Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP/E > Processing Personal Data > Flashcards

Processing Personal Data Flashcards

1
Q

What is the definition or processing (include GDPR article)?

Include examples from various sectors

A

Article 4(2)

“Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means”

Examples:

  • Recording: a customer service call with a client to demonstrate accountability for following company procedures
  • Retrieving: discovering a typo and correcting the mistake to access account information
  • Disclosure: an HR director shares a list of candidates for an open job position with their team
  • Storage: HR department stores the newly hired employee’s file containing their employment application, performance reviews, and benefits information
  • Collection: a product dev team collects results from customer satisfaction surveys at a trade show
  • Adaptation or alteration: hard copies of the surveys are digitized and the data is aggregated
  • Structuring: Aggregated data is shown on a graph that compares it with results from previous surveys
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the OECD Guidelines?

A 
Collection limitation
Data quality
Purpose specification
Use limitation
Security safeguards
Openness
Individual participation
Accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is collection limitation?

A

OECD Guideline

There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is data quality?

A

OECD Guideline

Personal data should be relevant to the purposes for which they are used, and, to the extent necessary for those purposes, should be accurate, complete, and kept up-to-date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is purpose specification?

A

OECD Guideline

The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is use limitation?

A

OECD Guideline

Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with [the purpose specification principle] except a) with the consent of the data subject; or b) by the authority of law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are security safeguards?

A

OECD Guideline

Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is opennness?

A

OECD Guideline

There should be a general policy of openness about developments, practices, and policies with respect to personal data. Means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as their identity and usual residence of the data controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is individual participation?

A

OECD Guideline

An individual should have the right:

a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him;
b) to have communicated to him, data relating to him within a reasonable time; at a charge, if any, that is not excessive, in a reasonable manner, and in a form that is readily intelligible to him;
c) to be given reasons if a request made under subparagraphs (a) and (b) is denied, and to be able to challenge such a denial; and
d) to challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed, or amended.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is accountability according to the OECD?

A

OECD Guideline

A data controller should be accountable for complying with measure which give effect to the principles stated above

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is lawfulness, fairness, and transparency of processing?

A

GDPR Processing Principle (Article 5)

Requires honest practices, such as communicating openly with data subjects about processing activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is purpose limitation?

A

GDPR Processing Principle (Article 5)

Requires collecting and processing personal data for the specified purpose only.

To determine if personal data may be processed further, use a compatibility test to look for links between purposes, nature of the data, method of collection, consequences of secondary uses and safeguards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is data minimization?

A

GDPR Processing Principle (Article 5)

Processing only personal data that is relevant and necessary for the purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is accuracy?

A

GDPR Processing Principle (Article 5)

Processing complete and up-to-date personal data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is storage limitation?

A

GDPR Processing Principle (Article 5)

Storing only personal data that is relevant and necessary for the purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is integrity and confidentiality?

A

GDPR Processing Principle (Article 5)

Require ensuring personal data is secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is accountability under GDPR?

A

GDPR Processing Principle

Processing personal data responsibly and demonstrating compliance with EU and member state data protection laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When does the GDPR apply? Which articles relate to the scope?

A

When 1 of the three criteria for territorial scope is met (as explained in Article 3) AND when activities fall within the material scope (as outlined in Article 2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How does the GDPR define territorial scope (include article)?

A

Article 3

Lays out 3 criteria; only 1 of these criteria must be met for the GDPR to be applicable:

  1. Processing of personal data when a controller or processor is established in the EU (regardless of whether the actual processing takes place in the EU);
  2. Processing the personal data of subjects in the EU relating to offering goods or services or monitoring behavior in the EU (where the controller or processor is not established in the EU;
  3. By a controller in a place where member state law applies by virtue of public international law
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the material scope of the GDPR (include article)?

A

Article 2

Material scope must also be met for GDPR to apply (in addition to below)

Includes:

  • Processing personal data wholly or partly by automated means…any processing with or without human intervention (do NOT confuse with automated decision-making, which has strict restrictions under the GDPR
  • Processing other than by automated means of personal data which form part of a filing system;
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the exclusions for the material scope of the GDPR?

