GDPR Specialist Principles and Concepts 4

Question 1

A US-based company markets goods to EU residents and monitors their behavior online. Is the company subject to GDPR?

Accepted Answer

Yes, under Article 3(2) extra-territorial scope provisions

Answer

Article 3(2) extends GDPR to non-EU establishments that offer goods/services to EU data subjects or monitor their behavior within the EU.

Question 2

Under GDPR, what is 'data portability' and when does it apply?

Accepted Answer

The right to receive personal data in a structured, machine-readable format when processing is based on consent or contract

Answer

Article 20 grants data subjects the right to receive their personal data in a structured, commonly used, machine-readable format, applicable when processing is based on consent or contract and carried out by automated means.

Question 3

Which GDPR concept requires controllers to implement appropriate technical and organisational measures from the design stage of a system, not as an afterthought?

Accepted Answer

Privacy by Design

Answer

Privacy by Design (Article 25(1)) mandates embedding data protection measures into the design of processing systems from the outset.

Question 4

What is the maximum administrative fine for the most serious GDPR infringements (Tier 2)?

Accepted Answer

€20 million or 4% of global annual turnover

Answer

Article 83(5) sets the upper limit for the most serious violations at €20 million or 4% of total worldwide annual turnover, whichever is higher.

Question 5

A controller processes employee health data for occupational medicine purposes. Which Article 9 condition most likely applies?

Accepted Answer

Processing necessary for preventive or occupational medicine under professional secrecy

Answer

Article 9(2)(h) permits processing of health data for occupational medicine or the assessment of working capacity, subject to professional secrecy obligations.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Specialist Principles and Concepts 4