PECB GDPR 시험

Question No : 1

Scenario:
BookSt is an online bookshop that collects personal data before selling its products. Sarah signed up for an account, providing her name, email, and password. To purchase a book, Sarah was required to provide her shipping address and payment information, which is needed to calculate shipping costs and complete the transaction.
Question:
Does the company have a legal basis for processing Sarah's data?

• A.No, the processing is not legally justified if it is only for sales purposes.
• B.Yes, the processing is necessary for the performance of a contract to which the data subject is a party.
• C.No, the processing is legally justified only if it is necessary to protect the vital interests of the data subject.
• D.Yes, but only if Sarah provides explicit consent for her data to be processed.

답을 확인하기

정답:
Explanation:
Reference: GDPR Article 6(1)(b) (Processing necessary for contract performance)
Recital 44 (Contractual necessity as a legal basis)

Question No : 2

Question:
Which of the following options is the DPO’s responsibility when processing personal data related to criminal convictions is carried out by an official authority?

• A.Determining the location where sensitive data may be processed.
• B.Assessing the necessity of knowing a data subject's identity.
• C.Ensuring compliance with any legal requirements of Member States.
• D.Approving all security measures for processing this data.

답을 확인하기

정답:
Explanation:
Under Article 39(1)(b) of GDPR, the DPO monitors compliance with GDPR and other applicable laws, including Member State laws on criminal conviction data.
Option C is correct because DPOs must ensure processing aligns with national legal requirements.
Option A is incorrect because determining processing locations is a technical decision, not a DPO responsibility.
Option B is incorrect because DPOs do not assess the necessity of identity disclosure.
Option D is incorrect because approving security measures is the responsibility of controllers and processors, not the DPO.
Reference: GDPR Article 39(1)(b) (DPO’s role in ensuring legal compliance)
Recital 97 (DPO responsibilities in public and private sectors)

Question No : 3

Question:
You work in a company that provides training services. One of the clients requests access to information about the categories of recipients to whom their personal data will be disclosed.
What actions should you take to be compliant with GDPR?

• A.Obtain authorization from the recipients before disclosing their identities.
• B.Verify the identity of the client by sending login data to their mailing address.
• C.Inform the client that access to this type of information is not allowed, since it may result in a high risk to the rights and freedoms of recipients.
• D.Provide the client with the requested information about the recipients of their data.

답을 확인하기

정답:
Explanation:
Under Article 15(1)(c) of GDPR, data subjects have the right to access information about the recipients or categories of recipients who have received their personal data.
Option D is correct because GDPR mandates transparency regarding data sharing.
Option A is incorrect because authorization from recipients is not required before disclosing their categories.
Option B is incorrect because identity verification applies to access requests but is not a prerequisite for providing recipient information.
Option C is incorrect because denying access to this information violates the data subject’s right under GDPR.
Reference: GDPR Article 15(1)(c) (Right of access to recipient categories)
Recital 63 (Transparency in processing and access rights)

Question No : 4

Question:
A patient gave consent for the use of their laboratory tests to defend a clinical laboratory against a lawsuit. As a result, the court required the collection and processing of the patient's health data, and such information was revealed in court.
Is this compliant with GDPR's lawfulness of processing requirements?

• A.Yes, because the data subject has consented to the processing of health data, and GDPR allows the processing of special categories of data where it is necessary for the establishment, exercise, or defense of legal claims.
• B.Yes, but only if the processing of special categories of personal data is controlled by a public health institution, and the data subject has consented to the processing of this type of data.
• C.No, although the data subject has consented to the processing of health data, GDPR does not allow the disclosure of special categories of personal data by health institutions.
• D.No, because personal data used in legal proceedings must be anonymized before being disclosed.