A

These exclusions for data processing are not regulated by GDPR for purposes that include:

  • activities outside the scope of EU law (ie national security activities)
  • law enforcement and public security
  • purely personal or household activities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Name the six lawful grounds for processing personal data (include article)

A

Article 6

One of the six must me bet for processing of personal data to be lawful:

  1. Consent from the data subject for a specific processing purpose;
  2. Performance of a contract if the processing is necessary to perform the contract and the data subject is party to the contract or the data subject requests to enter into the contract;
  3. Legal obligation (compliance with one to which the controller is subject);
  4. Protection of vital interests of the data subject or another natural person;
  5. Necessity for the public interest or in the exercise of official authority of a controller;
  6. Legitimate interests of the controller or a third party, UNLESS overridden by the interests, rights, or freedoms of the data subject
23
Q

What is unique about consent under the GDPR?

A

It is a common basis used to lawfully process personal data, but under the GDPR, additional conditions must be met to use this option.

It must be:

  • Freely given
  • Specific
  • Informed
  • Unambiguous

*Children

24
Q

Explain the “performance of a contract” as a lawful ground for processing personal data according to GDPR

A

Processing personal data may be necessary to perform a contract.

Commonly, a customer may purchase a good or service from an organization.

For that good or service to be provided, the organization must process the personal data of the customer.

25
Q

Explain “compliance with legal obligation” as a lawful ground for processing personal data

A

Compliance with a legal obligation to which a controller is subject is meant to be interpreted narrowly.

It applies to legal obligations required by EU and member state laws ONLY. It does not include legal obligations of contracts or those of third countries (outside the EU).

26
Q

Explain how protection of vital interests may be used as lawful grounds for processing personal data under GDPR

A

If personal data must be processed to ensure an individual’s survival, a controller may rely on vital interests for lawful processing.

This basis for processing should only be used in an emergency situation and if no other option is available.

27
Q

Explain how the necessity for the public interest or in the exercise of official authority of the controller may be used as lawful grounds for processing personal data under GDPR

A

A controller may be required to process personal data in the public interest, and member state legislation may determine what tasks fall within the public interests.

Examples include the administration of justice, tax collection, and research and statistical purposes, such as census.

28
Q

Explain how legitimate interests may be used as a lawful ground for processing personal data?

A

Legitimate interest of the controller or a third party has often been used as a safety net in the absence of another lawful basis for processing personal data, and while it may still prove a more realistic option than consent, it should be used with caution.

29
Q

What is consent?

A

It is permission from a data subject that provides the controller with permission to process the individual’s personal data for a specific purpose.

It must be:

  • clearly distinguishable from other matters
  • intelligble
  • in clear and plain language

*Controller should keep records of consent as they may be obligated to demonstrate that it was obtained

30
Q

What is freely given consent?

A

If a controller relies on consent, data subjects must be able to choose to have their personal data processed AND they must be free to withdraw consent at any time.

Withdrawing consent should be as easy as giving consent.

31
Q

When is consent forbidden as a lawful grounds for processing under GDPR?

A

If there is a clear imbalance between the controller and the data subject (e.g. when a controller is a public authority)

Also, a service or the performance of a contract should not be conditional upon consent unless it is necessary for the performance of a contract.

32
Q

What is specific consent?

A

Data subjects must be informed of all intended purposes for processing their personal data at the time of consent.

If another purpose arises, the data controller may be required to obtain additional consent.

33
Q

What is unique about consent for research and scientific purposes?

A

Data subjects should be able to give their consent to certain areas of scientific research when keeping with recognized ethical standards.

Data subjects must give consent with as much specificity as possible, while knowing that other uses within the same general area of scientific research may arise.

34
Q

What is informed consent?

A

For consent to be legitimate, the data subject must be informed of the controller’s identity, purpose and information about how processing may affect data subjects.

It must be communicated to data subjects using understandable language and form.

It is the controller’s responsibility to demonstrate that data subjects were informed prior to consent.

35
Q

What is unambiguous consent?

A

The wishes of the data subject must be ABSOLUTELY clear. This requires an AFFIRMATIVE action, such as checking opt-in or choosing technical settings for web apps.

Silence, pre-ticked boxes, and non-activity do not count as unambiguous expression of a data subject’s wishes.

36
Q

When must a parent give consent for a child?

A

When the child is younger than 16 years old.

*However, some member states can lower this threshold to as young as 13 years old.

37
Q

Describe the burden on controllers when relying on legitimate interests as the basis for processing

A

The controller must show that the data subjects’ fundamental rights and freedoms have not been compromised

38
Q

What are measures that the controller can take to demonstrate that they have met their obligation to data subjects if relying on legitimate interest?

