WP29’s “Guidelines on Personal data breach notification under Regulation 2016/679’’ provides examples of ways to communicate data breaches transparently. Which of the following was listed as a method that would NOT be effective for communicating a breach to data subjects?

1. A. A postal notification
2. B. A direct electronic message
3. C. A notice on a corporate blog
4. D. A prominent advertisement in print media

Correct Answer: C

Which of the following is an example of direct marketing that would be subject to European data protection laws?

1. A. An updated privacy notice sent to an individual’s personal email address.
2. B. A charity fundraising event notice sent to an individual at her business address.
3. C. A service outage notification provided to an individual by recorded telephone message.
4. D. A revision of contract terms conveyed to an individual by SMS from a marketing organization.

Correct Answer: B

As a result of the European Court of Justice’s ruling in the case of Google v. Spain, search engines outside the EEA are also likely to be subject to the Regulation’s right to be forgotten. This holds true if the activities of an EU subsidiary and its U.S. parent are what?

1. A. Supervised by the same Data Protection Officer.
2. B. Consistent with Privacy Shield requirements
3. C. Bound by a standard contractual clause.
4. D. Inextricably linked in their businesses.

Correct Answer: D

What permissions are required for a marketer to send an email marketing message to a consumer in the EU?

1. A. A prior opt-in consent for consumers unless they are already customers.
2. B. A pre-checked box stating that the consumer agrees to receive email marketing.
3. C. A notice that the consumer’s email address will be used for marketing purposes.
4. D. No prior permission required, but an opt-out requirement on all emails sent to consumers.

Correct Answer: A

A worker in a European Union (EU) member state has ceased his employment with a company. What should the employer most likely do in regard to the worker’s personal data?

1. A. Destroy sensitive information and store the rest per applicable data protection rules.
2. B. Store all of the data in case the departing worker makes a subject access request.
3. C. Securely store the data that is required to be kept under local law.
4. D. Provide the employee the reasons for retaining the data.

Correct Answer: A