GDPR for Employees Course (EU): Data subject rights

1. Vraag 1 van 17

   What does the right of access let a person do?

   • ASee the organisation's yearly financial accounts
   • BGet a copy of their own personal data
   • CVisit the organisation's offices and server room
   • DRead the personal data of any other customer
   Toon antwoord

   Antwoord: B. Get a copy of their own personal data

   Articles 15(1) and 15(3) GDPR: the person can get confirmation that their data is processed and a copy of it.

2. Vraag 2 van 17

   What does the right to rectification let a person do?

   • AHave all data about them deleted at once
   • BStop all direct marketing sent to them
   • CMove all their data to another company
   • DHave wrong data about them corrected
   Toon antwoord

   Antwoord: D. Have wrong data about them corrected

   Article 16 GDPR gives the right to have inaccurate personal data corrected without undue delay, and incomplete data completed.

3. Vraag 3 van 17

   The "right to be forgotten" is another name for which right?

   • AThe right to object
   • BThe right to restriction
   • CThe right of access
   • DThe right to erasure
   Toon antwoord

   Antwoord: D. The right to erasure

   Article 17 GDPR, the right to erasure, is also called the right to be forgotten.

4. Vraag 4 van 17

   Within what time must an organisation normally respond to a data subject's request?

   • AWithin one year of receiving the request
   • BWithin ten working days of receiving the request
   • CWithin one month of receiving it
   • DWithin 72 hours of receiving the request
   Toon antwoord

   Antwoord: C. Within one month of receiving it

   Article 12(3) GDPR: information on action taken must be given without undue delay and in any event within one month of receipt.

5. Vraag 5 van 17

   When can the response time for a request be extended, and by how much?

   • ABy six months, but only if the person agrees to it by phone
   • BBy two more months for complex requests, telling the person in time
   • CBy one more year whenever the organisation is busy, telling no one
   • DBy 72 hours whenever the request arrives at the weekend
   Toon antwoord

   Antwoord: B. By two more months for complex requests, telling the person in time

   Article 12(3) GDPR allows an extension of two further months where necessary. The person must be told, with reasons, within the first month.

6. Vraag 6 van 17

   Can an organisation normally charge a fee to give a person a copy of their data?

   • ANo, it is normally free, with limited exceptions
   • BYes, it can charge whatever the copy costs
   • CYes, the GDPR sets a fixed fee of 50 euro
   • DYes, but only for requests sent by email
   Toon antwoord

   Antwoord: A. No, it is normally free, with limited exceptions

   Information and copies are generally free. A reasonable fee is only possible for manifestly unfounded or excessive requests, or for extra copies.

7. Vraag 7 van 17

   A customer objects to their data being used for direct marketing. What must happen?

   • AAsk the customer to pay an administration fee first
   • BWait one full year before stopping the marketing
   • CStop using their data for direct marketing
   • DCarry on, if the company has a legitimate interest
   Toon antwoord

   Antwoord: C. Stop using their data for direct marketing

   Article 21(3) GDPR: when a person objects to direct marketing, their data must no longer be processed for that purpose.

8. Vraag 8 van 17

   Under the right to data portability, in what form should a person receive their data?

   • AStructured, commonly used and machine-readable
   • BPrinted paper copies sent to them by registered post
   • CA handwritten summary signed by a senior manager
   • DA photo of the computer screen taken on a mobile phone
   Toon antwoord

   Antwoord: A. Structured, commonly used and machine-readable

   Article 20(1) GDPR: the data is provided in a structured, commonly used and machine-readable format.

9. Vraag 9 van 17

   What does the right to restriction of processing mean in practice?

   • AThe data is kept but not otherwise used for a time
   • BThe organisation must send the data to the authority to check
   • CThe organisation must stop collecting any data from anyone
   • DThe organisation must delete all the data within 24 hours
   Toon antwoord

   Antwoord: A. The data is kept but not otherwise used for a time

   With restriction, data can be stored but not otherwise used, for example while a dispute about accuracy is checked.

10. Vraag 10 van 17

    Which right protects people from decisions made only by a computer that have legal or similarly significant effects?

    • AThe right not to be subject to automated decisions
    • BThe right to have inaccurate data rectified
    • CThe right to receive data in a portable format
    • DThe right to have processing restricted for a time
    Toon antwoord

    Antwoord: A. The right not to be subject to automated decisions

    Article 22(1) GDPR gives the right not to be subject to a decision based solely on automated processing, including profiling, with such effects.

