CSC GDPR Data Protection Principles 3 — Questions and Answers
Question 1: GDPR's lawfulness principle lists six lawful bases for processing. Which of the following is NOT one of them?
- Performance of a contract
- Legitimate interests
- Competitive business advantage (Correct answer)
- Vital interests
Correct answer: Competitive business advantage
Competitive business advantage is not a lawful basis; the six bases are consent, contract, legal obligation, vital interests, public task, and legitimate interests.
Question 2: When processing is based on 'legitimate interests,' controllers must perform a balancing test. What is the primary factor assessed?
- Whether the controller generates revenue from the processing
- Whether the data subject's interests or fundamental rights override the controller's interests (Correct answer)
- Whether the data was collected via a written form
- Whether a DPO was consulted
Correct answer: Whether the data subject's interests or fundamental rights override the controller's interests
The legitimate interests balancing test weighs the controller's interest against whether data subjects' rights and freedoms override it, especially for vulnerable individuals.
Question 3: Under GDPR, consent must meet several conditions to be valid. Which condition below is required?
- Consent must be bundled with other terms of service
- Consent must be freely given, specific, informed, and unambiguous (Correct answer)
- Consent obtained by default opt-out checkboxes is acceptable
- Consent can be implied from continued use of a service
Correct answer: Consent must be freely given, specific, informed, and unambiguous
Valid GDPR consent must be freely given, specific, informed, and indicated by a clear affirmative act; pre-ticked boxes and implied consent are invalid.
Question 4: A controller relies on legal obligation as the lawful basis for processing employee tax data. What does this mean for the employee's right to erasure?
- The right to erasure fully applies regardless of the legal basis
- The right to erasure does not apply where processing is necessary to comply with a legal obligation (Correct answer)
- The employee can demand erasure after 12 months
- Legal obligation as a basis eliminates all data subject rights
Correct answer: The right to erasure does not apply where processing is necessary to comply with a legal obligation
The right to erasure does not apply when processing is necessary for compliance with a legal obligation, such as mandatory tax record-keeping.
Question 5: Which GDPR principle is sometimes called the 'overarching' principle because it requires controllers to take responsibility for and demonstrate compliance with all other principles?
- Purpose limitation
- Data minimisation
- Accuracy
- Accountability (Correct answer)
Correct answer: Accountability
Accountability is the overarching principle that obliges controllers to implement appropriate measures and be able to demonstrate compliance with all other GDPR principles.
Question 6: A company retains personal data 'just in case it is needed for future lawsuits.' Under GDPR storage limitation, this practice is:
- Fully compliant as legal defense is a legitimate interest
- Permissible only if data is pseudonymised
- Non-compliant unless there is a specific, documented legal hold justification (Correct answer)
- Automatically exempt from storage limitation rules
Correct answer: Non-compliant unless there is a specific, documented legal hold justification
Storage limitation requires a specific, documented purpose for retention; vague future litigation risk without a concrete legal hold does not satisfy this requirement.
Question 7: Under the fairness component of the lawfulness, fairness, and transparency principle, which situation would most likely be considered unfair?
- Notifying users of a privacy policy change via email
- Using customer purchase data to deny them insurance without disclosure (Correct answer)
- Sending users a copy of their own data upon request
- Publishing a detailed privacy notice on a company website
Correct answer: Using customer purchase data to deny them insurance without disclosure
Using personal data in ways that are detrimental to individuals without their knowledge violates the fairness component of GDPR's first principle.
CSC GDPR Data Protection Principles 3
GDPR's lawfulness principle lists six lawful bases for processing.
Which of the following is NOT one of them?