structured set of personal data that are accessible according to specific criteria.

58
Q

Does the GDPR provide a definition for data subject?

A

No.

59
Q

Does the GDPR’s protection of personal data extend to legal entities?

A

No.

CIPP-E (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions