In which scenario is a Controller most likely required to undertake a Data Protection Impact Assessment?

1. A. When the controller is collecting email addresses from individuals via an online registration form for marketing purposes.
2. B. When personal data is being collected and combined with other personal data to profile the creditworthiness of individuals.
3. C. When the controller is required to have a Data Protection Officer.
4. D. When personal data is being transferred outside of the EEA.

Correct Answer: C

Based on GDPR Article 35, which of the following situations would trigger the need to complete a DPIA?

1. A. A company wants to combine location data with other data in order to offer more personalized service for the customer.
2. B. A company wants to use location data to infer information on a person’s clothes purchasing habits.
3. C. A company wants to build a dating app that creates candidate profiles based on location data and data from third-party sources.
4. D. A company wants to use location data to track delivery trucks in order to make the routes more efficient.

Correct Answer: C

Which aspect of the GDPR will likely have the most impact on the consistent implementation of data protection laws throughout the European Union?

1. A. That it essentially functions as a one-stop shop mechanism
2. B. That it takes the form of a Regulation as opposed to a Directive
3. C. That it makes notification of large-scale data breaches mandatory
4. D. That it makes appointment of a data protection officer mandatory

Correct Answer: D

The GDPR requires controllers to supply data subjects with detailed information about the processing of their data. Where a controller obtains data directly from data subjects, which of the following items of information does NOT legally have to be supplied?

1. A. The recipients or categories of recipients.
2. B. The categories of personal data concerned.
3. C. The rights of access, erasure, restriction, and portability.
4. D. The right to lodge a complaint with a supervisory authority.

Correct Answer: B

SCENARIO
Please use the following to answer the next question:
Sandy recently joined Market4U, an advertising technology company founded in 2016, as their VP of Privacy and Data Governance. Through her first initiative in conducting a data inventory, Sandy learned that Market4U maintains a list of 19 million global contacts that were collected throughout the course of Market4U’s existence. Knowing the risk of having such a large amount of data, Sandy wanted to purge all contacts that were entered into Market4U’s systems prior to May 2018, unless such contacts had a more recent interaction with Market4U content. However, Dan, the VP of Sales, informed Sandy that all of the contacts provide useful information regarding successful marketing campaigns and trends in industry verticals for Market4U’s clients.
Dan also informed Sandy that he had wanted to focus on gaining more customers within the sports and entertainment industry. To assist with this behavior, Market4U’s marketing team decided to add several new fields to Market4U’s website forms, including forms for downloading white papers, creating accounts to participate in Market4U’s forum, and attending events. Such fields include birth date and salary.
What is the best way that Sandy can gain the insights that Dan seeks while still minimizing risks for Market4U?

1. A. Conduct analysis only on anonymized personal data.
2. B. Conduct analysis only on pseudonymized personal data.
3. C. Delete all data collected prior to May 2018 after conducting the trend analysis.
4. D. Procure a third party to conduct the analysis and delete the data from Market4U’s systems.

Correct Answer: A