A

Obligation=showing the data subjects’ rights have not been compromised

Transparency, adequate safeguards and compliance can help support the controller’s case

39
Q

When relying on legitimate interest, the controller must:

A

Ensure that the purpose of processing is a legitimate interest of the controller or a third party

Ensure that processing the personal data is necessary for the legitimate interest

Inform data subjects, at the time data is collected, of the controller’s claimed legitimate interests

Balance the legitimate interests with those of the data subjects

Uphold fundamental rights and freedoms of data subjects

40
Q

Why is the controller-data subject relationship important with legitimate interest?

A

Because it has an effect on data subjects’ reasonable expectations.

41
Q

What are some examples of purposes of controllers with a legitimate interest?

A

Fraud prevention
Direct marketing
Administrative purposes
Information security

42
Q

Who/what may not rely on legitimate interest as grounds for processing personal data?

A

Public authorities

43
Q

What are the exceptions to the prohibition on processing special categories of data?

A

Explicit consent

Employment Context

Vital interests of the individual

Establishment, exercise, or defense of legal claims

Political, philosophical, and religious purposes

Substantial public interest

Medicine and social healthcare

Public health

Public archives or scientific or historical research or statistical purposes

44
Q

Explain the differences in consent between Articles 6 and 9

A

The consent under Article 9 (processing special categories of data) is different from that under Article 6 in that it must be EXPLICIT.

Any Article 9 consent must still be unambiguous, freely given, specific, and informed, but in addition, it must be a clear affirmative act by the data subject.

Regulators and courts require a strict level of compliance from controllers who wish to rely on the explicit consent of data subjects to use special categories of data.

45
Q

Employment Context

A

An exception to prohibiting processing of special categories of data

When necessary for the controller to comply with a legal obligation under employment, social security, and social protection law

Relevant when data subjects are candidates, employees, and contractors

46
Q

Vital interests of the individual in Article 6 vs. Article 9

A

Essentially identical to the provision in Article 6, but under Article 9, the controller must be able to demonstrate that it is not possible to obtain consent.

There are emergency examples where it will not be possible to obtain consent for the processing of special categories (e.g. if the data subject is unconscious). However, this qualification indicates that the controller is expected to attempt to seek consent.

47
Q

Political, philosophical and religious purposes

A

An exception to the prohibition on processing special categories of data

Covers particular foundations, associations, and not-for-profit bodies and any with a trade union aim.

Relates to processing of special categories of data about members of the organization, former members, or those who have regular contact with the organization for the organization’s purposes.

Appropriate safeguards must be in place to protect the personal data, and the data must not be disclosed outside the organization without the data subject’s consent.

48
Q

Sensitive data manifestly made public by the data subject

A

Exception to prohibition on processing sensitive categories of personal data

Criterion met when data subjects disclose sensitive data about themselves (e.g. when individuals provide details about their political opinions or health when giving media interviews)

Data collected from social networking sites that enable individuals to disclose information about themselves, including special categories of personal data, could also potentially fall within this criterion

49
Q

Establishment, exercise, or defense of legal claims

A

Exception to prohibition on processing of sensitive personal data

Using special categories of data may be necessary for a controller to establish, exercise, or defend legal claims. Requires the controller to establish necessity.

There must be a close and substantial connection between the processing and the purpose.

50
Q

Substantial public interest

A

Exception to the special categories processing prohibition

Narrower under the GDPR than it was under the Data Protection Directive

Requires the reason for processing special categories of data in the public interest to be balanced with the data subject’s right to data protection

Suitable and specific measures must be in place to safeguard data subjects’ fundamental rights and interests. Member states have the power to specify the reasons of public interest (including preventing and detecting crime)

51
Q

Medicine and social healthcare

A

Exception to the special categories processing prohibition

Allows for processing of special categories of info for medical or social care purposes, including assessing the working capacity of an employee, making a medical diagnosis, providing health or social care or treatment, and managing health or social systems or services.

The reason for processing must be based on EU or member state law or be necessary to fulfil a contract

52
Q

Public health

A

Exception to the special category processing prohibition

Based on EU or MS law, processing special categories of personal data without a data subject’s consent may be required for public health reasons.

Examples provided by the GDPR are “protecting against serious cross-border threats to health or ensuring high standards of quality and safety in health care and of medicinal products or medical devices”

53
Q

Public archives or scientific or historical research or statistical purposes

A

Exception to the special categories processing prohibition

Requires further interpretation from member state law. May include scientific or historical research and statistical purposes.

The processing of special categories of personal data must be proportionate to the purpose and respect data subjects’ rights to data protection. Again, suitable and specific measures must be in place to safeguard data subjects’ fundamental rights and interests.

CIPP/E (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions