To provide evidence of GDPR compliance, a company performs an internal audit. As a result, it finds a data base, password-protected, listing all the social network followers of the client.
Regarding the domain of the controller-processor relationships, how is this situation considered?

1. A. Compliant with the security principle, because the data base is password-protected.
2. B. Non-compliant, because the storage of the data exceeds the tasks contractually authorized by the controller.
3. C. Not applicable, because the data base is password protected, and therefore is not at risk of identifying any data subject.
4. D. Compliant with the storage limitation principle, so long as the internal auditor permanently deletes the data base.

Correct Answer: B

Select the answer below that accurately completes the following: “The right to compensation and liability under the GDPR…

1. A. …provides for an exemption from liability if the data controller (or data processor) proves that it is not in any way responsible for the event giving rise to the damage.”
2. B. …precludes any subsequent recourse proceedings against other controllers or processors involved in the same processing.”
3. C. ...can only be exercised against the data controller, even if a data processor was involved in the same processing.”
4. D. …is limited to a maximum amount of EUR 20 million per event of damage or loss.”

Correct Answer: B

Which of the following was the first legally binding international instrument in the area of data protection?

1. A. Convention 108.
2. B. General Data Protection Regulation.
3. C. Universal Declaration of Human Rights.
4. D. EU Directive on Privacy and Electronic Communications.

Correct Answer: A

Which change was introduced by the 2009 amendments to the e-Privacy Directive 2002/58/EC?

1. A. A voluntary notification for personal data breaches applicable to all data controllers.
2. B. A voluntary notification for personal data breaches applicable to electronic communication providers.
3. C. A mandatory notification for personal data breaches applicable to all data controllers.
4. D. A mandatory notification for personal data breaches applicable to electronic communication providers.

Correct Answer: D

Which of the following is NOT an explicit right granted to data subjects under the GDPR?

1. A. The right to request access to the personal data a controller holds about them.
2. B. The right to request the deletion of data a controller holds about them.
3. C. The right to opt-out of the sale of their personal data to third parties.
4. D. The right to request restriction of processing of personal data, under certain scenarios.

Correct Answer: A