Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP/E > GDPR > Flashcards

GDPR Flashcards

1
Q

GDPR application for establishment in EU

A

The GDPR will apply directly in all Member States of the European Union and in Iceland, Liechtenstein and Norway, which are part of the European Economic Area (EEA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

GDPR application for non-establishment in EU

A

Applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Scope of GDPR

A

GDPR Art 3 covers scope. Applies to processing of personal data of any controller or processor in the union regardless of whether the processing takes place in the union or not.

  1. You are established in EU as a process or a controller
    Should be interpreted with a wide scope. If HQ is in one country but team making decisions is in the EU, you are in the scope
  2. You offer goods or services to data subjects in the union
    Website simply accessible to global audience is not enough.
  3. You monitor (or profile) behavior of EU citizens such as location, wellness monitoring, CCTV, OBA, home automation…
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Name the Data 8 Subject Rights

A
  • Right of transparent communication and information
  • Right of Access
  • Right to recitifcaiton
  • Right to erasure
  • Right to restriciton on processing
  • Right to data portability
  • Right to object
  • Right not tho be subject to automated decision making or profiling
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Right of Access

A

Individuals have right to obtain copy of their personal data and supplementary information.

If a request is made, there is a one month window to respond. Company can ask for 2 month extension if needed. Under GDPR, you generally cannot charge but you can charge a reasonable fee if the request is unless, unfounded, or excessive.

Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Right of Rectification

A

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Right of Erasure

A

Also known as the Right to be Forgotten. Not absolute and only applies if:

  • Personal data no longer necessary for original purpose it was collected for
  • Individual the info is about withdraws consent
  • No legitimate interest any more
  • Direct marketing purposes and the individual objects to the processing
  • The data was unlawfully processed
  • Information involves children

Does not apply to processing done for following reasons:

  • Data collected in public interest or due to legal obligation
  • To exercise or protect legal claims
  • If it is necessary for public health purposes/preventative or occupational medicine
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Right to Restriction of Processing

A

Individual has right to restrict processing of personal data in limited circumstances. This is an alternative to erasure.

In most cases you only need to have the restriction in place for certain period of time.

Can request restriction if:

  • They contest the accuracy and entity is now confirming it
  • The data was unlawfully processed
  • The individual needs you to keep data
  • The individual has objected to you processing and you are evaluating claim.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Right to Data Portability

A

Right to receive the personal data they have provided to controllers in a structured and commonly used, machine readable format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Right to Object

A

Individuals can ask that their data stop being processed.

Absolute right: Direct marketing and profiling

Right to be evaluated: tasks carried out in public interest, official authority, or for legitimate interest. Processing must be stopped until dispute is resolved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Right to not be subject to automated decision making or profiling

A

he data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Examples: Online decision for loan, recruitment tests…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Restrictions on Privacy Rights

A

Member states can restrict obligations under GDPR hen such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

  • national security/defense
  • public security
  • prevention of crime
  • other important interests of the member state
  • protection of judicial independence
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

GDPR Security Obligations

A

Mirror the requirements from the Data Protection Directive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data Breach Notifications

A

Controller needs to notify DPA and data subjects
Processors only need to notify controllers
Controller needs to notify DPA without undue delay which is subject to 72 hour limit
Provide contact details of DPA contact person
Also, information regarding the categories and approx number or data subjects concerned
A description of the nature of the breach
Likely consequence of the breach
Measures the organization has taken or proposed to take to address the breach.

Controllers must provide notification to data subjects if the breach is high risk to their rights and freedoms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Exceptions to Controller Requirement to Notify Data Subjects of Breach

A
  • Data is unintelligible such as encryption
  • Controller took steps to prevent high risks from materializing
  • Notification would involve disproportionate effort: in such cases some effort must be made such as a public announcement.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Signs of Proper Accountability

A

Regulators want to see data protection embedded within corporate DNA

  • Need to have in place appropriate technical and organizational efforts
  • Data protection policies
  • Data protection by design and default
  • Documentation of processing activities
  • Appropriate security measures
  • Data protection officers and impact assessments.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data Protection by Design/Default

