GDPR for Employees Course (EU): Lawful bases and consent

1. Vraag 1 van 16

   How many lawful bases for processing are listed in Article 6(1) GDPR?

   • AFour
   • BThree
   • CEight
   • DSix
   Toon antwoord

   Antwoord: D. Six

   Article 6(1) lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests.

2. Vraag 2 van 16

   When is processing of personal data lawful under Article 6?

   • AOnly when the authority has approved it in advance
   • BOnly when the person has signed a consent form
   • CWhen at least one lawful basis applies
   • DOnly when the data is stored inside the EU
   Toon antwoord

   Antwoord: C. When at least one lawful basis applies

   Article 6(1) GDPR: processing is lawful only if and to the extent that at least one lawful basis applies.

3. Vraag 3 van 16

   An employer passes salary details to the social security authorities because national law requires it. Which lawful basis applies?

   • ALegitimate interests
   • BVital interests
   • CLegal obligation
   • DConsent
   Toon antwoord

   Antwoord: C. Legal obligation

   The EDPB gives employers processing data for social security as an example of a legal obligation.

4. Vraag 4 van 16

   An online shop uses a customer's address to deliver the item they ordered. Which lawful basis fits best?

   • AVital interests
   • BLegal obligation
   • CContract
   • DPublic task
   Toon antwoord

   Antwoord: C. Contract

   Processing that is necessary to perform a contract with the person falls under Article 6(1)(b).

5. Vraag 5 van 16

   A guide gives the hospital details about an injured customer who is unconscious. Which lawful basis applies?

   • AContract
   • BConsent
   • CLegitimate interests
   • DVital interests
   Toon antwoord

   Antwoord: D. Vital interests

   Vital interests covers emergencies, such as protecting someone's life when they cannot answer for themselves.

6. Vraag 6 van 16

   Under the GDPR, what must consent be?

   • AIn writing, signed by hand and witnessed by a manager
   • BGiven once only and then valid for the person's lifetime
   • CFreely given, specific, informed and unambiguous
   • DRecorded by phone and the recording stored for ten years
   Toon antwoord

   Antwoord: C. Freely given, specific, informed and unambiguous

   Article 4(11) GDPR defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes.

7. Vraag 7 van 16

   On a sign-up form, which of these is valid consent?

   • AThe person does not reply to an email that asked for their consent
   • BThe person keeps using the website without reading the information
   • CThe person ticks an empty box after reading clear information
   • DThe person leaves alone a box that was already ticked for them
   Toon antwoord

   Antwoord: C. The person ticks an empty box after reading clear information

   Consent needs a clear affirmative action. The GDPR recitals say silence, pre-ticked boxes and inactivity are not consent.

8. Vraag 8 van 16

   When can a person withdraw their consent?

   • AAt any time, as easily as they gave it
   • BOnly after twelve months
   • COnly by signed letter
   • DOnly with the authority's permission
   Toon antwoord

   Antwoord: A. At any time, as easily as they gave it

   Article 7(3) GDPR gives the right to withdraw consent at any time. The EDPB says withdrawing must be as easy as giving consent.

9. Vraag 9 van 16

   Why is consent usually not the right lawful basis for an employer to process staff data?

   • AStaff consent is only valid if a trade union representative signs it
   • BStaff may feel unable to refuse, so it is not freely given
   • CConsent given by members of staff always expires after one month
   • DEmployers are not allowed to process any data about their staff
   Toon antwoord

   Antwoord: B. Staff may feel unable to refuse, so it is not freely given

   The EDPB explains that employees may feel unable to refuse their employer's request, so their consent is usually not freely given.

10. Vraag 10 van 16

    Before relying on legitimate interests, what must an organisation do?

    • APublish the data so that everyone is able to see it
    • BWeigh its interest against the people's rights
    • CGet written consent from every person whose data it uses
    • DAsk the data protection authority to issue it a licence
    Toon antwoord

    Antwoord: B. Weigh its interest against the people's rights

    Legitimate interests can be overridden by people's interests or rights, so a balancing test is needed that also considers what people can reasonably expect.

11. Vraag 11 van 16

    An online bookshop wants to use customers' past purchases to recommend new books. Can it rely on the contract basis?

    • AYes, any use of customer data is covered by the contract
    • BNo, because purchase history is special category data
    • CYes, because the customer has already paid for a book
    • DNo, this is not necessary to perform the sale
    Toon antwoord

    Antwoord: D. No, this is not necessary to perform the sale

    The EDPB says the contract basis covers only what is necessary for the contract. Recommendations need consent or possibly legitimate interests.

12. Vraag 12 van 16

    For online services offered directly to children, what is the lowest age an EU country may set for a child to give consent alone?

    • A14
    • B13
    • C16
    • D12
    Toon antwoord

    Antwoord: B. 13

    The GDPR default is 16, but Member States may set a lower age by law, not below 13. Check the national rule.

13. Vraag 13 van 16

    To process special category data, such as health data, what does an organisation need?

    • AOnly a short note in the privacy notice
    • BAn Article 6 lawful basis plus an Article 9 condition
    • COnly one of the lawful bases listed in Article 6
    • DOnly written approval from a senior manager
    Toon antwoord

    Antwoord: B. An Article 6 lawful basis plus an Article 9 condition

    The EDPB checklist says to identify an Article 6 lawful basis and confirm that an additional Article 9 condition applies.

14. Vraag 14 van 16

    Which of these is one of the conditions in Article 9 that can allow special category data to be processed?

    • AExplicit consent from the person
    • BThe data was only sent in an internal email
    • CThe data is useful for future business planning
    • DThe person did not object within one week
    Toon antwoord

    Antwoord: A. Explicit consent from the person

    Explicit consent is one of the Article 9 conditions. Others include employment and social security obligations and occupational medicine.

15. Vraag 15 van 16

    Read Ana's message. What is the main problem with how she plans to get consent?

    Message from Ana, team manager, to her team:

    "Hi all, I'd like to put everyone's photo and date of birth on the intranet so we can celebrate birthdays. Please reply by Friday if you do NOT agree. If I don't hear from you, I'll take that as a yes. Thanks, Ana"

    • ANot replying is not consent; staff must actively agree
    • BConsent must be given in front of a witness
    • COnly the authority may ask staff for consent
    • DBirthdays are special category data
    Toon antwoord

    Antwoord: A. Not replying is not consent; staff must actively agree

    Silence, pre-ticked boxes and inactivity are not consent. People must actively agree with a clear positive action.

16. Vraag 16 van 16

    Read Ana's message. Why might consent from her team not be freely given even if they reply "yes"?

    Message from Ana, team manager, to her team:

    "Hi all, I'd like to put everyone's photo and date of birth on the intranet so we can celebrate birthdays. Please reply by Friday if you do NOT agree. If I don't hear from you, I'll take that as a yes. Thanks, Ana"

    • AConsent sent by email is never valid under the GDPR
    • BConsent is only valid if the DPO collects it in person
    • CStaff photos can only be used if a court allows it
    • DStaff may feel they cannot say no to their manager
    Toon antwoord

    Antwoord: D. Staff may feel they cannot say no to their manager

    Because of the imbalance of power at work, staff may feel unable to refuse, so consent may not be freely given. Refusing must have no negative consequences.

Toetsenbord: 1–4 om te antwoorden, Enter voor de volgende vraag.