CDPSE Consent Management 3

Question 1

What is 'consent fatigue' and what risk does it pose to effective privacy management?

Accepted Answer

Consent fatigue describes users routinely clicking 'accept all' without reading consent notices due to an overwhelming number of consent requests, undermining informed consent

Answer

Consent fatigue occurs when systems time out during the consent recording process, causing data loss

Answer

Consent fatigue is a technical condition where consent databases become too large to query efficiently

Answer

Consent fatigue is a regulatory term describing organizations that have too many consent forms to manage

Question 2

Which elements must a valid consent notice include to meet GDPR requirements?

Accepted Answer

The controller's identity, processing purposes, data types, right to withdraw, and any third-party sharing

Answer

Only the organization's name and the types of data collected

Answer

A legal citation to GDPR Article 6 and the organization's DPO contact

Answer

The retention period only, because purpose is implicitly understood from the service context

Question 3

When sharing personal data with third-party vendors, what consent-related obligation does the data controller bear?

Accepted Answer

The controller must ensure the original consent obtained from data subjects explicitly covered sharing with those third parties or obtain new consent

Answer

The controller's consent obligation ends once a data processing agreement is signed with the vendor

Answer

Vendor contracts automatically satisfy consent requirements under all major privacy laws

Answer

The controller must inform the data protection authority but is not required to notify data subjects

Question 4

What is the role of a Data Protection Officer (DPO) with respect to consent management programs?

Accepted Answer

The DPO advises on consent mechanisms, monitors compliance, and serves as a point of contact for data subjects exercising their rights

Answer

The DPO is responsible for obtaining and signing each individual consent form on behalf of the organization

Answer

The DPO delegates all consent decisions to the marketing team and only intervenes during audits

Answer

The DPO is solely responsible for designing the technical architecture of consent management platforms

Question 5

What is 'bundled consent' and why do data protection authorities consider it invalid under GDPR?

Accepted Answer

Bundled consent combines unrelated processing purposes into a single checkbox, making it impossible for users to consent selectively, thus violating the specificity and freely given requirements

Answer

Bundled consent is consent collected through a mobile app bundle rather than a web interface; it is invalid because it lacks cross-platform compatibility

Answer

Bundled consent is consent collected by a data processor on behalf of the controller; it is invalid because only controllers may collect consent

Answer

Bundled consent refers to consent collected in bulk from multiple users at once, which is invalid because consent must be individual

Question 6

Under GDPR Article 7(3), which statement best describes the right to withdraw consent?

Accepted Answer

The data subject may withdraw consent at any time, the withdrawal must be as easy as giving consent, and prior processing remains lawful

Answer

Withdrawal of consent voids all contracts formed with the data subject and triggers an automatic data deletion within 24 hours

Answer

Withdrawal of consent is only permitted once per calendar year to prevent abuse of the right

Answer

The data subject must provide a written justification before consent can be withdrawn

Question 7

How does the US CCPA's consent approach for opt-out of data sale differ from GDPR's opt-in consent model?

Accepted Answer

CCPA gives consumers the right to opt out of the sale of their data via a 'Do Not Sell My Personal Information' link, whereas GDPR requires affirmative opt-in consent before processing

Answer

CCPA requires businesses to obtain opt-in consent before selling personal information from any adult consumer

Answer

CCPA and GDPR both require opt-in consent, but CCPA applies only to California residents over age 16

Answer

CCPA applies a blanket ban on selling consumer data, eliminating the need for a consent mechanism entirely