GDPR for Employees Course (EU)：Personal data breaches

1. 第1题，共18题

   Which of these is a personal data breach?

   • AA customer's details are emailed to the wrong person
   • BA colleague forgets their own password and asks for a reset
   • CA hacker's attack is blocked before it reaches any data
   • DA planned software update is installed on time as expected
   显示答案

   答案: A. A customer's details are emailed to the wrong person

   A personal data breach includes unauthorised disclosure of personal data, even by accident (Article 4(12) GDPR).

2. 第2题，共18题

   Ransomware encrypts customer records so staff can no longer open them. What type of breach is this?

   • AAvailability breach
   • BConfidentiality breach
   • CIntegrity breach
   • DAccuracy breach
   显示答案

   答案: A. Availability breach

   An availability breach is the accidental or unauthorised loss of access to, or destruction of, personal data.

3. 第3题，共18题

   Someone without permission changes the bank details in several employee records. What type of breach is this?

   • AAvailability breach
   • BConfidentiality breach
   • CPortability breach
   • DIntegrity breach
   显示答案

   答案: D. Integrity breach

   An integrity breach is the unauthorised or accidental alteration of personal data.

4. 第4题，共18题

   You think you may have caused a data breach at work. What should you do first?

   • AContact the affected customers yourself
   • BFix it quietly so nobody needs to know
   • CReport it internally straight away, following your procedure
   • DWait a few days until you are sure
   显示答案

   答案: C. Report it internally straight away, following your procedure

   The controller has strict deadlines, so possible breaches must be reported internally at once to the right contact, following your procedure.

5. 第5题，共18题

   Where feasible, within how many hours of becoming aware must the controller notify the authority of a breach?

   • A72 hours
   • B168 hours (7 days)
   • C24 hours
   • D48 hours
   显示答案

   答案: A. 72 hours

   Article 33(1) GDPR: without undue delay and, where feasible, not later than 72 hours after becoming aware of it.

6. 第6题，共18题

   Who does the controller notify about a personal data breach under Article 33?

   • AThe organisation's own bank and insurer
   • BThe European Commission in Brussels
   • CThe local police station, in every case
   • DThe data protection authority
   显示答案

   答案: D. The data protection authority

   Article 33 GDPR requires notification to the competent supervisory authority, which is the national data protection authority.

7. 第7题，共18题

   In which case may a controller decide not to notify the authority of a breach?

   • AWhen fewer than ten people's data were affected
   • BWhen it happened during a weekend or public holiday
   • CWhen it is unlikely to result in a risk to people
   • DWhen it was caused by a mistake made by an employee
   显示答案

   答案: C. When it is unlikely to result in a risk to people

   Article 33(1) GDPR: notification is not needed if the breach is unlikely to result in a risk to people's rights and freedoms. It must still be documented.

8. 第8题，共18题

   When must the affected people themselves be told about a breach?

   • AWhen it is likely to result in a high risk to them
   • BOnly if they contact the organisation and ask about it
   • CIn every case, even when there is no risk to them at all
   • DOnly after the authority has fined the organisation
   显示答案

   答案: A. When it is likely to result in a high risk to them

   Article 34(1) GDPR: people must be told without undue delay when the breach is likely to result in a high risk to their rights and freedoms.

9. 第9题，共18题

   Which breaches must the controller document?

   • AOnly those caused by cyber attacks
   • BOnly those affecting 100 or more people
   • COnly those notified to the authority
   • DAll of them, even those not notified
   显示答案

   答案: D. All of them, even those not notified

   Article 33(5) GDPR requires the controller to document every personal data breach, its effects and the action taken, even if it is not notified.

10. 第10题，共18题

    A processor discovers a breach of data it handles for a controller. What must it do?

    • AWait until the controller asks about it
    • BTell the people affected before anyone else
    • CTell the controller without undue delay
    • DFix it and tell nobody if it was only small
    显示答案

    答案: C. Tell the controller without undue delay

    Article 33(2) GDPR: the processor notifies the controller without undue delay after becoming aware of a breach.

11. 第11题，共18题

    An encrypted tablet is stolen. The key was not stolen and there is a backup. What does the EDPB say?

