Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

European Data Protection CIPP E > Processing Personal Data (4) > Flashcards

Processing Personal Data (4) Flashcards

1
Q

What does the ‘‘Integrity and Confidentiality’’ principle under GDPR imply?

A

personal data processed in a manner that ensures appropriate security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 7 principles for processing personal data under GDPR?

A
  1. Lawfulness, fairness and transparency
  2. Purpose limitation
  3. Data minimization
  4. Accuracy
  5. Storage limitation
  6. Integrity and confidentiality
  7. Accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What principle was violated in the Denmark DPA fine against Taxa related to their management of ride records?

A

Data Minimization

Taxi company maintained ride records, including phone numbers, after 2 year retention period

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are 3 criteria for territorial scope of the GDPR?

A
  1. activities of EU-established organizations (regardlesss of whether processing takes place in EU or not)
  2. organizations offer goods and services to or monitor the behavior of individuals in the EU
  3. in a place where member state law applies by virtue of international treaties (embassies)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the material scope of GDPR under Article 2?

A
  1. processing of personal data wholly or partly by automated means
  2. personal data which forms part of a filing system, even if not conducted by automated means
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which activities fall outside the material scope of GDPR?

A
  1. activities outside the scope of Union law
    (national laws around public security, defense, national security)
  2. official bodies carrying out crime prevention, investigation, detection or prosecution of criminal offenses
  3. purely personal or household activities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What was the decision in Bodil Lindquist vs Aklagarkammaran regarding material scope?

A

Lindquist maintained private home page of personal data of colleagues

CJEU ruled that private home page accessible to only those who have address is NOT qualified under the household activity exclusion and GDPR does apply

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the 6 lawful grounds for processing personal data?

A

(obligations)

  1. Consent
  2. Performance of a contract
  3. Compliance with a legal obligation

(interests)

  1. Protection of vital interests of data subject or another person
  2. Public interest or exercise
  3. Legitimate interests
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the 5 original conditions for consent under GDPR?

A
  1. demonstrable
  2. clearly distinguishable
  3. intelligible and easily acccessible form, using clear and plain language
  4. right to withdraw at any time
  5. not conditional for performance of contract
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the 2 possible conditions to apply performance of a contract as a lawful basis?

A
  1. processing is necessary to perform the contract and data subject is party to the contract

or

  1. if data subject requests processing to enter into contract
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What legal obligations apply for “Compliance with a legal obligation” as a lawful basis?

A

legal obligations required by EU and member state laws only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the conditions for ‘‘Protection of vital interests’’ as a lawful basis?

A

to ensure an individual’s survival or of another person

only in where processing cannot be manifestly based on another legal basis

some cases may serve both public interest and vital interest (epidemics,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Who defines what qualifies as ‘‘processing for public interest’’ as a lawful basis?

A

Union law or member state law

must be necessary for the task carried out in the public interest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the exception to processing for ‘‘legitimate interests’’ as a lawful basis?

A

if overridden by interests or fundamental rights and freedoms of the data subject

in particular where data subject is a child

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the 4 updated requirements for consent in Recital 32?

(demonstrable, distinguishable, right to withdraw, not conditional)

A
  1. Clear affirmative act
  2. Freely given, specific, informed and unambiguous
  3. Consent given for each purpose
  4. For electronic means: clear, concise and not disruptive to use of the service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the conditions to process children’s data for information society services?

Article 8

A

consent must be given by parent or guardian if under 16
must make reasonable efforts to verify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the 10 justifications for processing special category data?

A
  1. Explicit consent
  2. Employment, social security or social protection law authorized by Union or Member State law, with safeguards
  3. Vital interests, incapable of giving consent
  4. Political, philosophical, religious purposes fpr legitimate activities
  5. Made public by the data subject
  6. Legal claims
  7. Substantial public interest
  8. Healthcare
  9. Public health
  10. Archives or research
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How do you determine if GPDR applies - by the organization or by the processing activity?

A

Processing Activitiy

Some activities may fall under GDPR and others may not

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the definition of “establishment” in the EU?

A

effective and real exercise of activity through stable arrangements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What did case Weltimmo v NAIH establish with regard to establishment?

A

Weltimmo, although incorporated in Slovakia, targeted Hungarian market, advertised Hungarian properties and written in Hungarian.

Weltimmo had representative in Hungary, used letter box in Hungary and had Hungarian bank account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Is GDPR restricted to individuals within the EU?

A

No, GDPR applies to:

  • activities of an establishment in the EU, regardless of where processing takes place
  • processing of personal data of data subjects who are in the Union
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are relevant factors in determining if goods or services are being offered to data subjects in the EU?

A

naming EU states in reference to goods/services

use of an EU language

marketing/advertising directed at EU audiences

paying search engine to facilitate access by individuals in EU

dedicated addresses or phone numbers for individuals in EU

top-level EU domain (.de or .eu)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is “monitoring” according to Recital 24?

A

tracking individuals online to create profiles, including where used to make decisions concerning them or for analyzing or predicting their preferences, behaviors and attitudes

24
Q

What are examples of monitoring?

A

behavioral advertising
online tracking (cookies)
personalized health analytics
CCTV
market surveys

25
Q

Can a competent authority be subject to both GDPR and LED?

A

Yes, if data is processed for purposes other than the purposes of the LED

26
Q

Are EU institutions covered by the GDPR?

