GDPR for Employees Course (EU)：The data protection principles

1. 第1题，共16题

   Article 5(1) GDPR lists six principles. Which extra principle in Article 5(2) says the controller must be able to show it complies?

   • AProportionality
   • BTransparency
   • CAvailability
   • DAccountability
   显示答案

   答案: D. Accountability

   Article 5(2) GDPR: the controller is responsible for, and must be able to demonstrate, compliance (accountability).

2. 第2题，共16题

   What does the principle of data minimisation mean?

   • ADelete all personal data at the end of every single month
   • BSave personal data using the smallest possible file size
   • CCollect as much data as possible in case it is useful later
   • DUse only data that is adequate, relevant and necessary
   显示答案

   答案: D. Use only data that is adequate, relevant and necessary

   Article 5(1)(c) GDPR: personal data must be adequate, relevant and limited to what is necessary for the purpose.

3. 第3题，共16题

   What does the principle of purpose limitation mean?

   • AData is collected for clear purposes and not reused in incompatible ways
   • BData may be used for any purpose once the organisation has collected it
   • CData may only ever be used by the one department that collected it
   • DData may only be collected for the purpose of selling products or services
   显示答案

   答案: A. Data is collected for clear purposes and not reused in incompatible ways

   Article 5(1)(b) GDPR: data is collected for specified, explicit and legitimate purposes and not further processed in an incompatible way.

4. 第4题，共16题

   What does the principle of storage limitation mean?

   • AData must all be stored on a single server in the organisation
   • BData must be kept for at least ten years in every single case
   • CData must only ever be stored on servers inside the EU
   • DData that identifies people is kept only as long as needed
   显示答案

   答案: D. Data that identifies people is kept only as long as needed

   Article 5(1)(e) GDPR: data must be kept in identifiable form no longer than necessary for its purposes.

5. 第5题，共16题

   You notice that a customer's phone number in your system is wrong. Which principle says it should be corrected without delay?

   • AAccuracy
   • BStorage limitation
   • CPurpose limitation
   • DData minimisation
   显示答案

   答案: A. Accuracy

   Article 5(1)(d) GDPR: data must be accurate and, where necessary, kept up to date; inaccurate data must be erased or corrected without delay.

6. 第6题，共16题

   Which principle requires appropriate security, including protection against accidental loss or damage?

   • AFairness and transparency
   • BAccuracy and quality
   • CIntegrity and confidentiality
   • DPurpose and storage limitation
   显示答案

   答案: C. Integrity and confidentiality

   Article 5(1)(f) GDPR requires appropriate security using technical or organisational measures (integrity and confidentiality).

7. 第7题，共16题

   Which principle means people must be told clearly how their personal data will be used?

   • AStorage limitation
   • BTransparency
   • CIntegrity and confidentiality
   • DData minimisation
   显示答案

   答案: B. Transparency

   Article 5(1)(a) GDPR: data must be processed lawfully, fairly and in a transparent manner.

8. 第8题，共16题

   Who is responsible for being able to demonstrate compliance with the principles?

   • AEach data subject
   • BThe European Commission
   • CThe national authority
   • DThe controller
   显示答案

   答案: D. The controller

   Under Article 5(2) GDPR, the controller is responsible for, and must be able to demonstrate, compliance.

9. 第9题，共16题

   Which practice best supports the storage limitation principle?

   • AMaking extra backup copies of every old file you have
   • BSetting retention periods and a deletion procedure
   • CMoving old files to your own personal drive at home
   • DPrinting out old records before they are archived
   显示答案

   答案: B. Setting retention periods and a deletion procedure

   The EDPB says storage limitation calls for retention periods and a procedure to delete or anonymise data that is no longer needed.

10. 第10题，共16题

    Must an organisation's record of processing activities be made public?

    • ANo, but the data protection authority can ask to see it
    • BNo, there is no need to keep such a record
    • CYes, it must be published on the website
    • DYes, it must be sent to every employee
    显示答案

    答案: A. No, but the data protection authority can ask to see it

    The EDPB explains that the record of processing does not have to be public, but it must be available to the data protection authority on request.

11. 第11题，共16题

    Which of these is a technical measure that supports integrity and confidentiality?

    • AWriting a longer privacy notice for all customers
    • BAdding more fields to the customer sign-up form
    • CKeeping customer records for a longer period of time
    • DEncrypting laptops that hold personal data
    显示答案

    答案: D. Encrypting laptops that hold personal data

    Article 32 GDPR names encryption and pseudonymisation as examples of security measures.

12. 第12题，共16题

    Staff gave emergency contact numbers for use in emergencies. A manager wants to use them to invite families to a sales event. Which principle is most at risk?

    • AAccountability
    • BPurpose limitation
    • CData minimisation
    • DAccuracy
    显示答案

    答案: B. Purpose limitation

    The numbers were collected for emergencies. Using them for marketing is a new purpose that is not compatible with the original one.

13. 第13题，共16题

    An application form for an office job asks for the applicant's blood type. Which principle does this most clearly break?

    • AAccountability
    • BStorage limitation
    • CAccuracy
    • DData minimisation
    显示答案

    答案: D. Data minimisation

    Blood type is not necessary to assess an office job application, so collecting it goes beyond what is necessary (and it is also health data).

14. 第14题，共16题

    A team keeps CVs from unsuccessful applicants "forever, just in case". Which principle does this conflict with most?

    • APurpose limitation
    • BStorage limitation
    • CTransparency
    • DAccuracy
    显示答案

    答案: B. Storage limitation

    Storage limitation means data is kept no longer than necessary. Keeping it forever with no reason breaks this principle.

15. 第15题，共16题

    Read the memo. Letting every employee open a list of home addresses and salaries conflicts most directly with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CStorage limitation
    • DLawfulness, fairness and transparency
    显示答案

    答案: A. Integrity and confidentiality

    Article 5(1)(f) GDPR requires protection against unauthorised access. Most staff do not need other people's addresses and salaries for their work.

16. 第16题，共16题

    Read the memo. Keeping 15 years of old staff lists because "we might need them one day" conflicts most with which principle?

    Memo from Tomas (HR) to all staff:

    "To save time, I have put a copy of the full staff list in the shared folder that every employee can open. It includes home addresses, dates of birth and salaries. I have also moved the old staff lists from the last 15 years into the same folder, because we might need them one day."

    • AIntegrity and confidentiality
    • BAccuracy
    • CLawfulness, fairness and transparency
    • DStorage limitation
    显示答案

    答案: D. Storage limitation

    Data must not be kept longer than necessary. "Might need it one day" is not a reason to keep old lists.

键盘：按1–4作答，按 Enter 进入下一题。