GDPR Specialist Rights of Data Subjects 2 — Questions and Answers
Question 1: Under GDPR Article 17, which of the following is NOT a valid ground for the right to erasure ('right to be forgotten')?
- The personal data is no longer necessary for the purpose it was collected
- The data subject withdraws consent and no other legal basis exists
- The data subject simply prefers their data not be stored any longer without other grounds (Correct answer)
- The personal data has been unlawfully processed
Correct answer: The data subject simply prefers their data not be stored any longer without other grounds
The right to erasure requires specific grounds under Article 17; a mere preference without a qualifying ground is insufficient.
Question 2: A data subject requests restriction of processing under Article 18 GDPR. During the restriction period, the controller may still process the data in which circumstance?
- To conduct routine marketing analytics
- With the data subject's consent or to establish, exercise, or defend legal claims (Correct answer)
- To improve the accuracy of the data
- To comply with internal retention schedules
Correct answer: With the data subject's consent or to establish, exercise, or defend legal claims
Article 18(2) allows processing during restriction only with consent or for legal claims, protecting vital interests, or public interest grounds.
Question 3: Which GDPR article governs the right to data portability, and to whom does it apply?
- Article 20 — applies to all lawful processing activities
- Article 20 — applies only when processing is based on consent or a contract (Correct answer)
- Article 21 — applies when processing is based on legitimate interests
- Article 15 — applies when the data subject requests access
Correct answer: Article 20 — applies only when processing is based on consent or a contract
Article 20 GDPR grants portability rights only when processing relies on consent (Article 6(1)(a)) or a contract (Article 6(1)(b)).
Question 4: A data subject exercises their right to object under Article 21(1) GDPR to processing based on legitimate interests. What must the controller demonstrate to continue processing?
- That the processing is necessary for the performance of a public task
- Compelling legitimate grounds that override the data subject's interests, rights, and freedoms (Correct answer)
- That the data subject previously consented to the processing
- That an adequacy decision covers the third country involved
Correct answer: Compelling legitimate grounds that override the data subject's interests, rights, and freedoms
Under Article 21(1), the controller may override an objection only by demonstrating compelling legitimate grounds that prevail over those of the data subject.
Question 5: Under GDPR, how must a controller respond to a right-of-access request when a large volume of information is involved?
- The controller may refuse the request entirely due to disproportionate effort
- The controller may ask the data subject to specify which information or processing activities they are concerned with (Correct answer)
- The controller must provide all data within 72 hours
- The controller must delegate the response to the DPO regardless of circumstances
Correct answer: The controller may ask the data subject to specify which information or processing activities they are concerned with
Recital 63 GDPR allows controllers to request that data subjects narrow their request when a large amount of information is held about them.
Question 6: Which right under GDPR allows a data subject to have inaccurate personal data corrected without undue delay?
- Right to erasure (Article 17)
- Right to rectification (Article 16) (Correct answer)
- Right to restriction (Article 18)
- Right to data portability (Article 20)
Correct answer: Right to rectification (Article 16)
Article 16 GDPR provides the right to rectification of inaccurate or incomplete personal data.
Question 7: A data subject objects to the processing of their personal data for direct marketing purposes under Article 21(2) GDPR. What is the controller's obligation?
- Assess whether legitimate interests override the objection before ceasing
- Cease processing for direct marketing immediately and without exception (Correct answer)
- Provide the data subject with a reason for continuing before any decision
- Obtain supervisory authority approval before stopping the processing
Correct answer: Cease processing for direct marketing immediately and without exception
Article 21(3) GDPR states that where a data subject objects to direct marketing processing, the controller must stop processing for that purpose immediately — no balancing test applies.
GDPR Specialist Rights of Data Subjects 2
Under GDPR Article 17, which of the following is NOT a valid ground for the right to erasure ('right to be forgotten')?