CIPP E Case Studies- A+ Rated

University Data - Answer-Anna is a lawyer for university tasked with student records. Frank is professor. 4 Types of Data 1. Student Data - Personal Info 2. Employee Data - Personal Info 3. Alumni Data - Personal Info 4. Department of Education: Demographic - no personal identifiers University Data Continued - Answer-Frank wants to build a database to process data and see how 1st year student in his class progress. He builds algorithm to process data without identifiers, all UNV systems encrypted. Takes laptop home, not encrypted, loses it. What should Anna / DPO check to confirm he can process that data? - Answer-More info about algorithm he developed. Which types of data does Anna not have to include in her records of processing? - Answer-Dept. of Education Records (No personal data included & not likely to be identified by data included in this) He loses data, what should happen next? - Answer-- Report to SA - Most likely tell students ABC Insurance - Answer-ABC Insurance gives data to subsidiary, which begins direct marketing to Jason. Jason decides to switch insurance companies. ABC Insurance is direct marketing to Jason, he asks them to stop - Answer-They say there is a line in the contract he signed saying he consents to direct marketing and they dont stop. If Jason asks to stop use of his data, what must the ABC Subsidiary do? - Answer-First stop processing immediately, then stop using data According to GDPR regulations on direct marketing, can Jason stop ABC from direct marketing? - Answer-Jason has the right to object & ABC must immediately stop using his data. Did ABC violate GDPR by not sending the data to new insurance company? - Answer-No because legitimately not possible