답을 확인하기

정답:
Explanation:
Under Article 9(2)(f) of GDPR, the processing of special categories of data (e.g., health data) is permitted without consent if it is necessary for the establishment, exercise, or defense of legal claims.
Option A is correct because GDPR allows processing of special category data for legal claims, even without explicit consent.
Option B is incorrect because processing for legal claims is not restricted to public health institutions.
Option C is incorrect because GDPR explicitly allows such processing for legal claims.
Option D is incorrect because anonymization is not required when data is processed under Article 9(2)(f).
Reference: GDPR Article 9(2)(f) (Processing of special categories of data for legal claims)
Recital 52 (Legal grounds for processing sensitive data in court cases)

Question No : 5

Scenario 5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Question:
Question:
Which statement regarding the material scope of the GDPR is incorrect?
A. The GDPR applies to the processing of personal data wholly or partly by automated means.
B. The GDPR applies to the processing of personal data in the course of an activity that falls outside the scope of Union law.
C. The GDPR does not apply to the processing of personal data by Member States when carrying out activities that fall within the scope of the Treaty on European Union (TEU).
D. The GDPR applies to the processing of personal data by a company established in the EEA, even if the data subjects are located outside the EEA.

답을 확인하기

정답: B
Explanation:
The material scope of the GDPR is outlined in Article 2. It applies to the processing of personal data by automated means and to non-automated processing if the data is part of a filing system. The GDPR does not apply to activities outside the scope of Union law, such as national security activities, which are excluded under Recital 16.
Option B is correct because the GDPR does not apply to activities falling outside the scope of Union law, such as law enforcement operations covered by the Law Enforcement Directive (EU 2016/680).
Option A is incorrect because automated processing is explicitly covered by GDPR.
Option C is incorrect because data processing by Member States under TEU (e.g., national security and defense) is excluded.
Option D is incorrect because GDPR applies to controllers/processors established in the EEA, even if data subjects are outside the EEA (Article 3(1)).
Reference: GDPR Article 2(2)(a) (Exclusion of activities outside EU law)
GDPR Article 3(1) (Territorial scope)
Recital 16 (GDPR does not apply to national security)

Question No : 6

Scenario 5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Question:
Question:
According to scenario 5, what should Recpond have considered when assessing the risks related to processing operations?

• A.Risks should be identified based on threats and vulnerabilities that the company faces.
• B.Risks should be analyzed using a quantitative approach, since risk scenarios make the evaluation process difficult.
• C.Risks should be assessed based on the risk-based approach adopted by the DP
• D.Risks should be assessed only when a supervisory authority requires it.

답을 확인하기

정답:
Explanation:
Under Article 32 of GDPR, risk assessments should be based on threats, vulnerabilities, and potential impact on data subjects. Organizations must identify and mitigate risks to personal data security.
Option A is correct because risk identification should consider threats, vulnerabilities, and impact.
Option B is incorrect because risk can be assessed qualitatively or quantitatively, depending on the approach used.
Option C is incorrect because DPOs do not define an organization’s risk-based approach.
Option D is incorrect because risk assessment is mandatory under GDPR, not only when a supervisory authority requests it.
Reference: GDPR Article 32(1) (Risk-based approach to security)
Recital 83 (Risk assessment in data protection)

Question No : 7

Scenario 5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Question:
Question:
Based on scenario 5, Recpond established and communicated the data protection policy to all employees.
What should the DPO ensure in this regard?

• A.That all policies within Recpond are reviewed and updated by the DP
• B.That employee awareness on the data protection policy is monitored.
• C.That the updates of the data protection policy are communicated to all employees through an official letter.
• D.That the data protection policy is approved by the supervisory authority before implementation.

답을 확인하기

정답:
Explanation:
Under Article 39(1)(b) of GDPR, the DPO is responsible for raising awareness and training employees but does not draft or approve policies.
Option B is correct because DPOs must ensure employee awareness and training.
Option A is incorrect because DPOs do not have direct responsibility for updating policies.
Option C is incorrect because GDPR does not mandate policy updates via official letters.
Option D is incorrect because supervisory authorities do not approve internal data protection policies.
Reference: GDPR Article 39(1)(b) (DPO’s role in employee training and awareness)
Recital 97 (DPO’s responsibility for training)

Question No : 8

Scenario 5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Question:
Question:
According to scenario 5, the DPO decided to accept most of the identified risks related to data processing. Is this acceptable under GDPR?

• A.Yes, the cost required for implementing appropriate risk controls was higher than simply deciding to accept them.
• B.No, the DPO should have been involved in all risk management activities to select an appropriate risk treatment option.
• C.No, the DPO’s role in risk management is to help the company select a risk treatment option, not take final decisions on risk acceptance.
• D.Yes, but only if the DPO received explicit approval from the supervisory authority.

