Fichas
CIPP/US: Module 3 - GDPR
Fichas del conjunto (17)
- 1Material scope of GDPR: Cite 2 activities that come under the material scope1. Processing personal data
wholly or partly by automated means
2. Material scope also covers personal data that forms part of a filing system. This applies even if the processing is not conducted by automated means. - 2Territorial scope of GDPR: What 3 criteria must be met for the GDPR to be applicable?One of these:
1. Controller/ processor
established in EU
2. Data subjects in EU
3. Controller not established in EU but where member state law applies - 3What do GDPR consumer rights allow individuals to do? Cite 4 rights1. Withdraw consent
2. Request a copy
3. Freeze processing
4. Object to automated decision-making - 4What obligations do organizations have under the GDPR? Name 6 obligations1. Notice to process personal data
2. Compliance of transfers
3. Protection by design and default
4. Responsibility for vendor processing
5. Appropriate security
6. Keep records and demonstrate compliance - 5Name 6 data transfer mechanisms provided by the GDPR for cross-border transfers of personal data1. Binding corporate rules (BCRs)
2. Adequacy decisions
3. Derogations (Article 49)
4. Ad hoc contracts
5. Standard contractual clauses (SCCs)
6. Codes of conduct and/ or
self-certification mechanisms - 6In what scenario could derogations be used as a data transfer mechanism?Can be used as last resort, in limited circumstances and under specific conditions, if no adequacy decision or appropriate safeguards exist
- 7Can an organization proceed with transferring personal data outside the European Economic Area **without a legal basis** as long as one of the transfer mechanisms provided by GDPR is utilized?No!
There must be a legal basis for
processing personal data and
transferring it outside the
European Economic Area - 8U.S. adequacy timeline: What key development took place in July 2000?Safe Harbor
found adequate by the
European Commission - 9U.S. adequacy timeline: What key development took place in October 2015?Safe Harbor invalidated
by the CJEU as a result of
Schrems v.
Data Protection Commissioner case - 10U.S. adequacy timeline: What key development took place in February 2016?Negotiations with the
European Commission resulted in the
EU-U.S. Privacy Shield agreement - 11U.S. adequacy timeline: What key development took place in July 2016?The Commission formally
approved the
EU-U.S. Privacy Shield - 12U.S. adequacy timeline: What key development took place in July 2020?In a subsequent ruling of
Data Protection Commission
v. Facebook Ireland, Schrems,
the CJEU invalidated the
European Commission’s adequacy determination for the
EU-U.S. Privacy Shield - 13Under GDPR, what entity determines the purposes and means of processing personal data?Controller
- 14GDPR requires all public authorities in the EU to appoint a DPO. True/ False?True
- 15Under what circumstances must organizations (that fall under the scope of the GDPR) appoint a DPO? Cite 2 circumstances1. Organizations whose core activities involve processing personal data
on a large scale
Or
2. Organizations who consistently process highly sensitive data or data relating to criminal convictions and offenses - 16A U.S. organization that collects personal data from individuals in the EU may need to build GDPR-specific data subject rights into its internal policies and procedures. Name up to 6 rights that may be extended by these organizations1. Access and rectification of personal data
2. Data portability
3. Erasure (or the “right to be forgotten”)
4. Restriction of processing
5. Object to processing of personal data
6. The right “not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects ... or similarly significant effects” - 17What is the GDPR definition of personal data?“Any information relating to an
identified or identifiable
natural person”
Información
- Descripción
- Fichas sobre CIPP/US: Module 3 - GDPR, creado por J Bro el 11/02/2022.
- Creado por
- J Bro
- Visitas
- 14
- Valoración