MEC Regulatory Compliance & Legal Framework 3 — Questions and Answers
Question 1: A UK university uses Moodle and must comply with GDPR. Which legal basis is most commonly relied upon for processing student personal data for course administration?
- Legitimate interests
- Consent
- Contractual necessity (Correct answer)
- Vital interests
Correct answer: Contractual necessity
Processing student data for course administration is typically justified under contractual necessity because enrollment creates a contract between student and institution.
Question 2: Under GDPR, what is the maximum timeframe within which a data controller must notify the supervisory authority of a personal data breach that poses a risk to individuals?
- 48 hours
- 72 hours (Correct answer)
- 7 days
- 30 days
Correct answer: 72 hours
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible.
Question 3: A Moodle administrator receives a GDPR 'right to erasure' request from a former student. Which scenario would most likely justify refusing the request?
- The student's grades are stored in a backup file
- The institution needs the records to comply with a legal obligation to retain data (Correct answer)
- The student has graduated and is no longer enrolled
- The deletion would require technical effort
Correct answer: The institution needs the records to comply with a legal obligation to retain data
Article 17(3)(b) GDPR allows controllers to refuse erasure when processing is necessary for compliance with a legal obligation requiring retention.
Question 4: Which Creative Commons license allows others to distribute, remix, and adapt content for any purpose, including commercially, as long as they credit the original creator?
- CC BY-NC
- CC BY (Correct answer)
- CC BY-SA
- CC BY-ND
Correct answer: CC BY
CC BY (Attribution) is the most permissive Creative Commons license, allowing any use including commercial, provided appropriate credit is given.
Question 5: In US higher education, Title IX primarily protects students from discrimination based on which characteristic within federally funded programs?
- Race
- Disability
- Sex (Correct answer)
- Religion
Correct answer: Sex
Title IX of the Education Amendments of 1972 prohibits discrimination on the basis of sex in any federally funded education program or activity.
Question 6: An institution stores Moodle course completion certificates indefinitely. Which data minimization principle under GDPR is most likely violated?
- Accuracy
- Storage limitation (Correct answer)
- Purpose limitation
- Data integrity
Correct answer: Storage limitation
GDPR's storage limitation principle requires that personal data not be kept longer than necessary for the purpose for which it was collected.
Question 7: Which US federal law requires institutions receiving federal funding to implement specific policies addressing campus sexual violence and to publish an annual security report?
- Title IX
- Clery Act (Correct answer)
- ADA
- FERPA
Correct answer: Clery Act
The Clery Act requires federally funded institutions to disclose campus crime statistics and maintain specific policies on sexual violence in an Annual Security Report.
MEC Regulatory Compliance & Legal Framework 3
A UK university uses Moodle and must comply with GDPR.
Which legal basis is most commonly relied upon for processing student personal data for course administration?