1. How does the GDPR now define “processing”?
Any act involving the collecting and recording of personal data.
Any operation or set of operations performed on personal
data or on sets of personal data.
Any use or disclosure of personal data compatible with the
purpose for which the data was collected.
Any operation or set of operations performed by automated
means on personal data or on sets of personal data.
Explanation:
Reference: https://gdpr-info.eu/issues/processing/
2. What is the MAIN reason GDPR Article 4(22) establishes the
concept of the “concerned supervisory authority”?
To encourage the consistency of local data processing activity.
To give corporations a choice about who their supervisory
authority will be.
To ensure the GDPR covers controllers that do not have an
establishment in the EU but have a representative in a member
state.
To ensure that the interests of individuals residing outside the
lead authority’s jurisdiction are represented.
Question was not answered
3. Which of the following would MOST likely trigger the
extraterritorial effect of the GDPR, as specified by Article 3?
The behavior of suspected terrorists being monitored by EU law
enforcement bodies.
, Personal data of EU citizens being processed by a controller or
processor based outside the E
The behavior of EU citizens outside the EU being monitored
by non-EU law enforcement bodies.
Personal data of EU residents being processed by a non-EU
business that targets EU customers.
Explanation:
Article 3 of the GDPR specifies the territorial scope of the regulation.
According to Article 3(2), the GDPR applies to the processing of
personal data of data subjects who are in the Union by a controller or
processor not established in the Union, where the processing
activities are related to:
a) the offering of goods or services, irrespective of whether a
payment of the data subject is required, to such data subjects in the
Union; or
b) the monitoring of their behavior as far as their behavior takes
place within the Union.
Option D aligns with the criteria specified in Article 3(2)(a). If a non-
EU business targets EU customers (or offers goods or services to
individuals in the EU), then it falls under the territorial scope of the
GDPR.
While option B may sound plausible, the mere fact of processing
personal data of EU citizens outside the EU doesn't automatically
bring an entity under the GDPR's scope. It's the targeting of services
or monitoring of behavior of individuals in the EU that triggers the
GDPR's extraterritorial effect.
4. It a company receives an anonymous email demanding
ransom for the stolen personal data of its clients, what must the
company do next, per GDPR requirements'3
Notify the police and Tile a criminal complaint about the incident
Start an investigation to understand the incident's possible
scope, duration and nature
Send a notification to the competent supervisory authority
describing the incident.
Send an email about the incident to all clients and ask them to
change their passwords
, 5. A company in France suffers a robbery over the weekend
owing to a faulty alarm system. When it is determined that the
break-in involves the loss of a substantial amount of data, the
company decides on a CCTV system to monitor for future
incidents. Company technicians install cameras in the entrance
of the building, hallways and offices. Footage is recorded
continuously, and is monitored by the home office in the United
States.
What is the most realistic step the company could take to
address their security concerns and comply with the personal
data processing principles set out in Article 5 of the GDPR?
Seek informed consent from company employees.
Have cameras recording during work hours only.
Retain captured footage for no more than 30 days.
Restrict camera placement to building entrances only.
6. SCENARIO
Please use the following to answer the next question:
T-Craze, a German-headquartered specialty t-shirt company,
was successfully selling to large German metropolitan cities.
However, after a recent merger with another German-based
company that was selling to a broader European market, T-
Craze revamped its marketing efforts to sell to a wider
audience. These efforts included a complete redesign of its logo
to reflect the recent merger, and improvements to its website
meant to capture more information about visitors through the
use of cookies.
T-Craze also opened various office locations throughout Europe
to help expand its business. While Germany continued to host
T-Craze’s headquarters and main product-design office, its
French affiliate became responsible for all marketing and sales
activities. The French affiliate recently procured the services of
Right Target, a renowned marketing firm based in the
Any act involving the collecting and recording of personal data.
Any operation or set of operations performed on personal
data or on sets of personal data.
Any use or disclosure of personal data compatible with the
purpose for which the data was collected.
Any operation or set of operations performed by automated
means on personal data or on sets of personal data.
Explanation:
Reference: https://gdpr-info.eu/issues/processing/
2. What is the MAIN reason GDPR Article 4(22) establishes the
concept of the “concerned supervisory authority”?
To encourage the consistency of local data processing activity.
To give corporations a choice about who their supervisory
authority will be.
To ensure the GDPR covers controllers that do not have an
establishment in the EU but have a representative in a member
state.
To ensure that the interests of individuals residing outside the
lead authority’s jurisdiction are represented.
Question was not answered
3. Which of the following would MOST likely trigger the
extraterritorial effect of the GDPR, as specified by Article 3?
The behavior of suspected terrorists being monitored by EU law
enforcement bodies.
, Personal data of EU citizens being processed by a controller or
processor based outside the E
The behavior of EU citizens outside the EU being monitored
by non-EU law enforcement bodies.
Personal data of EU residents being processed by a non-EU
business that targets EU customers.
Explanation:
Article 3 of the GDPR specifies the territorial scope of the regulation.
According to Article 3(2), the GDPR applies to the processing of
personal data of data subjects who are in the Union by a controller or
processor not established in the Union, where the processing
activities are related to:
a) the offering of goods or services, irrespective of whether a
payment of the data subject is required, to such data subjects in the
Union; or
b) the monitoring of their behavior as far as their behavior takes
place within the Union.
Option D aligns with the criteria specified in Article 3(2)(a). If a non-
EU business targets EU customers (or offers goods or services to
individuals in the EU), then it falls under the territorial scope of the
GDPR.
While option B may sound plausible, the mere fact of processing
personal data of EU citizens outside the EU doesn't automatically
bring an entity under the GDPR's scope. It's the targeting of services
or monitoring of behavior of individuals in the EU that triggers the
GDPR's extraterritorial effect.
4. It a company receives an anonymous email demanding
ransom for the stolen personal data of its clients, what must the
company do next, per GDPR requirements'3
Notify the police and Tile a criminal complaint about the incident
Start an investigation to understand the incident's possible
scope, duration and nature
Send a notification to the competent supervisory authority
describing the incident.
Send an email about the incident to all clients and ask them to
change their passwords
, 5. A company in France suffers a robbery over the weekend
owing to a faulty alarm system. When it is determined that the
break-in involves the loss of a substantial amount of data, the
company decides on a CCTV system to monitor for future
incidents. Company technicians install cameras in the entrance
of the building, hallways and offices. Footage is recorded
continuously, and is monitored by the home office in the United
States.
What is the most realistic step the company could take to
address their security concerns and comply with the personal
data processing principles set out in Article 5 of the GDPR?
Seek informed consent from company employees.
Have cameras recording during work hours only.
Retain captured footage for no more than 30 days.
Restrict camera placement to building entrances only.
6. SCENARIO
Please use the following to answer the next question:
T-Craze, a German-headquartered specialty t-shirt company,
was successfully selling to large German metropolitan cities.
However, after a recent merger with another German-based
company that was selling to a broader European market, T-
Craze revamped its marketing efforts to sell to a wider
audience. These efforts included a complete redesign of its logo
to reflect the recent merger, and improvements to its website
meant to capture more information about visitors through the
use of cookies.
T-Craze also opened various office locations throughout Europe
to help expand its business. While Germany continued to host
T-Craze’s headquarters and main product-design office, its
French affiliate became responsible for all marketing and sales
activities. The French affiliate recently procured the services of
Right Target, a renowned marketing firm based in the
