GDPR for Employees Course (EU): The data protection principles

1. Frage 1 von 16

   Article 5(1) GDPR lists six principles. Which extra principle in Article 5(2) says the controller must be able to show it complies?

   • AProportionality
   • BTransparency
   • CAvailability
   • DAccountability
   Antwort anzeigen

   Antwort: D. Accountability

   Article 5(2) GDPR: the controller is responsible for, and must be able to demonstrate, compliance (accountability).

2. Frage 2 von 16

   What does the principle of data minimisation mean?

   • ADelete all personal data at the end of every single month
   • BSave personal data using the smallest possible file size
   • CCollect as much data as possible in case it is useful later
   • DUse only data that is adequate, relevant and necessary
   Antwort anzeigen

   Antwort: D. Use only data that is adequate, relevant and necessary

   Article 5(1)(c) GDPR: personal data must be adequate, relevant and limited to what is necessary for the purpose.

3. Frage 3 von 16

   What does the principle of purpose limitation mean?

   • AData is collected for clear purposes and not reused in incompatible ways
   • BData may be used for any purpose once the organisation has collected it
   • CData may only ever be used by the one department that collected it
   • DData may only be collected for the purpose of selling products or services
   Antwort anzeigen

   Antwort: A. Data is collected for clear purposes and not reused in incompatible ways

   Article 5(1)(b) GDPR: data is collected for specified, explicit and legitimate purposes and not further processed in an incompatible way.

4. Frage 4 von 16

   What does the principle of storage limitation mean?

   • AData must all be stored on a single server in the organisation
   • BData must be kept for at least ten years in every single case
   • CData must only ever be stored on servers inside the EU
   • DData that identifies people is kept only as long as needed
   Antwort anzeigen

   Antwort: D. Data that identifies people is kept only as long as needed

   Article 5(1)(e) GDPR: data must be kept in identifiable form no longer than necessary for its purposes.

5. Frage 5 von 16

   You notice that a customer's phone number in your system is wrong. Which principle says it should be corrected without delay?

   • AAccuracy
   • BStorage limitation
   • CPurpose limitation
   • DData minimisation
   Antwort anzeigen

   Antwort: A. Accuracy

   Article 5(1)(d) GDPR: data must be accurate and, where necessary, kept up to date; inaccurate data must be erased or corrected without delay.

6. Frage 6 von 16

   Which principle requires appropriate security, including protection against accidental loss or damage?

   • AFairness and transparency
   • BAccuracy and quality
   • CIntegrity and confidentiality
   • DPurpose and storage limitation
   Antwort anzeigen

   Antwort: C. Integrity and confidentiality

   Article 5(1)(f) GDPR requires appropriate security using technical or organisational measures (integrity and confidentiality).

7. Frage 7 von 16

   Which principle means people must be told clearly how their personal data will be used?

   • AStorage limitation
   • BTransparency
   • CIntegrity and confidentiality
   • DData minimisation
   Antwort anzeigen

   Antwort: B. Transparency

   Article 5(1)(a) GDPR: data must be processed lawfully, fairly and in a transparent manner.

8. Frage 8 von 16

   Who is responsible for being able to demonstrate compliance with the principles?

   • AEach data subject
   • BThe European Commission
   • CThe national authority
   • DThe controller
   Antwort anzeigen

   Antwort: D. The controller

   Under Article 5(2) GDPR, the controller is responsible for, and must be able to demonstrate, compliance.

9. Frage 9 von 16

   Which practice best supports the storage limitation principle?

   • AMaking extra backup copies of every old file you have
   • BSetting retention periods and a deletion procedure
   • CMoving old files to your own personal drive at home
   • DPrinting out old records before they are archived
   Antwort anzeigen

   Antwort: B. Setting retention periods and a deletion procedure

   The EDPB says storage limitation calls for retention periods and a procedure to delete or anonymise data that is no longer needed.

10. Frage 10 von 16

    Must an organisation's record of processing activities be made public?

    • ANo, but the data protection authority can ask to see it
    • BNo, there is no need to keep such a record
    • CYes, it must be published on the website
    • DYes, it must be sent to every employee
    Antwort anzeigen

    Antwort: A. No, but the data protection authority can ask to see it

    The EDPB explains that the record of processing does not have to be public, but it must be available to the data protection authority on request.

11. Frage 11 von 16

    Which of these is a technical measure that supports integrity and confidentiality?

    • AWriting a longer privacy notice for all customers
    • BAdding more fields to the customer sign-up form
    • CKeeping customer records for a longer period of time
    • DEncrypting laptops that hold personal data
    Antwort anzeigen

    Antwort: D. Encrypting laptops that hold personal data

    Article 32 GDPR names encryption and pseudonymisation as examples of security measures.

12. Frage 12 von 16

    Staff gave emergency contact numbers for use in emergencies. A manager wants to use them to invite families to a sales event. Which principle is most at risk?

    • AAccountability
    • BPurpose limitation
    • CData minimisation
    • DAccuracy
    Antwort anzeigen

    Antwort: B. Purpose limitation

    The numbers were collected for emergencies. Using them for marketing is a new purpose that is not compatible with the original one.

13. Frage 13 von 16

    An application form for an office job asks for the applicant's blood type. Which principle does this most clearly break?

    • AAccountability
    • BStorage limitation
    • CAccuracy
    • DData minimisation
    Antwort anzeigen

    Antwort: D. Data minimisation

    Blood type is not necessary to assess an office job application, so collecting it goes beyond what is necessary (and it is also health data).

14. Frage 14 von 16

    A team keeps CVs from unsuccessful applicants "forever, just in case". Which principle does this conflict with most?

    • APurpose limitation
    • BStorage limitation
    • CTransparency
    • DAccuracy
    Antwort anzeigen

    Antwort: B. Storage limitation

    Storage limitation means data is kept no longer than necessary. Keeping it forever with no reason breaks this principle.

15. Frage 15 von 16

    Read the memo. Letting every employee open a list of home addresses and salaries conflicts most directly with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CStorage limitation
    • DLawfulness, fairness and transparency
    Antwort anzeigen

    Antwort: A. Integrity and confidentiality

    Article 5(1)(f) GDPR requires protection against unauthorised access. Most staff do not need other people's addresses and salaries for their work.

16. Frage 16 von 16

    Read the memo. Keeping 15 years of old staff lists because "we might need them one day" conflicts most with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CLawfulness, fairness and transparency
    • DStorage limitation
    Antwort anzeigen

    Antwort: D. Storage limitation

    Data must not be kept longer than necessary. "Might need it one day" is not a reason to keep old lists.

Tastatur: 1–4 zum Antworten, Eingabetaste für die nächste Frage.