Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

European Data Protection CIPP E > Data Subject Rights (5) > Flashcards

Data Subject Rights (5) Flashcards

1
Q

What rights are granted to data subjects under Access?

A
  1. confirmation of processing
  2. information about processing
  3. access to the personal data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 3 considerations of fulfilling a data subject right to access in terms of cost, format and content?

A
  1. A controller may charge a reasonable fee for further copies
  2. Provided in a commonly used electronic form (unless otherwise requested)
  3. Cannot adversely affect rights and freedoms of others
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the two types of data subject rights to rectification?

A
  1. correction (objectively or subjectively)
  2. completion
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three questions to ask when fulfilling a request to access or rectification?

A
  1. Can we verify the identity of the data subject?
  2. Will this affect the rights and freedoms of others?
  3. Is the request unfounded or excessive?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the right to portability?

A

the right to receive personal data or have it transferred to another controller

applies where consent or performance of a contract is used as lawful grounds for processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the limitations on responsibility of the controller following a portability request? (they do not….)

A

Assume responsibility for processing activities of recipient

Do not have to erase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is interoperability?

A

formats that enable data portability

*does not imply controllers must maintain technically compatible systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the cumulative conditions to exercise data portability?

(article 29 working party)

A
  1. PI processed automatically on the basis of consent or performance of a contract
  2. PI concerning and from the data subject
  3. Does not adversely affect the rights and freedoms of others
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Is the right to erasure an absolute right?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the difference between erasure and right to be forgotten?

A

Right to be forgotten is the right to ensure the information is erased by third parties, including links, copies and replications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the obligations of the controller under the Right to be Forgotten?

A

The controller must inform other controllers that the data subject has requested erasure. Burden on controller to remove the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the grounds to exercise a right to erasure (right to be forgotten)?

A
  1. when data no longer necessary for purpose
  2. data subject has withdrawn consent
  3. data subject objects to processing (basis was legitimate interest)
  4. processing was unlawful
  5. erasure required to fulfill legal obligation (member state law)
  6. data was collected in relation to info society (internet) from a child based on consent
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the exceptions to right to erasure / be forgotten?

A

freedom of expression

compliance with a legal obligation

public interest in the area of public health

archiving purposes

establishment, exercise or defense of legal claims.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are 4 circumstances in which a data subject exercise their right to restriction of processing (article 18)?

A

1) when processing is unlawful but data subject prefers restriction to erasure

2) when accuracy is contested and controller needs time to verify

3) when controller no longer needs data but data subject needs it for legal claim

4) when data subject objects to processing pending controller’s verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Under what conditions can data be further processed once exercised the right to restriction of processing?

A

New consent
Exercise or defend legal claims
Protect rights of another person
Important public interest reasons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the definition of the right to restriction of processing?

A

Personal data is stored without further processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How can a controller fulfil a right to restriction of processing request?

A
  1. move data to a separate system
  2. mark data as DO NOT USE
  3. temporarily remove published data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When can you exercise the right to object to processing?

A
  1. public interest or legitimate interest (not absolute, burden on controller to justify)
  2. research or statistical purpose (not absolute, overridden if processing is necessary in public interest)
  3. direct marketing (absolute)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are data subject rights related to automated decision-making under Article 22?

A

Data subject has the right not to be subject to a decision based solely on automated processing, including profiling, if decisions have legal and significant effects

20
Q

When can a data subject NOT exercise right to not be subject to automated decision making?

A

1) when processing is necessary to enter or perform contract
2) when authorized under union or member state law and safeguards in place
3) when data subject has given explicit consent

21
Q

When is automated decision-making permitted on special category data?

A

explicit consent
substantial public interest based
suitable measures in place

22
Q

What are the good practice recommendations for automated decision-making under Article 29?

A

provide meaningful information about logic involved
WP29 guidelines on consent
implement mechanism to check profiles and correct
make clear to data subject their right to object
appropriate safeguards

23
Q

What is profiling ?

A

automated processing of personal data for the purpose of evaluating, analyzing and predicting personal aspects relating to a natural person

24
Q

What are examples of profiling/targeting?

A

adware (software on user computer)
cookies (piece of text web server can store on hard drive)
beacon (passes information from user computer to website)
digital fingerprint (end user device identification)

25
Q

Which data subject right provides data subjects with entitlements to certain information from controller upon request?

