GDPR Data Protection Principles Flashcards

GDPR's lawfulness principle lists six lawful bases for processing. Which of the following is NOT one of them?

Answer: Competitive business advantage

Competitive business advantage is not a lawful basis; the six bases are consent, contract, legal obligation, vital interests, public task, and legitimate interests.

When processing is based on 'legitimate interests,' controllers must perform a balancing test. What is the primary factor assessed?

Answer: Whether the data subject's interests or fundamental rights override the controller's interests

The legitimate interests balancing test weighs the controller's interest against whether data subjects' rights and freedoms override it, especially for vulnerable individuals.

Under GDPR, consent must meet several conditions to be valid. Which condition below is required?

Answer: Consent must be freely given, specific, informed, and unambiguous

Valid GDPR consent must be freely given, specific, informed, and indicated by a clear affirmative act; pre-ticked boxes and implied consent are invalid.

A controller relies on legal obligation as the lawful basis for processing employee tax data. What does this mean for the employee's right to erasure?

Answer: The right to erasure does not apply where processing is necessary to comply with a legal obligation

The right to erasure does not apply when processing is necessary for compliance with a legal obligation, such as mandatory tax record-keeping.

Which GDPR principle is sometimes called the 'overarching' principle because it requires controllers to take responsibility for and demonstrate compliance with all other principles?

Answer: Accountability

Accountability is the overarching principle that obliges controllers to implement appropriate measures and be able to demonstrate compliance with all other GDPR principles.

A company retains personal data 'just in case it is needed for future lawsuits.' Under GDPR storage limitation, this practice is:

Answer: Non-compliant unless there is a specific, documented legal hold justification

Storage limitation requires a specific, documented purpose for retention; vague future litigation risk without a concrete legal hold does not satisfy this requirement.

Under the fairness component of the lawfulness, fairness, and transparency principle, which situation would most likely be considered unfair?

Answer: Using customer purchase data to deny them insurance without disclosure

Using personal data in ways that are detrimental to individuals without their knowledge violates the fairness component of GDPR's first principle.