PECB Certified Data Protection Officer : GDPR

Scenario:
Bankbiois a financial institution that handlespersonal dataof its customers. Itsdata processing activities involve processingthat is necessary for thelegitimate interestspursued by the institution. In such cases, Bankbio processes personal datawithout obtaining consent from data subjects.
Question:
Is the data processinglawful under GDPR?

• A. Yes, GDPR allows the processing of personal data for thelegitimate interest pursued by the controller or by a third party in all cases.
• B. No, the processing is lawfulonly if the data subject has given explicit consentto the processing of personal data for the specified purpose.
• C. No, financial institutionsmust always obtain explicit consentbefore processing personal data.
• D. Yes, processing is lawful when it is necessary for thelegitimate interestspursued by the controller, except where such interests are overridden by the interests of fundamental rights.

Scenario4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc's and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company.Based on this scenario, answer the following question:
Question:
Based on scenario 4, to which of the companies candata subjects exercise their rightsunder GDPR?

• A. None of the above.
• B. Data subjects may exercise their rights againstonly one of the controllers, as specified in the arrangement.
• C. Data subjects may exercise their rights againstboth Berc and Unty, regardless of the terms of the arrangement.
• D. Data subjects may exercise their rights againstBerc onlybecause it decided to implement GDPR for data processing activities.

Scenario 8:MA store is an online clothing retailer founded in 2010. They provide quality products at a reasonable cost. One thing that differentiates MA store from other online shopping sites is their excellent customer service.
MA store follows a customer-centered business approach. They have created a user-friendly website with well-organized content that is accessible to everyone. Through innovative ideas and services, MA store offers a seamless user experience for visitors while also attracting new customers. When visiting the website, customers can filter their search results by price, size, customer reviews, and other features. One of MA store's strategies for providing, personalizing, and improving its products is data analytics. MA store tracks and analyzes the user actions on its website so it can create customized experience for visitors.
In order to understand their target audience, MA store analyzes shopping preferences of its customers based on their purchase history. The purchase history includes the product that was bought, shipping updates, and payment details. Clients' personal data and other information related to MA store products included in the purchase history are stored in separate databases. Personal information, such as clients' address or payment details, are encrypted using a public key. When analyzing the shopping preferences of customers, employees access only the information about the product while the identity of customers is removed from the data set and replaced with a common value, ensuring that customer identities are protected and cannot be retrieved.
Last year, MA store announced that they suffered a personal data breach where personal data of clients were leaked. The personal data breach was caused by an SQL injection attack which targeted MA store's web application. The SQL injection was successful since no parameterized queries were used.
Based on this scenario, answer the following question:
Which de-identification method has MA store used when analyzing the shopping preferences of its customers?

• A. Differential privacy
• B. Generalizing data with k-anonymity
• C. Scrambling

Which of the statements below related to compliance monitoring is correct?

• A. The DPO should monitor and measure all activities of the organization in order to ensure the suitability and effectiveness of the GDPR compliance program
• B. The DPO should assign roles and responsibilities to monitor GDPR compliance
• C. The DPO should monitor internal compliance of the organization with applicable data protection laws

Question:
What is therole of the DPO in a DPIA?

• A. Conductthe DPI
• B. Approvethe DPIA and ensure all risks are eliminated.
• C. Recordthe DPIA outcomes.
• D. Determineif a DPIA is necessary.