Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP-E > Chapter 7 (Lawful Processing Criteria) > Flashcards

Chapter 7 (Lawful Processing Criteria) Flashcards

1
Q

What Article of the GDPR outlines the lawful bases for processing personal data?

A

Article 6 of the GDPR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 6 legal grounds for processing data under the GDPR?

A
  1. Consent from data subject
  2. Contract Performance: including steps requested by data subject prior to entering contract
  3. Legal obligation
  4. Vital interest of individuals: re data subject or another natural person
  5. Public interest
  6. Legitimate interest: of the controller or by a third party
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Under the GDPR, what 4 conditions must a data subject’s consent meet to be considered valid?

A

The consent must be:
1. Freely given
2. Specific
3. Informed, and
4. Show an unambiguous indication of wishes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Who has the responsibility of demonstrating that the data subject has consented to the process?

A

The controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

According to the EDPB, consent is the appropriate lawful basis for processing only when what exists?

A

The data subject is offered control and a genuine choice on the use of their personal data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Under the GDPR, what does freely given consent mean?

A

It means the data subject must have a genuine choice and must be able to refuse or withdraw consent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Why did the Directive, and then the GDPR, require the controller to provide a wholly separate document just dealing with obtaining consent?

A

The reasoning behind this separation was a data subject is not giving free consent if their consent is bundled with some other issue.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

If a data subject’s consent is given in the context of a written declaration that also concerns other matters, how must the request for consent be presented?

A

The request for consent must be presented in a manner clearly distinguishable from the other matters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The GDPR indicates that consent shouldn’t be relied upon when what exists? What are two examples?

A

Consent shouldn’t be relied upon where there is a clear imbalance between the data subject and controller.

Some examples include:
1. When the controller is a public authority
2. The employee-employee relationship

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

If data processing has multiple purposes, does a controller need to get consent for each purpose?

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

According to the EDPB, in order for consent to be specific a controller must apply what 3 things?

A
  1. Purpose specification as a safeguard.
  2. Granularity in consent requests.
  3. Clear separation of info as it relates to obtaining consent for data processing activities from info about other matters.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What allowance does the GDPR make for consent related to scientific research purposes?

A

When it’s not possible to fully identify the purpose of scientific research, data subjects can legally give their consent consistent with recognized ethical standards for scientific research.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Under the GDPR, what does informed consent mean?

A

Means that the data subject is given all the necessary details of the processing activity in a language and form they can understand so they can comprehend how the processing will affect them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

According to the EDPB what 6 things must be provided (at a minimum) in order to obtain valid consent?

A
  1. Identity of controller
  2. Purpose of each of the processing operations for which consent is sought
  3. Type(s) of data to be collected and used
  4. Existence of right to withdraw consent
  5. Info about use of data for automated decision-making in accordance with Article 22(2)(c)
  6. The possible risks of data transfers to third countries in the absence of an adequacy decision and appropriate safeguards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

If consent is going to be relied upon by multiple controllers must all controllers be specifically named for the consent? For the processors?

A

Yes, the EDPB expects all controllers to be specifically named.

Processors do not need to be named.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Does silence or prefixed boxes (an opt-out option) constitute consent? If not why?

A

No, because in order for consent to be unambiguous the data subject must give an active indication of consent through an affirmative action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Does the GDPR expressly state a controller must retain written evidence to demonstrate it has obtained consent from data subject?

A

No, however since the burden of proof is on the controllers written records are required for all practical purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What type of consent does Article 8 of the GDPR deal with?

A

Consent with respect to children and information society services offered to children.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In order to rely on consent as a legal basis for processing children’s personal data, how old must the child be for their consent to be valid?

A

The child must be at least 16 years old.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

If a child is under 16 years old processing via consent is only lawful if what occurs?

A

If and to the extent that consent is given or authorized by the holder of personal responsibility over the child.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Under the GDPR, May member states set a minimum age of consent less than 16 years old?

A

Yes, so long as the minimum age of consent is not lower than 13.

22
Q

The minimum age consent rule applies only in what context?

A
  1. An information society service offered directly to a child, and
  2. Where the controller relies solely on consent or perhaps can’t rely on other criteria.
23
Q

Under the GDPR is there a specific time limit for how long consent can last?

A

No.

24
Q

Under the GDPR, the test for the necessity of processing personal data requires what?

A

A close and substantial connection between the processing and the purposes.

25
Q

When is contract performance a relevant legal basis for processing personal data?

A

When a data subject purchases a product or service from a controller and, through the delivery of that product or device, the controller needs to process the individual’s personal data.

26
Q

When processing data based on a legal obligation, does this include obligations under a contract? A legal obligation from a non-EU country?

A

An obligation under a contract a controller has entered into or imposed by a non-EU country do not qualify as a sufficient legal obligation.

Generally relates to things like tax or social security obligations.

27
Q

Is the vital interests principle used often as a legal grounds for processing data?

A

No, because it refers to circumstances of life or death, i.e. processing the data is vital to an individual’s survival.

28
Q

Can a data subject object when a controller is processing data on the legal grounds that processing is necessary for the public interest/under the controller’s vested official authority?

A

Yes, if an objection occurs the controller must show that it has compelling legit grounds that override the data subject’s interests, rights, and freedoms.

29
Q

What are 3 factors involved in determining whether a controller has a legitimate interest in processing personal data?

