The GDPR requires controllers to supply data subjects with detailed information about the processing of their dat a. Where a controller obtains data directly from data subjects, which of the following items of information does NOT legally have to be supplied?

• A.The right to lodge a complaint with a supervisory authority.
• B.The categories of personal data concerned.
• C.The recipients or categories of recipients.
• D.The rights of access, erasure, restriction, and portability.

Comment: *

Name: *

Email: *

Verification: *

With respect to international transfers of personal data, the European Data Protection Board (EDPB) confirmed that derogations may be relied upon under what condition?

• A.If the data controller has received preapproval from a Data Protection Authority (DPA), after submitting the appropriate documents.
• B.When it has been determined that adequate protection can be performed.
• C.Only if the Data Protection Impact Assessment (DPIA) shows low risk.
• D.Only as a last resort and when interpreted restrictively.

Comment: *

Name: *

Email: *

Verification: *

When hiring a data processor, which action would a data controller NOT be able to depend upon to avoid liability in the event of a security breach?

• A.Conducting a risk assessment to analyze possible outsourcing threats.
• B.Documenting due diligence steps taken in the pre-contractual stage.
• C.Requiring that the processor directly notify the appropriate supervisory authority.
• D.Maintaining evidence that the processor was the best possible market choice available.

Comment: *

Name: *

Email: *

Verification: *

In the Planet 49 case, what was the man judgement of the Coon of Justice of the European Union (CJEU) regarding the issue of cookies?

• A.If the ePrivacy Directive requires consent for cookies, then the GDPR's consent requirements apply.
• B.If a website's cookie notice makes clear the information gathered and the lifespan of the cookie, then pre-checked boxes are acceptable.
• C.If a data subject continues to scroll through a website after reading a cookie banner, this activity constitutes valid consent for the tracking described in the cookie banner.
• D.If the cookies do not track personal data, then pre-checked boxes are acceptable.

Comment: *

Name: *

Email: *

Verification: *

What must be included in a written agreement between the controller and processor in relation to processing conducted on the controller's behalf?

• A.An obligation on the processor to assist the controller in complying with the controller's obligations to notify the supervisory authority about personal data breaches.
• B.An obligation on both parties to report any serious personal data breach to the supervisory authority.
• C.An obligation on the processor to report any personal data breach to the controller within 72 hours.
• D.An obligation on both parties to agree to a termination of the agreement if the other party is responsible for a personal data breach.

Comment: *

Name: *

Email: *

Verification: *