GDPR Specialist Compliance and Enforcement 3 — Questions and Answers
Question 1: A national supervisory authority disagrees with the draft decision of the lead supervisory authority. What GDPR mechanism resolves the dispute?
- The European Commission issues a binding ruling
- The EDPB's consistency mechanism and dispute resolution under Article 65 (Correct answer)
- Each authority enforces its own decision independently
- The Court of Justice of the EU arbitrates
Correct answer: The EDPB's consistency mechanism and dispute resolution under Article 65
Article 65 empowers the EDPB to issue binding decisions when supervisory authorities cannot reach consensus through the one-stop-shop cooperation mechanism.
Question 2: Under GDPR, which factor is NOT listed in Article 83(2) as relevant when determining the level of an administrative fine?
- Nature, gravity, and duration of the infringement
- The nationality of the data subjects affected (Correct answer)
- Degree of cooperation with the supervisory authority
- Categories of personal data affected
Correct answer: The nationality of the data subjects affected
Article 83(2) lists multiple factors including nature, gravity, cooperation, and data categories, but the nationality of data subjects is not among them.
Question 3: An organization conducts a DPIA and concludes that high residual risk remains after mitigation. What is the required next step?
- Proceed with processing but document the residual risk
- Consult the supervisory authority prior to processing (Correct answer)
- Appoint a DPO immediately
- Obtain explicit consent from all data subjects
Correct answer: Consult the supervisory authority prior to processing
Article 36 requires prior consultation with the supervisory authority when a DPIA indicates that high residual risk cannot be mitigated by the controller.
Question 4: A processor subcontracts data processing to a third party without the controller's prior written authorization. Which GDPR provision has the processor violated?
- Article 28(2) — restrictions on sub-processing (Correct answer)
- Article 32 — security of processing
- Article 30 — records of processing activities
- Article 37 — designation of DPO
Correct answer: Article 28(2) — restrictions on sub-processing
Article 28(2) prohibits a processor from engaging another processor without prior specific or general written authorization from the controller.
Question 5: Which of the following best describes the 'one-stop-shop' mechanism under GDPR?
- Data subjects can lodge complaints with any EU supervisory authority
- A controller with cross-border processing has a single lead supervisory authority (Correct answer)
- All GDPR enforcement is centralized through the EDPB
- Controllers need only register with one national authority
Correct answer: A controller with cross-border processing has a single lead supervisory authority
The one-stop-shop mechanism means that a controller operating in multiple EU Member States deals primarily with the supervisory authority of its main establishment.
Question 6: A supervisory authority wants to conduct an on-site investigation of a controller's premises. Under Article 58(1), what power enables this?
- The power to impose administrative fines
- The power to obtain access to any premises of the controller (Correct answer)
- The power to issue public warnings
- The power to order erasure of data
Correct answer: The power to obtain access to any premises of the controller
Article 58(1)(f) grants supervisory authorities investigative powers including access to the controller's or processor's premises, equipment, and means of data processing.
Question 7: Under GDPR, a data subject files a complaint with a supervisory authority. If no action is taken within three months, what can the data subject do?
- Escalate directly to the EDPB
- Seek a judicial remedy against the supervisory authority under Article 78 (Correct answer)
- File a complaint with the European Ombudsman
- Request the controller to self-report
Correct answer: Seek a judicial remedy against the supervisory authority under Article 78
Article 78(2) grants data subjects the right to an effective judicial remedy if the supervisory authority does not handle a complaint or fails to inform them within three months.
GDPR Specialist Compliance and Enforcement 3
A national supervisory authority disagrees with the draft decision of the lead supervisory authority.
What GDPR mechanism resolves the dispute?