A
  1. The processing must be necessary for the purpose.
  2. The purpose must be a legitimate intent of the controller or third party.
  3. The legit interest can’t be overridden by the data subject’s interests or fundamental rights and freedoms.
30
Q

Recital 47 of the GDPR states that a legit interest can exist when what is present?

A

Where there is a relevant and appropriate relationship b/w the data subject and controller in situations such as where the subject is a client or in the service of the controller.

31
Q

What are 4 examples the GDPR gives of legitimate interest and reasonable expectations re data processing ?

A
  1. Purpose of preventing fraud
  2. Direct marketing
  3. Sharing personal data within a group of undertakings or institutions affiliated with a central body for internal admin purposes (e.g. client or employee personal data)
  4. To ensure network information security
32
Q

Can a data subject object when a controller is processing data on the legal grounds that processing is based on controller’s legitimate interest?

A

Yes. Controller must show that its interest overrides data subject’s interests, rights, and freedoms.

33
Q

If a data subject makes a justified objection to controller’s processing of data based on a legit interest can the controller keep processing data?

A

No, must hold off on proceeding until the objection has been addressed.

34
Q

In order to rely on the legal grounds of legal obligation and/or public interest, the processing should have a basis in what?

A

EU or member state law.

35
Q

Article 9 of the GDPR is concerned with protecting what?

A

Special categories of data know as sensitive data.

36
Q

What qualifies as sensitive data?

A

Personal data revealing:
1. Racial or ethnic origins
2. Political opinions
3. Religious or philosophical beliefs
4. Trade Union membership
5. Processing of genetic data
6. Biometric data for the purpose of uniquely identifying a natural person
7. Data concerning health
8. A natural person’s sex life or sexual orientation

37
Q

Should photographs of individuals systematically be considered to be sensitive data?

A

No. They are covered by the definition of biometric data only when processed through a specific technical means that allow the unique identification or authentication of an individual.

38
Q

How is Article 9 of the GDPR structured with regards to processing sensitive data?

A

The general starting point is that processing is prohibited unless one of the narrow exceptions applies.

39
Q

Under the GDPR, what are the 10 exceptions that allow a data controller to process sensitive data?

A
  1. Explicit consent (unless EU or member state law states that prohibition can’t be lifted)
  2. To carry out obligations/exercise rights of controller/data subject in the field of employment, social security, and/or social protection law
  3. Protects vital interest of data subject physically or legally incapable of giving consent
  4. Legit activities of a foundation, association, or any other not-for-profit body with philosophical, religious, or trade union aims
  5. Personal data which are manifestly made public by data subject
  6. Establishing, exercising, or defending legal claims or court acting in judicial capacity
  7. Substantial public interest based on EU or member state law
  8. Preventive or occupational medicine, assessment of the employee’s working capacity, medical diagnosis, provision of health or social care, or treatment or the management of health or social care systems and services
  9. Public interest in the area of public health
  10. Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1)
40
Q

How does the consent requirement for sensitive data (Article 9) differ from the consent requirement for personal data in general (Article 6)

A

In addition to being unambiguous, freely given, specific and informed, consent under Article 9 must be explicit.

41
Q

The EDPB’s guidelines indicate that explicit consent under the GDPR refers to what?

A

The way consent is expressed by data subjects.

42
Q

What are some examples of explicit consent?

A
  1. Filling in an electronic form
  2. Sending an email
  3. Using electronic signatures
  4. Employing two-stage verification
43
Q

Can there be circumstances where a member state’s law stipulates consent isn’t enough to avoid the prohibition on processing sensitive data?

A

Yes.

44
Q

The sensitive data exception for nonprofit institutions with philosophical, or trade union aims generally applies to what type of organizations?

A
  1. Churches
  2. Other religious establishments
  3. Political parties
45
Q

The sensitive data exception for nonprofit institutions with philosophical, or trade union aims allows processing to occur for what type of data subjects?

A
  1. Members of the given institution
  2. Former members of the given institution
  3. Those who have regular contact with the institution
46
Q

If the sensitive data exception for nonprofit institutions with philosophical, or trade union aims applies what are 4 restrictions that are placed on the processing?

A

The processing must only take place
1. In the course of the institution’s legit activities
2. With appropriate safeguards
3. In connection with their specific purposes, and
4. Cannot be disclosed outside of the institution without the explicit consent of the relevant data subject

47
Q

The GDPR tightens up member state’s ability to set down in law what they consider to be in the substantial public interest by adding what 3 additional requirements?

A

That the laws
1. Are proportionate to the aim pursued
2. Show respect for the essence of the right of data protection
3. Provide specific measures to safeguard the fundamental rights and interests of the data subject

48
Q

Processing sensitive data under the medical or social care purpose exception may be carried out on the basis of what laws or legal documents?

A
  1. EU laws
  2. Member state laws
  3. A contract with a health professional subject to the conditions an safeguards provided in Paragraph 3 Article 9 of the GDPR
49
Q

The medical or social care purpose exception for processing sensitive data is generally understood to cover whom?

A
  1. Doctors
  2. Nurses
  3. Others involved in health care professions
50
Q

Give 2 examples of when the public health interest exception for processing sensitive data may apply.

A
  1. Protection against serious cross-border threats to health
  2. Ensuring high standards of quality and safety of health care and of medicinal products or medical devices
51
Q

The GDPR added what two data elements to the original sensitive data list under the Directive?

A
  1. Genetic data
  2. Biometric data

CIPP-E (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions