After leaving the EU under the terms of Brexit, the United Kingdom will seek an adequacy determination. What is the reason for this?

1. A. The Insurance Commissioner determined that an adequacy determination is required by the Data Protection Act.
2. B. Adequacy determinations automatically lapse when a Member State leaves the EU.
3. C. The UK is now a third country because it’s no longer subject to the GDPR.
4. D. The UK is less trustworthy now that its not part of the Union.

Correct Answer: C

What is a reason the European Court of Justice declared the Data Retention Directive invalid in 2014?

1. A. The requirements affected individuals without exception.
2. B. The requirements were financially burdensome to EU businesses.
3. C. The requirements specified that data must be held within the EU.
4. D. The requirements had limitations on how national authorities could use data.

Correct Answer: D

In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?

1. A. Where the DPIA identifies that personal data needs to be transferred to other countries outside of the EEA.
2. B. Where the DPIA identifies high risks to individuals’ rights and freedoms that the controller can take steps to reduce.
3. C. Where the DPIA identifies that the processing being proposed collects the sensitive data of EU citizens.
4. D. Where the DPIA identifies risks that will require insurance for protecting its business interests.

Correct Answer: B

Which marketing-related activity is least likely to be covered by the provisions of Privacy and Electronic Communications Regulations (Directive 2002/58/EC)?

1. A. Advertisements passively displayed on a website.
2. B. The use of cookies to collect data about an individual.
3. C. A text message to individuals from a company offering concert tickets for sale.
4. D. An email from a retail outlet promoting a sale to one of their previous customer.

Correct Answer: A

Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?

1. A. Carry out an exercise that weighs the interests of the controller and the basis for the data subject’s objection.
2. B. Consider the impact of the profiling on the data subject’s interest, rights and freedoms.
3. C. Demonstrate that the profiling is for the purposes of direct marketing.
4. D. Consider the importance of the profiling to their particular objective.

Correct Answer: C