    • ADocument it; people generally need not be told
    • BNothing at all needs to be done or recorded
    • CReport it to the police and to the national press
    • DWrite to every customer at once to tell them
    显示答案

    答案: A. Document it; people generally need not be told

    If strong encryption keeps the data unintelligible, telling people is generally not required, but every breach must be documented.

12. 第12题，共18题

    An unencrypted laptop with no password, holding the names, addresses and dates of birth of over 100,000 customers, is stolen. What does the EDPB say should happen?

    • AOnly tell customers if they complain about fraud later
    • BNotify the authority and tell the customers
    • COnly write it down in the internal breach log
    • DOnly buy a new laptop for the employee concerned
    显示答案

    答案: B. Notify the authority and tell the customers

    Without encryption or a password the data is easy to access, and customers could suffer identity fraud. The risk is high, so the authority must be notified and the customers told.

13. 第13题，共18题

    The controller does not yet have all the facts about a breach when the 72 hours run out. What should it do?

    • ADecide not to notify, because facts are still missing
    • BWait until every fact is known before notifying
    • CNotify anyway and add details in phases
    • DAsk the authority for a 30-day extension first
    显示答案

    答案: C. Notify anyway and add details in phases

    The EDPB says information may be given in phases if it is not all available within 72 hours.

14. 第14题，共18题

    A controller becomes aware of a breach on Tuesday at 10:00. Where feasible, what is the latest time to notify the authority?

    • AThursday 10:00
    • BFriday 10:00
    • CFriday 18:00
    • DSaturday 10:00
    显示答案

    答案: B. Friday 10:00

    72 hours after Tuesday 10:00 is Friday 10:00 (3 days x 24 hours).

15. 第15题，共18题

    A company's worldwide annual turnover is €900 million. What is the highest fine in the top band (€20 million or 4%, whichever is higher)?

    • A€9 million
    • B€20 million
    • C€36 million
    • D€18 million
    显示答案

    答案: C. €36 million

    4% of €900 million is €36 million, which is higher than €20 million, so €36 million is the maximum.

16. 第16题，共18题

    Read the description. What type of breach is this?

    Marek works at the reception of Linden Physiotherapy. On Monday at 11:20 he meant to send a supplier an order form. By mistake he attached a list of 120 patients with their names, phone numbers and treatment notes, and sent it to orders@supplyhouse.example.com. He noticed the mistake at 11:35.

    • AAvailability breach
    • BNo breach, because it was an accident
    • CConfidentiality breach
    • DIntegrity breach
    显示答案

    答案: C. Confidentiality breach

    Personal data was disclosed to someone not authorised to see it. That is a confidentiality breach, even if accidental.

17. 第17题，共18题

    Read the description. What should Marek do now?

    Marek works at the reception of Linden Physiotherapy. On Monday at 11:20 he meant to send a supplier an order form. By mistake he attached a list of 120 patients with their names, phone numbers and treatment notes, and sent it to orders@supplyhouse.example.com. He noticed the mistake at 11:35.

    • ATell his manager or data protection contact at once
    • BDelete the email from his Sent folder to hide it
    • CPhone each of the 120 patients himself to apologise
    • DWait to see whether the supplier replies about it
    显示答案

    答案: A. Tell his manager or data protection contact at once

    Staff should report a possible breach internally straight away so the controller can assess it and meet the 72-hour deadline.

18. 第18题，共18题

    Read the description. Why is this breach likely to be treated as more serious?

    Marek works at the reception of Linden Physiotherapy. On Monday at 11:20 he meant to send a supplier an order form. By mistake he attached a list of 120 patients with their names, phone numbers and treatment notes, and sent it to orders@supplyhouse.example.com. He noticed the mistake at 11:35.

    • AMarek noticed it within an hour
    • BThe email was sent before lunchtime
    • CThe treatment notes are health data, a special category
    • DThe supplier's address ends in .com
    显示答案

    答案: C. The treatment notes are health data, a special category

    Treatment notes are data concerning health, a special category, so the risk to patients is higher.

键盘：按1–4作答，按 Enter 进入下一题。