답을 확인하기

정답:
Explanation:
Under Article 39 of GDPR, the DPO’s role is to monitor and advise but not make risk acceptance decisions. Risk management is the responsibility of the controller.
Option C is correct because DPOs provide guidance on risk, but the organization decides risk treatment.
Option A is incorrect because risk acceptance is not a decision for the DPO.
Option B is incorrect because DPOs do not manage risk directly but provide recommendations.
Option D is incorrect because supervisory authorities do not approve risk acceptance decisions.
Reference: GDPR Article 39(1)(b) (DPO’s advisory role in risk management)
Recital 97 (DPO’s independence)

Question No : 9

Scenario 5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Question:
Question:
Based on scenario 5, the DPO reports directly to Recpond’s top management. Is this in alignment with GDPR requirements?

• A.Yes, Article 38 of the GDPR requires that the DPO reports directly to the highest management level of the controller.
• B.No, Article 38 of the GDPR requires that the DPO reports directly to the supervisory authority to ensure independence in performing their tasks.
• C.Yes, based on GDPR, the controller may choose any reporting structure for the DPO, including top and middle management.
• D.No, DPOs should report directly to department heads, not top management.

답을 확인하기

정답:
Explanation:
Under Article 38(3) of GDPR, the DPO must report directly to the highest level of management to ensure independence and avoid interference in their tasks.
Option A is correct because GDPR requires direct reporting to top management.
Option B is incorrect because the DPO does not report to the supervisory authority, but they can liaise with it.
Option C is incorrect because GDPR does not allow reporting to middle management.
Option D is incorrect because department heads cannot oversee the DPO’s work, ensuring they remain free from conflict of interest.
Reference: GDPR Article 38(3) (DPO must report to highest management)
Recital 97 (DPO’s independence and protection from undue influence)

Question No : 10

Scenario 5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Question:
Question:
Recpond stores files of candidates who are not selected in its databases, even if they withdraw consent. Is this acceptable under GDPR?

• A.No, the GDPR requires the controller to erase personal data if the data subject withdraws their consent for data processing.
• B.Yes, the GDPR only requires the controller to stop processing the data when consent is withdrawn but does not require its deletion.
• C.Yes, the GDPR allows personal data to be processed even after consent is withdrawn so organizations can use the data for future recruitment opportunities.
• D.No, Recpond must retain candidate data for statistical analysis but must anonymize it.

답을 확인하기

정답:
Explanation:
Under Article 17 of GDPR (Right to Erasure), data subjects have the right to request deletion of their personal data when consent is withdrawn, unless a legal obligation or legitimate interest requires retention.
Option A is correct because Recpond must erase personal data if consent is withdrawn and no other lawful basis exists.
Option B is incorrect because GDPR requires deletion, not just stopping processing.
Option C is incorrect because organizations cannot retain data for future purposes without an explicit legal basis.
Option D is incorrect because statistical use must involve anonymization, which is not mentioned in Recpond’s process.
Reference: GDPR Article 17(1)(b) (Right to be forgotten when consent is withdrawn)
Recital 65 (Obligation to erase personal data when processing is no longer necessary)

Question No : 11

Scenario 4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc’s and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Question:
Question:
Based on scenario 4, to which of the companies can data subjects exercise their rights under GDPR?

• A.Data subjects may exercise their rights against both Berc and Unty, regardless of the terms of the arrangement.
• B.Data subjects may exercise their rights against only one of the controllers, as specified in the arrangement.
• C.Data subjects may exercise their rights against Berc only because it decided to implement GDPR for data processing activities.
• D.None of the above.

답을 확인하기

정답:
Explanation:
Reference: GDPR Article 26(3) (Joint controllers must ensure data subjects can exercise their rights).

Question No : 12

Scenario 4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unity, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unity’s customers, were not aware that there was an arrangement between Berc and Unity and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc’s and Unity’s clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Question:
Question:
According to scenario 4, individuals from whom the health data was collected were not informed about the arrangement between Berc and Unty.
Which option below is correct?

• A.The arrangement and roles and responsibilities of Berc and Unty should be available to individuals.
• B.Berc and Unty have determined the purpose and means of processing, so they can decide if they want to inform individuals or not.
• C.The data processing means, purpose, or other arrangements between Berc and Unty are confidential and should not be disclosed to individuals.
• D.The supervisory authority should decide whether individuals need to be informed.

