Articles 13 and 14 of the GDPR provide details on the obligation of data controllers to inform data subjects when collecting personal dat a. However, both articles specify an exemption for situations in which the data subject already has the information.
Which other situation would also exempt the data controller from this obligation under Article 14?

• A.When providing the information would involve a disproportionate effort
• B.When the personal data was obtained 5 years before the entry into force of the GDPR
• C.When providing the information would go against a police order.
• D.When the personal data was obtained through multiple source in the public domain

Comment: *

Name: *

Email: *

Verification: *

SCENARIO
Please use the following to answer the next question:
Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a few months ago.
Although no one was hurt, Louis has been plagued by texts and calls from a company called Accidentable offering to help him recover compensation for personal injury. Louis has heard about insurance companies selling customers' data to third parties, and he's convinced that Accidentable must have gotten his information from Bedrock Insurance.
Louis has also been receiving an increased amount of marketing information from Bedrock, trying to sell him their full range of their insurance policies.
Perturbed by this, Louis has started looking at price comparison sites on the internet and has been shocked to find that other insurers offer much cheaper rates than Bedrock, even though he has been a loyal customer for many years. When his Bedrock policy comes up for renewal, he decides to switch to Zantrum Insurance.
In order to activate his new insurance policy, Louis needs to supply Zantrum with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask Bedrock to transfer his information directly to Zantrum. He also takes this opportunity to ask Bedrock to stop using his personal data for marketing purposes.
Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Louis it cannot transfer his data directly to Zantrum as this is not technically feasible.
Bedrock also explains that Louis's contract included a provision whereby Louis agreed that his data could be used for marketing purposes; according to Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which was filled with legal jargon and very confusing.
In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He writes to Accidentable to ask for the name of the organization that supplied his details to them. He warns Accidentable that he plans to complain to the data protection authority, because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.
Accidentable's response letter confirms Louis's suspicions. Accidentable is Bedrock Insurance's wholly owned subsidiary, and they received information about Louis's accident from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis that there has been no breach of the GDPR, as Louis's contract included, a provision in which he agreed to share his information with Bedrock's affiliates for business purposes.
Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them insisting that all his information be erased from their computer system.
After Louis has exercised his right to restrict the use of his data, under what conditions would Accidentable have grounds for refusing to comply?

• A.If Accidentable is entitled to use of the data as an affiliate of Bedrock.
• B.If Accidentable also uses the data to conduct public health research.
• C.If the data becomes necessary to defend Accidentable's legal rights.
• D.If the accuracy of the data is not an aspect that Louis is disputing.

Comment: *

Name: *

Email: *

Verification: *

According to the E-Commerce Directive 2000/31/EC, where is the place of "establishment" for a company providing services via an Internet website confirmed by the GDPR?

• A.Where the technology supporting the website is located
• B.Where the website is accessed
• C.Where the decisions about processing are made
• D.Where the customer's Internet service provider is located

Comment: *

Name: *

Email: *

Verification: *

What permissions are required for a marketer to send an email marketing message to a consumer in the EU?

• A.A prior opt-in consent for consumers unless they are already customers.
• B.A pre-checked box stating that the consumer agrees to receive email marketing.
• C.A notice that the consumer's email address will be used for marketing purposes.
• D.No prior permission required, but an opt-out requirement on all emails sent to consumers.

Comment: *

Name: *

Email: *

Verification: *

What is true if an employee makes an access request to his employer for any personal data held about him?

• A.The employer can automatically decline the request if it contains personal data about a third person.
• B.The employer can decline the request if the information is only held electronically.
• C.The employer must supply any information held about an employee unless an exemption applies.
• D.The employer must supply all the information held about the employee.

Comment: *

Name: *

Email: *

Verification: *