GDPR Automation & Scripting 2 — Questions and Answers
Question 1: Under GDPR, when an automated profiling system denies a loan application, what right does the data subject have?
- The right to erasure of all financial data
- The right to obtain human intervention and contest the decision (Correct answer)
- The right to demand the algorithm be open-sourced
- The right to receive compensation automatically
Correct answer: The right to obtain human intervention and contest the decision
Article 22 grants data subjects the right to obtain human intervention, express their point of view, and contest automated decisions.
Question 2: A script automatically collects cookies beyond strictly necessary ones without user consent. Which GDPR principle is most directly violated?
- Storage limitation
- Data minimisation
- Lawfulness, fairness and transparency (Correct answer)
- Integrity and confidentiality
Correct answer: Lawfulness, fairness and transparency
Processing personal data via cookies without a valid legal basis violates the lawfulness principle under Article 5(1)(a).
Question 3: Which technical measure should be built into automated data pipelines to comply with GDPR's storage limitation principle?
- Automated data deletion schedules based on defined retention periods (Correct answer)
- Encrypting all data at rest indefinitely
- Storing data in a separate jurisdiction
- Anonymising data only when a data subject requests it
Correct answer: Automated data deletion schedules based on defined retention periods
Article 5(1)(e) requires data not be kept longer than necessary, making automated retention and deletion scheduling a key compliance control.
Question 4: A company uses a script to scrape publicly available personal data from social media for marketing. Under GDPR, which statement is correct?
- Publicly available data is exempt from GDPR entirely
- A legitimate interest assessment is always sufficient to justify scraping
- The scraping still requires a valid legal basis and data subjects must be informed (Correct answer)
- Scraped data may be retained indefinitely since it was publicly accessible
Correct answer: The scraping still requires a valid legal basis and data subjects must be informed
GDPR applies to all personal data processing regardless of source; a lawful basis and transparency obligations still apply to scraped public data.
Question 5: When automating the exercise of data subject access requests (DSARs), which GDPR deadline must the system be designed to meet?
- 7 calendar days
- 14 business days
- One month (extendable to three for complex requests) (Correct answer)
- Six weeks
Correct answer: One month (extendable to three for complex requests)
Article 12(3) requires controllers to respond to DSARs within one month, with a possible extension of two further months for complex or numerous requests.
Question 6: A GDPR-compliant automated consent management platform must be capable of which function?
- Preventing users from withdrawing consent once given
- Recording timestamped consent and enabling granular withdrawal at any time (Correct answer)
- Requiring users to consent to all processing in a single click
- Storing consent records for a minimum of 6 months only
Correct answer: Recording timestamped consent and enabling granular withdrawal at any time
Article 7(3) requires that withdrawal of consent be as easy as giving it, and Article 5(2) accountability requires detailed consent records.
Question 7: Under GDPR, an automated system that transfers personal data to a third country without adequate safeguards violates which article?
- Article 13
- Article 28
- Article 44 (Correct answer)
- Article 83
Correct answer: Article 44
Article 44 establishes the general principle that transfers to third countries are only permitted when appropriate safeguards or an adequacy decision exists.
GDPR Automation & Scripting 2
Under GDPR, when an automated profiling system denies a loan application, what right does the data subject have?