CIPM CIPM Data Subject Rights 2 — Questions and Answers
Question 1: Under GDPR Article 17, which of the following would allow a data controller to REFUSE an erasure request?
- The data subject no longer uses the service
- The data is needed for exercising the right of legal defense (Correct answer)
- The data subject's contract has expired
- The data was collected more than two years ago
Correct answer: The data is needed for exercising the right of legal defense
Under GDPR Article 17, data controllers may refuse erasure requests when the data is necessary for establishing, exercising, or defending legal claims.
Question 2: What is the primary purpose of a Data Subject Access Request (DSAR)?
- To allow individuals to correct their data
- To allow individuals to obtain a copy of their personal data (Correct answer)
- To allow individuals to delete their data
- To allow individuals to opt out of marketing
Correct answer: To allow individuals to obtain a copy of their personal data
A DSAR enables individuals to obtain a copy of their personal data held by an organization and learn how it is being processed.
Question 3: Under GDPR, when may organizations charge a fee for responding to a data subject access request?
- Always, to cover administrative costs
- Never under any circumstances
- Only for requests that are manifestly unfounded or excessive (Correct answer)
- Only for requests involving more than 100 records
Correct answer: Only for requests that are manifestly unfounded or excessive
GDPR allows organizations to charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive, particularly repetitive ones.
Question 4: Which GDPR right enables data subjects to challenge decisions made solely by automated processing that significantly affects them?
- Right to portability
- Right to erasure
- Right not to be subject to automated decision-making (Correct answer)
- Right to restriction
Correct answer: Right not to be subject to automated decision-making
GDPR Article 22 provides data subjects the right to not be subject to solely automated decisions that significantly affect them, including profiling.
Question 5: Which of the following must be provided when responding to a data subject access request?
- The organization's revenue and data storage costs
- The purposes of processing and categories of recipients (Correct answer)
- The names of all employees who accessed the data
- The technical architecture of the data storage system
Correct answer: The purposes of processing and categories of recipients
DSARs must be fulfilled with information including the purposes of processing, categories of data held, and recipients or categories of recipients.
Question 6: Under CCPA, what does the 'right to know' allow consumers to request from a business?
- The organization's cybersecurity audit results
- Categories and specific pieces of personal information collected about them (Correct answer)
- The names of all third-party advertisers using their data
- Access to their financial transaction records
Correct answer: Categories and specific pieces of personal information collected about them
The CCPA right to know allows consumers to request disclosure of the categories and specific pieces of personal information a business has collected about them.
CIPM CIPM Data Subject Rights 2
Under GDPR Article 17, which of the following would allow a data controller to REFUSE an erasure request?