답을 확인하기

정답:
Explanation:
Under Article 13 of GDPR, data subjects must be informed about who processes their data, including joint controllers. This ensures transparency and accountability.
Option A is correct because individuals have the right to know who processes their data.
Option B is incorrect because controllers do not have the discretion to withhold this information.
Option C is incorrect because data processing arrangements must be transparent.
Option D is incorrect because organizations, not authorities, must ensure transparency.
Reference: GDPR Article 13(1)(a) (Identity of controllers must be disclosed)
Recital 60 (Transparency in processing)

Question No : 13

Scenario 4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc’s and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Question:
Question:
Based on scenario 4, Berc shared personal information of its clients with an international marketing company even though an adequacy decision was absent.
Which of the following is a valid reason to do so?

• A.The transfer of data does not depend on the adoption of an adequacy decision by the country where the company is located.
• B.Authorization for data transfer from Berc's Chief Information Security Officer (CISO) is obtained.
• C.The controller or processor provides appropriate safeguards for data protection.
• D.The marketing company’s reputation ensures compliance with data protection standards.

답을 확인하기

정답:
Explanation:
Under Article 46 of GDPR, in the absence of an adequacy decision, controllers can transfer data only if appropriate safeguards (e.g., Standard Contractual Clauses, Binding Corporate Rules) are in place.
Option C is correct because safeguards such as SCCs allow data transfers when no adequacy decision exists.
Option A is incorrect because adequacy decisions are a legal requirement, not optional.
Option B is incorrect because a CISO cannot authorize GDPR data transfers.
Option D is incorrect because reputation does not ensure GDPR compliance.
Reference: GDPR Article 46(1) (Appropriate safeguards for data transfers)
Recital 108 (Legally binding commitments for data protection)

Question No : 14

Scenario 4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required
the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc’s and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Question:
Question:
Based on scenario 4, Berc followed the DPO's advice for outsourcing an international marketing company in the absence of an adequacy decision. Is the DPO responsible for evaluating this case?

• A.Yes, the DPO should evaluate cases where an adequacy decision is absent.
• B.Yes, the DPO takes the final decision on transferring personal data to an international company in the absence of an adequacy decision.
• C.No, the controller or processor should evaluate cases when the adequacy decision is absent.
• D.No, because the marketing company operates under the same data protection rules as Berc.

답을 확인하기

정답:
Explanation:
Under Article 44 of GDPR, the controller (Berc) is responsible for ensuring lawful data transfers. The DPO advises on compliance but does not make final decisions on data transfers.
Option C is correct because the controller (Berc) must evaluate the legality of the transfer.
Option A is incorrect because DPOs provide advice but do not evaluate data transfer legality.
Option B is incorrect because DPOs do not have executive decision-making authority.
Option D is incorrect because data protection rules vary by jurisdiction, making this assumption incorrect.
Reference: GDPR Article 44 (General principle for transfers)
GDPR Article 39(1)(a) (DPO’s advisory role)

Question No : 15

Scenario 4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc’s and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Question:
Question:
Is the transfer of data from Berc to Unty in compliance with GDPR?

• A.Yes, Berc can transfer data to Unty because Switzerland provides a level of data protection that is "essentially equivalent” to that of the E
• B.Yes, Berc can transfer data to Unty because they collected data for the same purpose.
• C.No, Berc cannot transfer data to a company in Switzerland unless authorization from the supervisory authority in France is obtained.
• D.No, Berc must conduct a new DPIA before transferring data to Switzerland.

답을 확인하기

정답:
Explanation:
Under Article 45 of GDPR, data transfers to third countries are lawful if the European Commission has adopted an adequacy decision, meaning the country offers equivalent protection to GDPR. Switzerland has such an adequacy decision, making Berc’s transfer lawful.
Option A is correct because Switzerland meets GDPR adequacy standards.
Option B is incorrect because having the same purpose does not automatically make the transfer lawful.
Option C is incorrect because no supervisory authorization is needed when an adequacy decision exists.
Option D is incorrect because a DPIA is not required for a GDPR-compliant transfer.
Reference: GDPR Article 45(1) (Adequacy decisions for third countries)
European Commission Decision on Switzerland’s adequacy