GDPR for Employees Course (EU): Lawful bases and consent

1. Question 1 of 16

   How many lawful bases for processing are listed in Article 6(1) GDPR?

   • AFour
   • BThree
   • CEight
   • DSix
   Show answer

   Answer: D. Six

   Article 6(1) lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests.

2. Question 2 of 16

   When is processing of personal data lawful under Article 6?

   • AOnly when the authority has approved it in advance
   • BOnly when the person has signed a consent form
   • CWhen at least one lawful basis applies
   • DOnly when the data is stored inside the EU
   Show answer

   Answer: C. When at least one lawful basis applies

   Article 6(1) GDPR: processing is lawful only if and to the extent that at least one lawful basis applies.

3. Question 3 of 16

   An employer passes salary details to the social security authorities because national law requires it. Which lawful basis applies?

   • ALegitimate interests
   • BVital interests
   • CLegal obligation
   • DConsent
   Show answer

   Answer: C. Legal obligation

   The EDPB gives employers processing data for social security as an example of a legal obligation.

4. Question 4 of 16

   An online shop uses a customer's address to deliver the item they ordered. Which lawful basis fits best?

   • AVital interests
   • BLegal obligation
   • CContract
   • DPublic task
   Show answer

   Answer: C. Contract

   Processing that is necessary to perform a contract with the person falls under Article 6(1)(b).

5. Question 5 of 16

   A guide gives the hospital details about an injured customer who is unconscious. Which lawful basis applies?

   • AContract
   • BConsent
   • CLegitimate interests
   • DVital interests
   Show answer

   Answer: D. Vital interests

   Vital interests covers emergencies, such as protecting someone's life when they cannot answer for themselves.

6. Question 6 of 16

   Under the GDPR, what must consent be?

   • AIn writing, signed by hand and witnessed by a manager
   • BGiven once only and then valid for the person's lifetime
   • CFreely given, specific, informed and unambiguous
   • DRecorded by phone and the recording stored for ten years
   Show answer

   Answer: C. Freely given, specific, informed and unambiguous

   Article 4(11) GDPR defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes.

7. Question 7 of 16

   On a sign-up form, which of these is valid consent?

   • AThe person does not reply to an email that asked for their consent
   • BThe person keeps using the website without reading the information
   • CThe person ticks an empty box after reading clear information
   • DThe person leaves alone a box that was already ticked for them
   Show answer

   Answer: C. The person ticks an empty box after reading clear information

   Consent needs a clear affirmative action. The GDPR recitals say silence, pre-ticked boxes and inactivity are not consent.

8. Question 8 of 16

   When can a person withdraw their consent?

   • AAt any time, as easily as they gave it
   • BOnly after twelve months
   • COnly by signed letter
   • DOnly with the authority's permission
   Show answer

   Answer: A. At any time, as easily as they gave it

   Article 7(3) GDPR gives the right to withdraw consent at any time. The EDPB says withdrawing must be as easy as giving consent.

9. Question 9 of 16

   Why is consent usually not the right lawful basis for an employer to process staff data?

   • AStaff consent is only valid if a trade union representative signs it
   • BStaff may feel unable to refuse, so it is not freely given
   • CConsent given by members of staff always expires after one month
   • DEmployers are not allowed to process any data about their staff
   Show answer

   Answer: B. Staff may feel unable to refuse, so it is not freely given

   The EDPB explains that employees may feel unable to refuse their employer's request, so their consent is usually not freely given.

10. Question 10 of 16

    Before relying on legitimate interests, what must an organisation do?

    • APublish the data so that everyone is able to see it
    • BWeigh its interest against the people's rights
    • CGet written consent from every person whose data it uses
    • DAsk the data protection authority to issue it a licence
    Show answer

    Answer: B. Weigh its interest against the people's rights

    Legitimate interests can be overridden by people's interests or rights, so a balancing test is needed that also considers what people can reasonably expect.

11. Question 11 of 16

    An online bookshop wants to use customers' past purchases to recommend new books. Can it rely on the contract basis?

    • AYes, any use of customer data is covered by the contract
    • BNo, because purchase history is special category data
    • CYes, because the customer has already paid for a book
    • DNo, this is not necessary to perform the sale
    Show answer

    Answer: D. No, this is not necessary to perform the sale

    The EDPB says the contract basis covers only what is necessary for the contract. Recommendations need consent or possibly legitimate interests.

12. Question 12 of 16

    For online services offered directly to children, what is the lowest age an EU country may set for a child to give consent alone?

    • A14
    • B13
    • C16
    • D12
    Show answer

    Answer: B. 13

    The GDPR default is 16, but Member States may set a lower age by law, not below 13. Check the national rule.

13. Question 13 of 16

    To process special category data, such as health data, what does an organisation need?

    • AOnly a short note in the privacy notice
    • BAn Article 6 lawful basis plus an Article 9 condition
    • COnly one of the lawful bases listed in Article 6
    • DOnly written approval from a senior manager
    Show answer

    Answer: B. An Article 6 lawful basis plus an Article 9 condition

    The EDPB checklist says to identify an Article 6 lawful basis and confirm that an additional Article 9 condition applies.

14. Question 14 of 16

    Which of these is one of the conditions in Article 9 that can allow special category data to be processed?

    • AExplicit consent from the person
    • BThe data was only sent in an internal email
    • CThe data is useful for future business planning
    • DThe person did not object within one week
    Show answer

    Answer: A. Explicit consent from the person

    Explicit consent is one of the Article 9 conditions. Others include employment and social security obligations and occupational medicine.

15. Question 15 of 16

    Read Ana's message. What is the main problem with how she plans to get consent?

    Message from Ana, team manager, to her team:

    "Hi all, I'd like to put everyone's photo and date of birth on the intranet so we can celebrate birthdays. Please reply by Friday if you do NOT agree. If I don't hear from you, I'll take that as a yes. Thanks, Ana"

    • ANot replying is not consent; staff must actively agree
    • BConsent must be given in front of a witness
    • COnly the authority may ask staff for consent
    • DBirthdays are special category data
    Show answer

    Answer: A. Not replying is not consent; staff must actively agree

    Silence, pre-ticked boxes and inactivity are not consent. People must actively agree with a clear positive action.

16. Question 16 of 16

    Read Ana's message. Why might consent from her team not be freely given even if they reply "yes"?

    Message from Ana, team manager, to her team:

    "Hi all, I'd like to put everyone's photo and date of birth on the intranet so we can celebrate birthdays. Please reply by Friday if you do NOT agree. If I don't hear from you, I'll take that as a yes. Thanks, Ana"

    • AConsent sent by email is never valid under the GDPR
    • BConsent is only valid if the DPO collects it in person
    • CStaff photos can only be used if a court allows it
    • DStaff may feel they cannot say no to their manager
    Show answer

    Answer: D. Staff may feel they cannot say no to their manager

    Because of the imbalance of power at work, staff may feel unable to refuse, so consent may not be freely given. Refusing must have no negative consequences.

Keyboard: 1–4 to answer, Enter for the next question.