1. Which statement is correct when considering the right B. The right to privacy has
to privacy under Article 8 of the European Convention to be balanced against
on Human Rights (ECHR)? other rights under the
ECHR
2. What is one major goal that the OECD Guidelines, D. The restriction of
Convention 108 and the Data Protection Directive (Di- cross-border data flow
rective 95/46/EC) all had in common but largely failed
to achieve in Europe?
3. A key component of the OECD Guidelines is the "Indi- D. The rights granted to
vidual Participation Principle". What parts of the Gen- data subjects under Arti-
eral Data Protection Regulation (GDPR) provide the cles 12 to 22
closest equivalent to that principle?
4. Which EU institution is vested with the competence D. The CounciloftheEuro-
to propose new data protection legislation on its own peanUnion
initiative?
5. What is an important difference between the Euro- B. CJEU can force nation-
pean Court of Human Rights (ECHR) and the Court of al governments to imple-
Justice of the European Union (CJEU) in relation to their ment and honor EU law,
roles and functions? while the ECHR cannot.
6. Anna and Frank both work at Granchester University. C. Frank'sperformance-
Anna is a lawyer responsible for data protection, while database
Frank is a lecturer in the engineering department. The
University maintains a number of types of records:
Student records, including names, student numbers,
home addresses, pre-university information, univer-
sity attendance and performance records, details
of special educational needs and financial informa-
tion.Staff records, including autobiographical materi-
,als (such as curricula, professional contact files, stu-
dent evaluations and other relevant teaching files).
Alumni records, including birthplaces, years of birth,
dates of matriculation and conferrals of degrees.
These records are available to former students after
registering through Granchester's Alumni portal. De-
partment for Education records, showing how certain
demographic groups (such as first-generation stu-
dents) could be expected, on average, to progress.
These records do not contain names or identification
numbers.
Under their security policy, the University encrypts all
of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to in-
vestigate how his engineering students perform in
relational to Department for Education expectations.
He has attended one of Anna's data protection train-
ing courses and knows that he should use no more
personal data than necessary to accomplish his goal.
He creates a program that will only export some stu-
dent data: previous schools attended, grades original-
ly obtained, grades currently obtained and first time
university attended. He wants to keep the records at
the individual student level. Mindful of Anna's train-
ing, Frank runs the student numbers through an algo-
rithm to transform them into different reference num-
bers. He uses the same algorithm on each occasion so
that he can update each record over time.
One of Anna's tasks is to complete the record of pro-
cessing activities, as required by the GDPR. After re-
ceiving her email reminder, as required by the GDPR.
After receiving her email reminder, Frank informs
, 3
CIPP-E
Anna about his performance database.
Ann explains to Frank that, as well as minimizing per-
sonal data, the University has to check that this new
use of existing data is permissible. She also suspects
that, under the GDPR, a risk analysis may have to be
carried out before the data processing can take place.
Anna arranges to discuss this further with Frank after
she has done some additional research.
Frank wants to be able to work on his analysis in
his spare time, so he transfers it to his home laptop
(which is not encrypted). Unfortunately, when Frank
takes the laptop into the University he loses it on the
train. Frank has to see Anna that day to discuss com-
patible processing. He knows that he needs to report
security incidents, so he decides to tell Anna about his
lost laptop at the same time.
Which of the University's records does Anna NOT have
to include in her record of processing activities?
7. Please use the following to answer the next question: D. More information
Anna and Frank both work at Granchester University. about what students have
Anna is a lawyer responsible for data protection, while been told and how the re-
Frank is a lecturer in the engineering department. The search will be used.
University maintains a number of types of records:
Student records, including names, student numbers,
home addresses, pre-university information, univer-
sity attendance and performance records, details
of special educational needs and financial informa-
tion.Staff records, including autobiographical materi-
als (such as curricula, professional contact files, stu-
, dent evaluations and other relevant teaching files).
Alumni records, including birthplaces, years of birth,
dates of matriculation and conferrals of degrees.
These records are available to former students after
registering through Granchester's Alumni portal. De-
partment for Education records, showing how certain
demographic groups (such as first-generation stu-
dents) could be expected, on average, to progress.
These records do not contain names or identification
numbers.
Under their security policy, the University encrypts all
of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to in-
vestigate how his engineering students perform in
relational to Department for Education expectations.
He has attended one of Anna's data protection train-
ing courses and knows that he should use no more
personal data than necessary to accomplish his goal.
He creates a program that will only export some stu-
dent data: previous schools attended, grades original-
ly obtained, grades currently obtained and first time
university attended. He wants to keep the records at
the individual student level. Mindful of Anna's train-
ing, Frank runs the student numbers through an algo-
rithm to transform them into different reference num-
bers. He uses the same algorithm on each occasion so
that he can update each record over time.
