Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC). Why is the Directive no longer part of EU law?

• A.The Directive was superseded by the EU Directive on Privacy and Electronic Communications.
• B.The Directive was superseded by the General Data Protection Regulation.
• C.The Directive was annulled by the Court of Justice of the European Union.
• D.The Directive was annulled by the European Court of Human Rights.

Comment: *

Name: *

Email: *

Verification: *

What is true if an employee makes an access request to his employer for any personal data held about him?

• A.The employer must supply any information held about an employee unless an exemption applies.
• B.The employer can decline the request if the information is only held electronically.
• C.The employer must supply all the information held about the employee.
• D.The employer can automatically decline the request if it contains personal data about a third person.

Comment: *

Name: *

Email: *

Verification: *

What term BEST describes the European model for data protection?

• A.Sectoral
• B.Self-regulatory
• C.Market-based
• D.Comprehensive

Comment: *

Name: *

Email: *

Verification: *

SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
What is the time period in which Mike should receive a response to his request?

• A.When all the information about Mike has been collected.
• B.Not more than thirty days after submission of Mike's request.
• C.Not more than one month of receipt of Mike's request.
• D.Not more than two months after verifying Mike's identity.

Comment: *

Name: *

Email: *

Verification: *

SCENARIO
Please use the following to answer the next question:
Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA analysis. The company is headquartered in Montreal, and all of its employees are located there. The company offers its services to Canadians only: Its website is in English and French, it accepts only Canadian currency, and it blocks internet traffic from outside of Canada (although this solution doesn't prevent all non-Canadian traffic). It also declines to process orders that request the DNA report to be sent outside of Canada, and returns orders that show a non-Canadian return address.
Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU, and the company is exploring a number of plans to expand its customer base.
The first plan, collegially called We-Track-U, will use an app to collect information about its current Canadian customer base. The expansion will allow its Canadian customers to use the app while traveling abroad. He suggests that the company use this app to gather location information. If the plan shows promise, Bob proposes to use push notifications and text messages to encourage existing customers to pre-register for an EU version of the service. Bob calls this work plan, We-Text-U. Once the company has gathered enough pre- registrations, it will develop EU-specific content and services.
Another plan is called Customer for Life. The idea is to offer additional services through the company's app, like storage and sharing of DNA information with other applications and medical providers. The company's contract says that it can keep customer DNA indefinitely, and use it to offer new services and market them to customers. It also says that customers agree not to withdraw direct marketing consent. Paul, the marketing director, suggests that the company should fully exploit these provisions, and that it can work around customers' attempts to withdraw consent because the contract invalidates them.
The final plan is to develop a brand presence in the EU. The company has already begun this process. It is in the process of purchasing the naming rights for a building in Germany, which would come with a few offices that Who-R-U executives can use while traveling internationally. The office doesn't include any technology or infrastructure; rather, it's simply a room with a desk and some chairs.
On a recent trip concerning the naming-rights deal, Bob's laptop is stolen. The laptop held unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of Canad a. The reports include customer name, birthdate, ethnicity, racial background, names of relatives, gender, and occasionally health information.
The Customer for Life plan may conflict with which GDPR provision?

• A.Article 6, which requires processing to be lawful.
• B.Article 16, which provides data subjects with a rights to rectification.
• C.Article 20, which gives data subjects a right to data portability.
• D.Article 7, which requires consent to be as easy to withdraw as it is to give.

Comment: *

Name: *

Email: *

Verification: *