CIPP/E Chapter 7: Lawful Processing Criteria fully solved graded A+ 2023/2024

CIPP/E Chapter 7: Lawful Processing CriteriaTrue or false: article 6 of the GDPR outlines the lawful bases for processing personal data - correct answers True What is the first lawful basis for processing personal data? - correct answers A data subject gives their consent to the processing of his or her personal data for one or more specific purposes. A data subjects consent must meet the following conditions: - correct answers 1. Freely given 2. Specific 3. Informed 4. Unambiguous indication of wishes Does the responsibility lie with the controller to demonstrate that the data subject has consented to processing? - correct answers Yes. Define 'freely given' consent. - correct answers The data subject must have a genuine choice and must be able to refuse or withdraw consent. Offering anything less than a genuine choice is unlikely to result in valid consent. True or false: to be valid, consent must be 'specific.' - correct answers True. Consent must be given specifically for the particular processing operation in question. True or false: consent must be 'informed.' - correct answers True. A data subject is given all the necessary details of the processing activity in a language and form they can understand so that they can comprehend how the processing will affect them. True or false: placing an 'accept' button on an online form for a data subject to acknowledge their acceptance qualifies as consent. - correct answers False. Placing an 'accept' button on an online form for a data subject to acknowledge their acceptance may not amount to consent under data protection law, unless the controller can prove that the data subject had reasonable opportunity to be informed of the significance of this consent. What is informed consent? - correct answers A data subject is given all the necessary details of the processing activity in a language and form they can understand so they can comprehend how the processing will affect them. The REgulation indicates for consent to be informed, the data subject should at least be aware of the identity of the controller and purposes of the processing. What is unambiguous consent? - correct answers The data subject's statement or clear affirmative act must leave no doubt as to their intention to give consent. If there is uncertainty regarding whether consent has been given, the circumstances are construed against the controller. True or false: if a data subject comes across a pre-ticked selection box without prior interactions, this counts as unambiguous consent. - correct answers False. An active indication of consent with a clear statement or affirmative action is required. If a data subject actively ticks a selection box, the action most likely will be considered unambiguous consent. True or false: consent is not the same as giving a data subject the opportunity to opt out. - correct answers True. Consent requires and express indication of wishes, whereas opt-out works on the basis that a lack of action by the data subject indicates a lack of objection. The minimum age of consent rule is only in the context of... - correct answers 1. Information society services offered directly to a child; and 2. where the controller relies solely on consent or perhaps True or false: the processing of data is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract - correct answers True. For example, a data subject purchases a product or service from a controller, and through the delivery of that product or service, the controller needs to process the individual's personal data. True or false: processing is necessary for compliance with a legal obligation to which the controller is subject - correct answers True. This relates to a legal obligation with which the controller is required by law to comply like tax or social security obligations. It cannot be an obligation under a contract that the controller has entered into. True or false: processing is not necessary in order to protect the vital interests of the data subject or of another natural person - correct answers False. Processing is necessary in order to protect the vital interests of the data subject or of another natural person. Protecting 'vital interests' refers to life or death situations. For example, if the data subject is unconscious, processing of personal data may be necessary in order to provide urgent medical care.