CIPP E
Study online at https://quizlet.com/_dgb66l
1. A key component of the OECD Guidelines is the 'indi- Rights granted to data
vidual participation principle.' What parts of the GDPR subjects under Articles 12
provide the closest equivalent? to 23
2. Under the GDPR, when processing data for direct mar- Provide info explaining
keting activities, data controllers must do which of the how personal data will be
following? used for marketing pur-
poses
3. How does the GDPR define processing? Any operation or set of
operations performed on
personal data or on sets of
personal data
4. Which of the following is a right/freedom that must be Freedom of expression
considered when balancing privacy rights under the
GDPR?
5. Which of the following is a right/freedom that must be Freedom to conduct lawful
considered when balancing privacy rights under the business
GDPR?
6. Much of the GDPR builds upon the Data Protection Right to data portability
Directive. Which of the following data subject rights is
the only right that did NOT exist in some form in the
Directive?
7. Under the right to be forgotten, what is a controller Inform all third party con-
required to do when they receive a proper request for trollers processing shared
erasure from a data subject? personal data that they
must delete it
8.
, CIPP E
Study online at https://quizlet.com/_dgb66l
What is one major goal that the OECD Guidelines, Con- Synchronization of the ap-
vention 108 and the Data Protection Directive had in proaches to data protec-
common but largely failed to achieve in Europe? tion
9. Which of the following is one of the seven EU-US and Security
Swiss-US Privacy Shield Principles?
10. Which of the following is one of the seven EU-US and Access
Swiss-US Privacy Shield Principles?
11. Which of the following is a piece of criteria that the Actions taken by the con-
supervisory authority may take into account when de- troller to mitigate the
termining the amount of a fine? damage suffered by the
data subjects
12. According to the GDPR, how is pseudonymous person- Data that cannot be attrib-
al data defined? uted to a specific data sub-
ject without the use of ad-
ditional information kept
separately
13. Processing of biometric data requires both a lawful condition for processing
basis and ________________, otherwise, it is generally
prohibited by the GDPR.
14. True / False: Article 30's record keeping requirement False: There are three ex-
has absolutely no exceptions for companies employ- ceptions
ing fewer than 250 people.
15. A company must appoint a DPO, whether it is a processing of sensitive
controller or processor, if its core activities involve data on a large scale
______________.
16. Which treaty created the European Union? 1992 Maastricht Treaty
Study online at https://quizlet.com/_dgb66l
1. A key component of the OECD Guidelines is the 'indi- Rights granted to data
vidual participation principle.' What parts of the GDPR subjects under Articles 12
provide the closest equivalent? to 23
2. Under the GDPR, when processing data for direct mar- Provide info explaining
keting activities, data controllers must do which of the how personal data will be
following? used for marketing pur-
poses
3. How does the GDPR define processing? Any operation or set of
operations performed on
personal data or on sets of
personal data
4. Which of the following is a right/freedom that must be Freedom of expression
considered when balancing privacy rights under the
GDPR?
5. Which of the following is a right/freedom that must be Freedom to conduct lawful
considered when balancing privacy rights under the business
GDPR?
6. Much of the GDPR builds upon the Data Protection Right to data portability
Directive. Which of the following data subject rights is
the only right that did NOT exist in some form in the
Directive?
7. Under the right to be forgotten, what is a controller Inform all third party con-
required to do when they receive a proper request for trollers processing shared
erasure from a data subject? personal data that they
must delete it
8.
, CIPP E
Study online at https://quizlet.com/_dgb66l
What is one major goal that the OECD Guidelines, Con- Synchronization of the ap-
vention 108 and the Data Protection Directive had in proaches to data protec-
common but largely failed to achieve in Europe? tion
9. Which of the following is one of the seven EU-US and Security
Swiss-US Privacy Shield Principles?
10. Which of the following is one of the seven EU-US and Access
Swiss-US Privacy Shield Principles?
11. Which of the following is a piece of criteria that the Actions taken by the con-
supervisory authority may take into account when de- troller to mitigate the
termining the amount of a fine? damage suffered by the
data subjects
12. According to the GDPR, how is pseudonymous person- Data that cannot be attrib-
al data defined? uted to a specific data sub-
ject without the use of ad-
ditional information kept
separately
13. Processing of biometric data requires both a lawful condition for processing
basis and ________________, otherwise, it is generally
prohibited by the GDPR.
14. True / False: Article 30's record keeping requirement False: There are three ex-
has absolutely no exceptions for companies employ- ceptions
ing fewer than 250 people.
15. A company must appoint a DPO, whether it is a processing of sensitive
controller or processor, if its core activities involve data on a large scale
______________.
16. Which treaty created the European Union? 1992 Maastricht Treaty
