GDPR for Employees Course (EU): The data protection principles

1. Pregunta 1 de 16

   Article 5(1) GDPR lists six principles. Which extra principle in Article 5(2) says the controller must be able to show it complies?

   • AProportionality
   • BTransparency
   • CAvailability
   • DAccountability
   Ver respuesta

   Respuesta: D. Accountability

   Article 5(2) GDPR: the controller is responsible for, and must be able to demonstrate, compliance (accountability).

2. Pregunta 2 de 16

   What does the principle of data minimisation mean?

   • ADelete all personal data at the end of every single month
   • BSave personal data using the smallest possible file size
   • CCollect as much data as possible in case it is useful later
   • DUse only data that is adequate, relevant and necessary
   Ver respuesta

   Respuesta: D. Use only data that is adequate, relevant and necessary

   Article 5(1)(c) GDPR: personal data must be adequate, relevant and limited to what is necessary for the purpose.

3. Pregunta 3 de 16

   What does the principle of purpose limitation mean?

   • AData is collected for clear purposes and not reused in incompatible ways
   • BData may be used for any purpose once the organisation has collected it
   • CData may only ever be used by the one department that collected it
   • DData may only be collected for the purpose of selling products or services
   Ver respuesta

   Respuesta: A. Data is collected for clear purposes and not reused in incompatible ways

   Article 5(1)(b) GDPR: data is collected for specified, explicit and legitimate purposes and not further processed in an incompatible way.

4. Pregunta 4 de 16

   What does the principle of storage limitation mean?

   • AData must all be stored on a single server in the organisation
   • BData must be kept for at least ten years in every single case
   • CData must only ever be stored on servers inside the EU
   • DData that identifies people is kept only as long as needed
   Ver respuesta

   Respuesta: D. Data that identifies people is kept only as long as needed

   Article 5(1)(e) GDPR: data must be kept in identifiable form no longer than necessary for its purposes.

5. Pregunta 5 de 16

   You notice that a customer's phone number in your system is wrong. Which principle says it should be corrected without delay?

   • AAccuracy
   • BStorage limitation
   • CPurpose limitation
   • DData minimisation
   Ver respuesta

   Respuesta: A. Accuracy

   Article 5(1)(d) GDPR: data must be accurate and, where necessary, kept up to date; inaccurate data must be erased or corrected without delay.

6. Pregunta 6 de 16

   Which principle requires appropriate security, including protection against accidental loss or damage?

   • AFairness and transparency
   • BAccuracy and quality
   • CIntegrity and confidentiality
   • DPurpose and storage limitation
   Ver respuesta

   Respuesta: C. Integrity and confidentiality

   Article 5(1)(f) GDPR requires appropriate security using technical or organisational measures (integrity and confidentiality).

7. Pregunta 7 de 16

   Which principle means people must be told clearly how their personal data will be used?

   • AStorage limitation
   • BTransparency
   • CIntegrity and confidentiality
   • DData minimisation
   Ver respuesta

   Respuesta: B. Transparency

   Article 5(1)(a) GDPR: data must be processed lawfully, fairly and in a transparent manner.

8. Pregunta 8 de 16

   Who is responsible for being able to demonstrate compliance with the principles?

   • AEach data subject
   • BThe European Commission
   • CThe national authority
   • DThe controller
   Ver respuesta

   Respuesta: D. The controller

   Under Article 5(2) GDPR, the controller is responsible for, and must be able to demonstrate, compliance.

9. Pregunta 9 de 16

   Which practice best supports the storage limitation principle?

   • AMaking extra backup copies of every old file you have
   • BSetting retention periods and a deletion procedure
   • CMoving old files to your own personal drive at home
   • DPrinting out old records before they are archived
   Ver respuesta

   Respuesta: B. Setting retention periods and a deletion procedure

   The EDPB says storage limitation calls for retention periods and a procedure to delete or anonymise data that is no longer needed.

10. Pregunta 10 de 16

    Must an organisation's record of processing activities be made public?

    • ANo, but the data protection authority can ask to see it
    • BNo, there is no need to keep such a record
    • CYes, it must be published on the website
    • DYes, it must be sent to every employee
    Ver respuesta

    Respuesta: A. No, but the data protection authority can ask to see it

    The EDPB explains that the record of processing does not have to be public, but it must be available to the data protection authority on request.

11. Pregunta 11 de 16

    Which of these is a technical measure that supports integrity and confidentiality?

    • AWriting a longer privacy notice for all customers
    • BAdding more fields to the customer sign-up form
    • CKeeping customer records for a longer period of time
    • DEncrypting laptops that hold personal data
    Ver respuesta

    Respuesta: D. Encrypting laptops that hold personal data

    Article 32 GDPR names encryption and pseudonymisation as examples of security measures.

12. Pregunta 12 de 16

    Staff gave emergency contact numbers for use in emergencies. A manager wants to use them to invite families to a sales event. Which principle is most at risk?

    • AAccountability
    • BPurpose limitation
    • CData minimisation
    • DAccuracy
    Ver respuesta

    Respuesta: B. Purpose limitation

    The numbers were collected for emergencies. Using them for marketing is a new purpose that is not compatible with the original one.

13. Pregunta 13 de 16

    An application form for an office job asks for the applicant's blood type. Which principle does this most clearly break?

    • AAccountability
    • BStorage limitation
    • CAccuracy
    • DData minimisation
    Ver respuesta

    Respuesta: D. Data minimisation

    Blood type is not necessary to assess an office job application, so collecting it goes beyond what is necessary (and it is also health data).

14. Pregunta 14 de 16

    A team keeps CVs from unsuccessful applicants "forever, just in case". Which principle does this conflict with most?

    • APurpose limitation
    • BStorage limitation
    • CTransparency
    • DAccuracy
    Ver respuesta

    Respuesta: B. Storage limitation

    Storage limitation means data is kept no longer than necessary. Keeping it forever with no reason breaks this principle.

15. Pregunta 15 de 16

    Read the memo. Letting every employee open a list of home addresses and salaries conflicts most directly with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CStorage limitation
    • DLawfulness, fairness and transparency
    Ver respuesta

    Respuesta: A. Integrity and confidentiality

    Article 5(1)(f) GDPR requires protection against unauthorised access. Most staff do not need other people's addresses and salaries for their work.

16. Pregunta 16 de 16

    Read the memo. Keeping 15 years of old staff lists because "we might need them one day" conflicts most with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CLawfulness, fairness and transparency
    • DStorage limitation
    Ver respuesta

    Respuesta: D. Storage limitation

    Data must not be kept longer than necessary. "Might need it one day" is not a reason to keep old lists.

Teclado: 1–4 para responder, Intro para la siguiente pregunta.