11. Vraag 11 van 17

    Is the right to erasure absolute?

    • ANo, it can be refused in some cases, such as a legal duty to keep data
    • BYes, but it only applies to customers
    • CYes, data must always be deleted at once
    • DNo, it only applies to data on paper
    Toon antwoord

    Antwoord: A. No, it can be refused in some cases, such as a legal duty to keep data

    The EDPB explains that erasure can be refused in limited cases, such as when the law requires the data to be kept or for legal claims.

12. Vraag 12 van 17

    If an organisation refuses a request, what must it tell the person?

    • AThe reasons, and that they can complain to an authority
    • BOnly the name of the member of staff who refused it
    • CNothing, because a refusal does not need any explanation
    • DOnly that they may try the request again in twelve months
    Toon antwoord

    Antwoord: A. The reasons, and that they can complain to an authority

    The person must be told the reasons within one month, and that they can complain to a data protection authority and seek a judicial remedy.

13. Vraag 13 van 17

    You work in customer service and a customer asks you for a copy of all the data your company holds on them. What should you do?

    • ASearch all the systems yourself and email what you find
    • BPass it at once to the right person under your procedure
    • CIgnore it unless it arrives on an official request form
    • DWait to see whether the customer asks a second time
    Toon antwoord

    Antwoord: B. Pass it at once to the right person under your procedure

    The one-month time limit runs from when the organisation receives the request, so it must reach the people who handle requests straight away.

14. Vraag 14 van 17

    In which situation must an organisation appoint a data protection officer (DPO)?

    • AIf it is a public authority or systematically monitors people on a large scale
    • BNever, because a DPO is always optional
    • COnly if the authority sends it a letter
    • DOnly if it has more than 1,000 employees
    Toon antwoord

    Antwoord: A. If it is a public authority or systematically monitors people on a large scale

    A DPO is required for public authorities, for large-scale regular and systematic monitoring, or for large-scale processing of sensitive or criminal data.

15. Vraag 15 van 17

    Read Jonas's email. Which right is he using when he asks for a copy of his information?

    From: Jonas Weber <jonas.w.private@example.com>
    To: service@greenleaf-energy.example.com
    Subject: My data

    Hello,

    Please send me a copy of all the personal information you hold about me. Also, please stop sending me your special offers by email.

    My customer number is 55120. My account is registered to jweber@example.net.

    Jonas Weber

    • AThe right of access
    • BThe right to rectification
    • CThe right to data portability
    • DThe right to restriction
    Toon antwoord

    Antwoord: A. The right of access

    Asking for confirmation and a copy of one's personal data is the right of access in Article 15 GDPR.

16. Vraag 16 van 17

    Read Jonas's email. It comes from a different email address than the one on his account. What may the company do?

    From: Jonas Weber <jonas.w.private@example.com>
    To: service@greenleaf-energy.example.com
    Subject: My data

    Hello,

    Please send me a copy of all the personal information you hold about me. Also, please stop sending me your special offers by email.

    My customer number is 55120. My account is registered to jweber@example.net.

    Jonas Weber

    • ARefuse the request because it uses the wrong format
    • BCharge Jonas a fee before it reads the request
    • CSend the copy to the new address without checking
    • DAsk for more information to confirm it is him
    Toon antwoord

    Antwoord: D. Ask for more information to confirm it is him

    If there are reasonable doubts about identity, the controller may ask for more information. The EDPB gives a request from an unusual email address as an example.

17. Vraag 17 van 17

    Read Jonas's email. What must the company do about the special offers?

    From: Jonas Weber <jonas.w.private@example.com>
    To: service@greenleaf-energy.example.com
    Subject: My data

    Hello,

    Please send me a copy of all the personal information you hold about me. Also, please stop sending me your special offers by email.

    My customer number is 55120. My account is registered to jweber@example.net.

    Jonas Weber

    • AAsk him to explain why he objects
    • BDelete his whole customer account at once
    • CKeep sending offers until the request is done
    • DStop using his data to send him direct marketing
    Toon antwoord

    Antwoord: D. Stop using his data to send him direct marketing

    An objection to direct marketing must lead to an end to that processing. It does not require deleting the whole account.

Toetsenbord: 1–4 om te antwoorden, Enter voor de volgende vraag.