A

No, however regulation 2018/1725 will apply to cover this gap

27
Q

What principle was added by GDPR to the original principles of the Directive?

A

Accountability

28
Q

What does the lawfulness principle mean?

A

Personal data must only be processed when data controllers have a legal ground for processing the data

29
Q

What are two things to assess to determine whether processing is “fair”?

A
  1. data subjects are aware of the fact that their data will be processed to make an informed choice
  2. how the processing will affect the data subject and if, in the case of negative impact, it is justified
30
Q

What did GDPR remove from the Directive regarding transparency?

A

the general obligation to notify DPAs of processing of personal data

(instead promotes procedures and mechanisms and notifying data subject)

31
Q

In what case does GPDR exempt data controllers from duty to inform?

A

when data is obtained directly from the data subject and they are already aware of the information

32
Q

In what cases do data controllers not have to provide notice to data subjects when data is collected from other sources?

A
  1. when providing information represents disproportionate effort
  2. to protect data subject’s legitimate interest
  3. preserve confidentiality of the information
33
Q

When must notice be given to the data subject if he or she provides the data directly?

A

at the time of collection

34
Q

When is secondary processing lawfully permitted?

A

when considered compatible with the original purpose for which the data was gathered

35
Q

What should controllers consider when evaluating compatibility of a secondary purpose with the original purpose?

A
  1. link between original and further processing
  2. context personal data was collected in (reasonable expectations of data subject)
  3. nature of the personal data
  4. consequences of further processing
  5. existence of proper safeguards
36
Q

What two concepts should be considered when assessing data minimization?

A

necessity
proportionality

37
Q

How should a controller comply with the accuracy principle?

A

implement reasonable measures to ensure data are collected from reliable sources

keep data up-to-date and respond to data subject requests to correct

38
Q

What did GDPR remove from the Directive regarding transparency?

A

GPDR eliminates the Directive’s general obligation to notify DPAs of processing of personal data

(instead promotes procedures and mechanisms and notifying data subject)

39
Q

Which article outlines lawful bases for processing personal data?

A

Article 6

40
Q

What does it mean for consent to be “freely given’’?

A

data subject must have a genuine choice and be able to refuse and withdraw consent

41
Q

What does Recital 43 state regarding consent?

when can it not be relied upon

A

cannot be relied upon if there is a clear imbalance of power between data subject and controller (in particular when controller is a public authority)

42
Q

What is the EDPB guidance to make consent “specific”?

A
  1. purpose specification
  2. granularity in consent requests
  3. clear separation of information related to data processing consent (from other matters)
43
Q

What is the minimum that must be provided for valid consent?

A
  1. controller identity
  2. purpose of processing operations
  3. type of data to be collected/used
  4. right to withdraw consent
  5. use of data for automated decision-making

6 possible risks of data transfers

44
Q

What has to happen for consent to be valid for multiple controllers?

A

all controllers must be specifically named

45
Q

What 3 factors are involved in satisfying the “legitimate interest’’ condition?

A
  1. processing must be necessary for the purpose
  2. purpose must be a legitimate interest of controller or a third party
  3. the legitimate interest cannot be overridden by data subject’s interests or rights and freedoms
46
Q

What is the ICO’s 3-part test for controller’s in establishing legitimate interest?

A
  1. identify the legitimate interest
  2. show that processing is necessary to achieve it
  3. balance legitimate interest against individual’s interests, rights and freedoms
47
Q

What shifted between the Directive and GDPR with regard to legal basis and notification?

A

Under GDPR a controller is required to provide a privacy notice that specifies the legal basis for processing

(under directive, controller did not have to document criterion)

48
Q

What influenced the definition of special category data?

A

Anti-discrimination laws

49
Q

What is different about consent for processing special category data (under Article 9) from consent defined under Article 6?

A

it must be explicit

(in addition to unambiguous, freely given, specific and informed)

50
Q

What are some of the ways explicit consent can be provided in a digital environment per EDPB?

A

filling in electronic form
sending an email
using electronic signature
2-stage verification

51
Q

What is different between vital interest under article 6 (legal basis) versus article 9 (special category)?

A

Article 9: controller must be able to demonstrate it is not possible to obtain consent (data subject legally or physically incapable)

52
Q

What are the requirements for processing special category data related to political, philosophical, religious, trade organizations?

A
  1. processing only in the course of legitimate activities
  2. with appropriate safeguards
  3. in connection with specific purpose
53
Q

Can a political, philosophical, religious, trade organization disclose sensitive data outside of the organization?

A

only with explicit consent from data subject

54
Q

What are the 2 requirements for establishing substantial public interest as a basis for processing special category data?

A

laws that:

  1. are proportionate to the aim pursued
  2. show respect for the essence of the right to data protection
55
Q

What is processing of personal data?

A

Any operation, or set of operations, which is performed on personal data or on sets of personal data whether or not by automated means

such as collection, recording, organizing, structuring, storing, adapting, altering, retreiving, consulting, using, disclosing, disseminating or otherwise making available, aligning, combining, restricting, erasing and destroying

56
Q

What does restriction of processing mean?

A

marking of stored personal data with the aim of limiting their processing in the future

57
Q

What does “cross-border processing” refer to?

A
  1. takes place in the context of activities of establishments in more than one member state
  2. takes place in the context of activities of a single establishment in EU but likely to affect data subjects in more than one member state

European Data Protection CIPP E (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions