CIPM Data Subject Rights Flashcards

Which GDPR right allows individuals to unconditionally object to processing of their data for direct marketing purposes?

Answer: Right to object

GDPR Article 21 grants data subjects the absolute right to object to processing for direct marketing, and the controller must cease such processing upon objection.

In the US, which federal law grants individuals rights to access and correct records about themselves held by federal agencies?

Answer: The Privacy Act of 1974

The Privacy Act of 1974 grants US citizens and lawful permanent residents rights to access and request correction of records held about them by federal agencies.

What should an organization do when it cannot fulfill a data subject rights request within the required initial timeframe?

Answer: Notify the data subject of the delay and provide an extended completion date

When extensions are needed, organizations must inform the data subject within the initial response period, explaining the reason for the delay and the new expected completion date.

Which principle ensures data subjects receive equal service regardless of whether they exercise their privacy rights?

Answer: Non-discrimination

The non-discrimination principle, reflected in laws like CCPA, ensures consumers are not penalized or receive inferior service for exercising their privacy rights.

What is the key operational difference between the right to erasure and the right to restriction under GDPR?

Answer: Erasure removes data permanently; restriction limits how data is processed without deleting it

Erasure permanently deletes personal data, while restriction suspends or limits its processing without removing it, allowing the data to be retained for specific purposes.

Under GDPR, what is the maximum total response time for complex or multiple data subject access requests?

Answer: 3 months

For complex or numerous requests, GDPR allows an additional two-month extension beyond the standard one-month period, for a maximum total of three months.