A

1) Proactive not reactive
2) Privacy as the default setting
3) Privacy embedded into design
4) Full functionality
5) End to end security
6) Visibility and transparency
7) Respect for user privacy

By default:

  • Most protective option is the default option. No action by the data subject will result in the most privacy.
  • Data retention period being kept at minimum amount is a similar option
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Vendor Contracts

A

When a controller uses a processor they must have a contract in place with certain requirements specified by GDPR
Controllers are liable for their compliance with GDPR and should only apoint processors that adhere to GDPR standards.
Processors have direct responsibilities
Contracts must set out the subject matter and duration of the processing along with the nature and purpose of the processing, type of data and categories of data subject, and obligations and rights of the controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Processor Responsibilities Under GDPR

A
  • Controller authorization to use sub-processor
  • Co-operate with supervisory authorities
  • Ensure security
  • Keep records of processing
  • Notify data breaches to the controller
  • Employ a data protection officer
  • Appoint a representative within the EU if established outside of EU.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data Protection Impact Assessment (DPIA)

A

Required under GDPR. GDPR requires DPIA before carrying out process likely to result in high risk
Consult DPA if high risk

DPIAs are mandatory in some situations
Must do a DPIA if:
- Systematic and extensive profiling with significant effects
- Special category or criminal offence data on a large scale
- Systematically monitor publicly accessible places on a large scale.

DPIA must contain at least:

  • Processing operation, purposes and legal basis
  • Necessity and proportionality of processing
  • Assessment of risks
  • The measures, safeguards, security.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data Protection Officer (DPO)

A

Recognized by GDPR but not required for every company
Mandatory if:
- Controller is a Public authority
- Core activities involve systematic monitoring on a large scale
- Large scale = number of subjects, range of data, duration of permanence of processing, geographic coverage.

Code of Conduct Must be submitted to DPA for authorization

22
Q

Cross Border Transfers

A

Personal data may only be transferred beyond the EEA if done so in compliance with GDPR under these conditions:

1) Adequacy decisions: European Commission can issue a decision that the county or territory in question has an 2) Appropriate Safe Guards
3) Derogation

23
Q

Exceptions for Cross Border Transfers

A

Also known as Derogations:

  • Informed consent
  • Performance of contract
  • Public interest
  • Exercise or defence of legal claims
  • Vital interest of the data subject

Certification is not a valid derogation. If you wish to use a derogation, must notify DPA.

Must be non-repetitive, for a limited number of data subjects, and for “compelling” legitimate interest. Controller must inform the DPA of the derogation-based transfer and compelling legitimate interest.

24
Q

6 Bases for Legal Processing

A
  1. Consent - Most unreliable because data subject can withdraw at any time.
  2. Contract
  3. Legal Obligation
  4. Vital Interest
  5. Public Interest
  6. Legitimate Interest
25
Q

Requirements for Consent

A

Must be clearly distinguishable. Does not exist when there is a clear imbalance between data subject and controller (employer must treat emloyees that refuse consent as favorably as those that do)

If person finds the consent form confusing it will lack consent.

26
Q

eCookie Directive

A

Does not apply to cloud computing

27
Q

Which body votes on directives

A

Council of Europe

28
Q

Name things processors are not responsible to do

A

Perform data protection assessments.

29
Q

When data subject takes back consent

A

Can do this at any time. Once it is done, future processing is not allowed. The processor does not need to destroy prior processing unless data subject invokes right of erasure.

30
Q

Processing pursuant to contract

A

Data subject cannot just revoke consent and ask for something to be taken down if it is in violation of the terms of the contract.

31
Q

Legal obligation processing

A

Example: Employer must report employee wages to IRS. The legal basis must be based on a union or member state law.

32
Q

Vital interest processing

A

Such as saving someone’s life. Think about a hospital having to access information to save your life when neither you or a family member are available to consent.

33
Q

Public Interest Processing

A

Processing in the exercise of an official authority vested in the controller.

34
Q

Legitimate Interest Processing

A

Any interest of the controller or processor to process data that does not violate rights of subject. Examples: Processing data to prevent fraud, processing employee data for administrative purposes, providing network security to your organization.

35
Q

What types of data are generally prohibited from processing?