One of Anna's tasks is to complete the record of
processing activities, as required by the GDPR. Af-
ter receiving her email reminder, as required by the
GDPR. After receiving her email reminder, Frank in-
forms Anna about his performance database.
to privacy under Article 8 of the European Convention to be balanced against
on Human Rights (ECHR)? other rights under the
ECHR
2. What is one major goal that the OECD Guidelines, D. The restriction of
Convention 108 and the Data Protection Directive (Di- cross-border data flow
rective 95/46/EC) all had in common but largely failed
to achieve in Europe?
3. A key component of the OECD Guidelines is the "Indi- D. The rights granted to
vidual Participation Principle". What parts of the Gen- data subjects under Arti-
eral Data Protection Regulation (GDPR) provide the cles 12 to 22
closest equivalent to that principle?
4. Which EU institution is vested with the competence D. The CounciloftheEuro-
to propose new data protection legislation on its own peanUnion
initiative?
5. What is an important difference between the Euro- B. CJEU can force nation-
pean Court of Human Rights (ECHR) and the Court of al governments to imple-
Justice of the European Union (CJEU) in relation to their ment and honor EU law,
roles and functions? while the ECHR cannot.
6. Anna and Frank both work at Granchester University. C. Frank'sperformance-
Anna is a lawyer responsible for data protection, while database
Frank is a lecturer in the engineering department. The
University maintains a number of types of records:
Student records, including names, student numbers,
home addresses, pre-university information, univer-
sity attendance and performance records, details
of special educational needs and financial informa-
tion.Staff records, including autobiographical materi-
,als (such as curricula, professional contact files, stu-
dent evaluations and other relevant teaching files).
Alumni records, including birthplaces, years of birth,
dates of matriculation and conferrals of degrees.
These records are available to former students after
registering through Granchester's Alumni portal. De-
partment for Education records, showing how certain
demographic groups (such as first-generation stu-
dents) could be expected, on average, to progress.
These records do not contain names or identification
numbers.
Under their security policy, the University encrypts all
of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to in-
vestigate how his engineering students perform in
relational to Department for Education expectations.
He has attended one of Anna's data protection train-
ing courses and knows that he should use no more
personal data than necessary to accomplish his goal.
He creates a program that will only export some stu-
dent data: previous schools attended, grades original-
ly obtained, grades currently obtained and first time
university attended. He wants to keep the records at
the individual student level. Mindful of Anna's train-
ing, Frank runs the student numbers through an algo-
rithm to transform them into different reference num-
bers. He uses the same algorithm on each occasion so
that he can update each record over time.
One of Anna's tasks is to complete the record of pro-
cessing activities, as required by the GDPR. After re-
ceiving her email reminder, as required by the GDPR.
After receiving her email reminder, Frank informs
, 3
CIPP-E
Anna about his performance database.
Ann explains to Frank that, as well as minimizing per-
sonal data, the University has to check that this new
use of existing data is permissible. She also suspects
that, under the GDPR, a risk analysis may have to be
carried out before the data processing can take place.
Anna arranges to discuss this further with Frank after
she has done some additional research.
Frank wants to be able to work on his analysis in
his spare time, so he transfers it to his home laptop
(which is not encrypted). Unfortunately, when Frank
takes the laptop into the University he loses it on the
train. Frank has to see Anna that day to discuss com-
patible processing. He knows that he needs to report
security incidents, so he decides to tell Anna about his
lost laptop at the same time.
Which of the University's records does Anna NOT have
to include in her record of processing activities?
7. Please use the following to answer the next question: D. More information
Anna and Frank both work at Granchester University. about what students have
Anna is a lawyer responsible for data protection, while been told and how the re-
Frank is a lecturer in the engineering department. The search will be used.
University maintains a number of types of records:
Student records, including names, student numbers,
home addresses, pre-university information, univer-
sity attendance and performance records, details
of special educational needs and financial informa-
tion.Staff records, including autobiographical materi-
als (such as curricula, professional contact files, stu-
, dent evaluations and other relevant teaching files).
Alumni records, including birthplaces, years of birth,
dates of matriculation and conferrals of degrees.
These records are available to former students after
registering through Granchester's Alumni portal. De-
partment for Education records, showing how certain
demographic groups (such as first-generation stu-
dents) could be expected, on average, to progress.
These records do not contain names or identification
numbers.
Under their security policy, the University encrypts all
of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to in-
vestigate how his engineering students perform in
relational to Department for Education expectations.
He has attended one of Anna's data protection train-
ing courses and knows that he should use no more
personal data than necessary to accomplish his goal.
He creates a program that will only export some stu-
dent data: previous schools attended, grades original-
ly obtained, grades currently obtained and first time
university attended. He wants to keep the records at
the individual student level. Mindful of Anna's train-
ing, Frank runs the student numbers through an algo-
rithm to transform them into different reference num-
bers. He uses the same algorithm on each occasion so
that he can update each record over time.
One of Anna's tasks is to complete the record of
processing activities, as required by the GDPR. Af-
ter receiving her email reminder, as required by the
GDPR. After receiving her email reminder, Frank in-
forms Anna about his performance database.
