GDPR for Employees Course (EU)：Lawful bases and consent

1. 第1题，共16题

   How many lawful bases for processing are listed in Article 6(1) GDPR?

   • AFour
   • BThree
   • CEight
   • DSix
   显示答案

   答案: D. Six

   Article 6(1) lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests.

2. 第2题，共16题

   When is processing of personal data lawful under Article 6?

   • AOnly when the authority has approved it in advance
   • BOnly when the person has signed a consent form
   • CWhen at least one lawful basis applies
   • DOnly when the data is stored inside the EU
   显示答案

   答案: C. When at least one lawful basis applies

   Article 6(1) GDPR: processing is lawful only if and to the extent that at least one lawful basis applies.

3. 第3题，共16题

   An employer passes salary details to the social security authorities because national law requires it. Which lawful basis applies?

   • ALegitimate interests
   • BVital interests
   • CLegal obligation
   • DConsent
   显示答案

   答案: C. Legal obligation

   The EDPB gives employers processing data for social security as an example of a legal obligation.

4. 第4题，共16题

   An online shop uses a customer's address to deliver the item they ordered. Which lawful basis fits best?

   • AVital interests
   • BLegal obligation
   • CContract
   • DPublic task
   显示答案

   答案: C. Contract

   Processing that is necessary to perform a contract with the person falls under Article 6(1)(b).

5. 第5题，共16题

   A guide gives the hospital details about an injured customer who is unconscious. Which lawful basis applies?

   • AContract
   • BConsent
   • CLegitimate interests
   • DVital interests
   显示答案

   答案: D. Vital interests

   Vital interests covers emergencies, such as protecting someone's life when they cannot answer for themselves.

6. 第6题，共16题

   Under the GDPR, what must consent be?

   • AIn writing, signed by hand and witnessed by a manager
   • BGiven once only and then valid for the person's lifetime
   • CFreely given, specific, informed and unambiguous
   • DRecorded by phone and the recording stored for ten years
   显示答案

   答案: C. Freely given, specific, informed and unambiguous

   Article 4(11) GDPR defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes.

7. 第7题，共16题

   On a sign-up form, which of these is valid consent?

   • AThe person does not reply to an email that asked for their consent
   • BThe person keeps using the website without reading the information
   • CThe person ticks an empty box after reading clear information
   • DThe person leaves alone a box that was already ticked for them
   显示答案

   答案: C. The person ticks an empty box after reading clear information

   Consent needs a clear affirmative action. The GDPR recitals say silence, pre-ticked boxes and inactivity are not consent.

8. 第8题，共16题

   When can a person withdraw their consent?

   • AAt any time, as easily as they gave it
   • BOnly after twelve months
   • COnly by signed letter
   • DOnly with the authority's permission
   显示答案

   答案: A. At any time, as easily as they gave it

   Article 7(3) GDPR gives the right to withdraw consent at any time. The EDPB says withdrawing must be as easy as giving consent.

9. 第9题，共16题

   Why is consent usually not the right lawful basis for an employer to process staff data?

   • AStaff consent is only valid if a trade union representative signs it
   • BStaff may feel unable to refuse, so it is not freely given
   • CConsent given by members of staff always expires after one month
   • DEmployers are not allowed to process any data about their staff
   显示答案

   答案: B. Staff may feel unable to refuse, so it is not freely given

   The EDPB explains that employees may feel unable to refuse their employer's request, so their consent is usually not freely given.

10. 第10题，共16题

    Before relying on legitimate interests, what must an organisation do?

    • APublish the data so that everyone is able to see it
    • BWeigh its interest against the people's rights
    • CGet written consent from every person whose data it uses
    • DAsk the data protection authority to issue it a licence
    显示答案

    答案: B. Weigh its interest against the people's rights

    Legitimate interests can be overridden by people's interests or rights, so a balancing test is needed that also considers what people can reasonably expect.

11. 第11题，共16题

    An online bookshop wants to use customers' past purchases to recommend new books. Can it rely on the contract basis?

    • AYes, any use of customer data is covered by the contract
    • BNo, because purchase history is special category data
    • CYes, because the customer has already paid for a book
    • DNo, this is not necessary to perform the sale
    显示答案

    答案: D. No, this is not necessary to perform the sale

    The EDPB says the contract basis covers only what is necessary for the contract. Recommendations need consent or possibly legitimate interests.

12. 第12题，共16题

    For online services offered directly to children, what is the lowest age an EU country may set for a child to give consent alone?

    • A14
    • B13
    • C16
    • D12
    显示答案

    答案: B. 13

    The GDPR default is 16, but Member States may set a lower age by law, not below 13. Check the national rule.

13. 第13题，共16题

    To process special category data, such as health data, what does an organisation need?

    • AOnly a short note in the privacy notice
    • BAn Article 6 lawful basis plus an Article 9 condition
    • COnly one of the lawful bases listed in Article 6
    • DOnly written approval from a senior manager
    显示答案

    答案: B. An Article 6 lawful basis plus an Article 9 condition

    The EDPB checklist says to identify an Article 6 lawful basis and confirm that an additional Article 9 condition applies.

14. 第14题，共16题

    Which of these is one of the conditions in Article 9 that can allow special category data to be processed?

    • AExplicit consent from the person
    • BThe data was only sent in an internal email
    • CThe data is useful for future business planning
    • DThe person did not object within one week
    显示答案

    答案: A. Explicit consent from the person

    Explicit consent is one of the Article 9 conditions. Others include employment and social security obligations and occupational medicine.

15. 第15题，共16题

    Read Ana's message. What is the main problem with how she plans to get consent?

    Message from Ana, team manager, to her team:

    "Hi all, I'd like to put everyone's photo and date of birth on the intranet so we can celebrate birthdays. Please reply by Friday if you do NOT agree. If I don't hear from you, I'll take that as a yes. Thanks, Ana"

    • ANot replying is not consent; staff must actively agree
    • BConsent must be given in front of a witness
    • COnly the authority may ask staff for consent
    • DBirthdays are special category data
    显示答案

    答案: A. Not replying is not consent; staff must actively agree

    Silence, pre-ticked boxes and inactivity are not consent. People must actively agree with a clear positive action.

16. 第16题，共16题

    Read Ana's message. Why might consent from her team not be freely given even if they reply "yes"?

    Message from Ana, team manager, to her team:

    "Hi all, I'd like to put everyone's photo and date of birth on the intranet so we can celebrate birthdays. Please reply by Friday if you do NOT agree. If I don't hear from you, I'll take that as a yes. Thanks, Ana"

    • AConsent sent by email is never valid under the GDPR
    • BConsent is only valid if the DPO collects it in person
    • CStaff photos can only be used if a court allows it
    • DStaff may feel they cannot say no to their manager
    显示答案

    答案: D. Staff may feel they cannot say no to their manager

    Because of the imbalance of power at work, staff may feel unable to refuse, so consent may not be freely given. Refusing must have no negative consequences.

键盘：按1–4作答，按 Enter 进入下一题。