According to the GDPR, what is the main task of a Data Protection Officer (DPO)?

• A.To create and maintain records of processing activities.
• B.To conduct Privacy Impact Assessments on behalf of the controller or processor.
• C.To monitor compliance with other local or European data protection provisions.
• D.To create procedures for notification of personal data breaches to competent supervisory authorities.

Comment: *

Name: *

Email: *

Verification: *

Assuming that the "without undue delay" provision is followed, what is the time limit for complying with a data access request?

• A.Within 40 days of receipt
• B.Within 40 days of receipt, which may be extended by up to 40 additional days
• C.Within one month of receipt, which may be extended by up to an additional month
• D.Within one month of receipt, which may be extended by an additional two months

Comment: *

Name: *

Email: *

Verification: *

Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?

• A.The group of undertakings must obtain approval from a supervisory authority.
• B.The group of undertakings must be comprised of organizations of similar sizes and functions.
• C.The data protection officer must be located in the country where the data controller has its main establishment.
• D.The data protection officer must be easily accessible from each establishment where the undertakings are located.

Comment: *

Name: *

Email: *

Verification: *

Which GDPR principle would a Spanish employer most likely depend upon to annually send the personal data of its employees to the national tax authority?

• A.The consent of the employees.
• B.The legal obligation of the employer.
• C.The legitimate interest of the public administration.
• D.The protection of the vital interest of the employees.

Comment: *

Name: *

Email: *

Verification: *

SCENARIO
Please use the following to answer the next question:
TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business.
During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations. TripBliss Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services.
Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered.
After Leon has informed his manager, what is Techiva's legal responsibility as a processor?

• A.They must report it to TripBliss Inc.
• B.They must inform customers who have used the website.
• C.They must report it to the supervisory authority.
• D.They must conduct a full systems audit.

Comment: *

Name: *

Email: *

Verification: *