A

Right to Access

26
Q

What 8 kinds of information about processing can be obtained when exercising a right to access?

A
  1. purpose of processing
  2. categories of personal data
  3. recipients of data (including countries and IOs)
  4. retention period
  5. rights to rectification and erasure and restriction or object
  6. lodge a complaint with the SA
  7. source of data
  8. automated decision-making
27
Q

What are the cases where a data subject can exercise their right to object to processing of personal data? (3 cases)

A

direct marketing
public interest or legitimate interest
research or statistical purposes

28
Q

What right is granted to data subjects under article 15?

A

right to access

data subjects may request information from controllers about processing of their personal data

29
Q

In which circumstances (bases) can a data subject object to processing of their personal data?

A
  1. when processing is conducted on the basis of controller’s legitimate interest
  2. processing for direct marketing
30
Q

What is the required timeframe to respond to data subject requests upon receipt of request under Article 12?

A

One month

Can be extended to two months

31
Q

What does the Right to Information require to provide about controllers (Article 13)?

A

right to be provided with information that describes their relationship with the controller

controller identity, contact details, reasons for processing, legal basis and recipients of data

32
Q

What does the Right of Access grant data subjects? (article 15)

A

purposes of processing
categories of personal data processed
recipients or categories of recipients
period data will be stored
right to request rectification
right to lodge complaint to SA
source of personal information
existence of automated decision-making

33
Q

What does the EDPB ask of social media controllers regarding right to access?

A

implement mechanism for users to independently check profile - including data collected and sources

34
Q

What must a controller do if rejecting a request to rectification?

A

inform data subject without undue delay
inform reasons for not correcting
inform of right to complain to DPA

35
Q

What must a controller do if complying with a right to rectification if it has shared the data with third parties?

A

contact 3rd parties and inform them of the rectification

36
Q

For what reasons can a data subject request their data to be erased? (right to be forgotten)

A
  1. data no longer needed for original purpose
  2. data subject withdraws consent
  3. controller has no overriding grounds for continuing processing
  4. data has been processed unlawfully
  5. erasure is necessary for compliance with EU law
37
Q

When can organizations decline data subject requests to erasure?

A
  1. when exercising right of freedom of expression and information
  2. compliance with a legal obligation which requires processing by law
  3. for establishment and exercise of legal claims
38
Q

When is a controller exempt from the obligation to to notify 3rd parties of data subject rectification, erasure or blocking?

A

if it is impossible to comply

would require disproportionate effort

39
Q

According to the EDPB, what considerations must be taken into account when applying article 17 (right to be forgotten) to search engine results?

A

content will only be delisted that appears in searches for the data subject’s name

delisting does not result in personal data being erased

40
Q

When can search engines refuse to delist content following a data subject request?

A
  1. can demonstrate its inclusion is strictly necessary for protecting freedom of information
  2. processing is necessary for compliance with a legal obligation
  3. processing necessary for performance of public interest
  4. search engine can demonstrate delisting is a serious obstacle or prevents archiving, research or statistical purposes
41
Q

What are the 4 conditions under which data subjects exercise their right to restrict processing?

A
  1. accuracy of data is being contested
  2. processing is unlawful
  3. controller no longer needs data for original purpose but data still required by data subject for legal rights
  4. verification if legal grounds of controller override rights of data subject
42
Q

What is the right to data portability? (Article 20)

A

data subjects have the right to receive their own personal data, which they have provided to a controller, in a structured, commonly used and machine-readable format

and, the right to transmit the data to a controller without hindrance

43
Q

What are 2 methods a controller can hand over data to a data subject (right to portability) per Article 20?

A

1) hand the data over to data subject in a usable fashion

or

2) transfer data to a recipient of data subject’s choice

44
Q

Is there a formal process to submit a right to object to processing?

A

no, requests can be made verbally or in writing, to any part of the organization and need not say specifically “objection to processing”

45
Q

When does the right to not be subject to automated decision-making apply?

A

if a decision is based solely on automated processing and produces legal effects concerning the data subject or significantly affects them

46
Q

If a data subject request for erasure is valid, how soon must the controller commence with erasure?

A

without undue delay

47
Q

What must a controller do in the case of a request for erasure if they have made the data public?

A

take reasonable steps to inform other controllers of the erasure

European Data Protection CIPP E (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions