GDPR Troubleshooting & Problem Resolution 3

Question 1

A supervisory authority issues an enforcement notice requiring a controller to stop a specific processing activity within 14 days. The controller believes the notice is incorrect. What is the appropriate response?

Accepted Answer

Comply with the notice while exercising the right to appeal via Article 78

Answer

Article 78 grants controllers the right to an effective judicial remedy against a supervisory authority decision, but compliance with an enforcement notice is generally required while appealing.

Question 2

A user complains that the privacy notice they received at data collection did not mention data sharing with a subsidiary. What Article 13 element was omitted?

Accepted Answer

The recipients or categories of recipients of the personal data

Answer

Article 13(1)(e) requires controllers to inform data subjects of recipients or categories of recipients at the time data is collected.

Question 3

An organization running automated credit-scoring decisions receives a complaint that an applicant was not informed of the logic involved. Which Article was breached?

Accepted Answer

Article 22(3) — failure to provide meaningful information about the logic of automated decisions

Answer

Article 22(3) requires controllers to provide meaningful information about the logic, significance, and envisaged consequences of solely automated decisions.

Question 4

During a post-incident review, it is discovered that the breach notification to the supervisory authority was sent within 72 hours but lacked details on the approximate number of affected individuals. What is the correct remediation?

Accepted Answer

Submit supplementary information to the SA as soon as it becomes available

Answer

Article 33(4) expressly allows phased notifications; where not all information is available, controllers may provide it in phases without undue delay.

Question 5

A controller in the US transfers EU personal data to a cloud provider in India without any transfer mechanism in place. What is the most immediate compliance problem?

Accepted Answer

An unlawful third-country transfer in violation of Chapter V GDPR

Answer

Chapter V of the GDPR prohibits transfers to third countries lacking adequacy decisions unless appropriate safeguards such as SCCs are in place.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Troubleshooting & Problem Resolution 3