CDPSE Subject Rights 3 — Questions and Answers
Question 1: A data subject objects to their personal data being used for direct marketing. Under GDPR, what must the controller do?
- Evaluate the objection and decide within 30 days
- Cease processing for direct marketing immediately and without exception (Correct answer)
- Continue processing if a legitimate interest overrides the objection
- Require the data subject to submit the objection in writing
Correct answer: Cease processing for direct marketing immediately and without exception
GDPR Article 21(3) states that when a data subject objects to direct marketing, the controller must stop processing for that purpose immediately with no balancing test.
Question 2: Under GDPR, what must accompany a decision made solely by automated processing that significantly affects a data subject?
- A fee waiver for the data subject
- The right to obtain human review, express their point of view, and contest the decision (Correct answer)
- A mandatory waiting period of 30 days
- Notification to the supervisory authority
Correct answer: The right to obtain human review, express their point of view, and contest the decision
GDPR Article 22 requires that data subjects have the right to human intervention, to express their view, and to contest automated decisions that significantly affect them.
Question 3: Which of the following is NOT a lawful basis for refusing a data subject access request under GDPR?
- The request is manifestly unfounded
- The request is repetitive
- The data was collected from a third party (Correct answer)
- Providing the data would adversely affect the rights of others
Correct answer: The data was collected from a third party
The origin of data from a third party is not a valid ground for refusing an access request; organizations must provide data regardless of its source.
Question 4: A data subject requests rectification of inaccurate data. What obligation does the controller have regarding third parties who received the incorrect data?
- No obligation to notify third parties
- Notify third parties only if technically feasible
- Inform each recipient of the rectification unless it is impossible or involves disproportionate effort (Correct answer)
- Notify the supervisory authority about the error
Correct answer: Inform each recipient of the rectification unless it is impossible or involves disproportionate effort
GDPR Article 19 requires controllers to notify all recipients of the corrected data unless doing so is impossible or involves disproportionate effort.
Question 5: Under the Virginia Consumer Data Protection Act (VCDPA), which right allows consumers to correct inaccuracies in their personal data?
- Right to access
- Right to deletion
- Right to correct (Correct answer)
- Right to portability
Correct answer: Right to correct
The VCDPA grants consumers a right to correct inaccuracies in the personal data held by a controller.
Question 6: What is the maximum fee a GDPR controller can charge for handling a data subject access request?
- A flat fee of €10
- A reasonable fee based on administrative costs
- No fee may be charged for the first request (Correct answer)
- €50 per request
Correct answer: No fee may be charged for the first request
Under GDPR, the first copy of data requested must be provided free of charge; fees may only be charged for additional copies or manifestly unfounded/excessive requests.
Question 7: Which of the following scenarios qualifies as profiling under GDPR?
- Manually reviewing a customer file
- Using algorithms to analyze personal data to predict behavior or preferences (Correct answer)
- Storing anonymized aggregate statistics
- Encrypting personal data at rest
Correct answer: Using algorithms to analyze personal data to predict behavior or preferences
GDPR defines profiling as any automated processing of personal data to evaluate, analyze, or predict aspects of a natural person's behavior or characteristics.
CDPSE Subject Rights 3
A data subject objects to their personal data being used for direct marketing.
Under GDPR, what must the controller do?