GDPR GDPR Lawful Bases for Processing 3

Question 1

Under GDPR, which lawful basis is often described as the 'gold standard' but is frequently misapplied by organizations?

Accepted Answer

Consent

Answer

Consent is described as the gold standard for data protection but is frequently overused; many situations are better served by another lawful basis such as contract or legitimate interests.

Question 2

Under GDPR, data subjects have the right to object to processing based on which lawful bases?

Accepted Answer

Legitimate interests and public task

Answer

Article 21 grants data subjects the right to object to processing carried out under legitimate interests (Article 6(1)(f)) or public task (Article 6(1)(e)).

Question 3

Which of the following statements about consent as a lawful basis is correct under GDPR?

Accepted Answer

Withdrawal of consent must be as easy as giving it

Answer

Article 7(3) explicitly states that the data subject shall have the right to withdraw consent at any time, and withdrawal must be as easy as giving consent.

Question 4

Under GDPR, what additional rule applies when processing personal data of children using consent as the lawful basis for information society services?

Accepted Answer

Parental or guardian consent is required for children below the applicable age threshold (16 by default, minimum 13)

Answer

Article 8 sets the default age at 16, below which parental consent is required, though Member States may lower this to a minimum of 13.

Question 5

The balancing test within a Legitimate Interests Assessment (LIA) requires the controller to weigh:

Accepted Answer

The controller's legitimate interest against the data subject's rights, interests, and freedoms

Answer

The balancing test asks whether the legitimate interests of the controller are overridden by the interests or fundamental rights and freedoms of the data subject.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR GDPR Lawful Bases for Processing 3