A

Race, ethnicity, politics, religion, philosophy, trade union membership, genetic data, biometric data, health, sex life, and sexual orientation.

36
Q

When may typically prohibited data be processed?

A
  1. When data subject gives explicit consent (like a yes or no option).
  2. To comply with state employment laws.
  3. Vital interest.
  4. Legitimate activity of a political, philosophical, religious, or trade organization but info cannot be disclosed outside organization without explicit consent.
  5. Data subject makes the sensitive data public
  6. Establishment, exercise, or defense of legal claims
  7. Preventative or occupational medicine (worker’s compensation and treatment).
  8. Public health
  9. Archiving in the public interest.
37
Q

Transparency Principle

A

Anything presented to data subject should state:

  • What date is collected and how it is used.
  • Be easily accessible
  • Be easy to understand.

Requests by a data subjects exercise of rights shall be free. If the requests are unfounded or repetitive and excessive, the controller my charge a reasonable fee or refuse the request.

38
Q

What data subject rights apply to all types of processing?

A

Rights of access, rectification, and restriction.

39
Q

Things Controller should do when hiring a Processor…

A

1) Implement technical and organizational measures
2) Written contract stating duration, purpose of processing, type of personal data, and categories of data subjects.
3) The processor can only process per your instructions
4) They will keep data confidential
5) They will assist Controller with data subject requests
6) They will delete or return data to controller at conclusion of contract.

*A processor hiring a sub-processor should do the same because a processor is fully liable to a controller for a sub-processor’s work.

40
Q

Three elements of territorial scope of GDPR

A

1) Establishment in the EU, or
2) Offering goods or services To people in the EU, or
3) Monitoring people’s behavior in the EU

41
Q

Documentation and Cooperation with Regulators

A

You do not need to document if your organization is under 250 people. Since most companies will be larger than this, then need to document by keeping records of processing activity and having data protecting policies.

42
Q

Adequacy Decision

A

The Commission deems the recipient county has adequate safeguards. The adequacy decision that pertains to the US is the Privacy Shield.

43
Q

US Safe Harbor

A

2000 TO 2015, ruled illegal by CJEU because it violated rights to privacy

44
Q

Privacy Shield

A

US-EU privacy framework adopted in 2016. This is a self-certification program. A company fills out a form with the US Department of Commerce.

45
Q

Name which authorities have authority to approve certain types of data transfer frameworks

A

Commission: Adequacy decisions and Standard Contractual Clauses.
DPA: Ad Hoc Clauses, Derogations, and Binding Corporate Rules
Code of Conduct: European Data Protection Board then the Commission.

46
Q

Binding Corporate Rules

A

1) Multinational company drafts them
2) Sends to DPA for approval
3) Gets put on approved list.

Disadvantage is they don’t bind anyone or entity outside your company.

47
Q

Codes of Conduct

A

These are used by smaller business and allow them to engage in international data transfer.

48
Q

DPA

A

Data Protection Authority or Supervisory Authority. They monitor, enforce, promote, and advise on data protection issues. They have investigative, corrective, and authorization and advisory powers.

They can issue warning s but not notice of alleged infringement. They can issue reprimands, order compliance with data subject’s request, ban processing, and impose fines. They also issue opinions, approve BCRs, clauses, codes of conduct, and certifications.

49
Q

Who is the lead DPA?

A

The place with the greatest “substantial affect” on data subjects. If the events took place in multiple jurisdictions then the lead DPA is where the data processing decisions were made.

50
Q

European Data Protection Board

A

Head of each DPA. They monitor the DPAs, advise the Commission, and oversees consistency. They issue guidelines for interpreting the GDPR.

51
Q

What can data subject do if GDPR is violated?

A

They have three options:

1) Lodge complaint with SA. Can be based on where there residence is, where they work, or where the infringement took place.
2) Sue any DPA where it is located.
3) Sue any controller or processor where they are established, or where the data subject lives, works, or where the infringement took place.

52
Q

Infringements and Fines under GDPR

A

10m OR 2% of revenue: Involving children’s parent’s consent; poor data protection design; failure to hire DPO or causing dysfunction for DPO; Issue with certification such as false claim of cert.

20m or 4% revenue: All other infringements.

CIPP/E (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions