Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

European Data Protection CIPP E > Compliance Considerations (8) > Flashcards

Compliance Considerations (8) Flashcards

(89 cards)

Start Studying
1
Q

What does Article 88 allow member states to do regarding rules around processing of employee data?

A

To establish - by law or collective agreement - more specific rules around processing employees’ data

must include safeguards to dignity, interests and rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What 3 elements must be safeguarded in member state rules established under Article 88?

processing in the context of employment

A

suitable and specific measures to to safeguard:

  1. Human dignity
  2. Legitimate interests
  3. Fundamental rights (transparency of processing, transfer of personal data and monitoring in the workplace)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are three most common legal bases to process employee personal data?

A
  1. Fulfillment of a contract (e.g. bank account info for salaries)
  2. Compliance with legal obligation (e.g. tax authorities)
  3. Necessary for legitimate interests (e.g. data management)

consent in contract not valid under data protection law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Can consent serve as a legal basis for processing employee data?

A

Unlikely.

Due to imbalance of power. Where consent is not freely given it is not valid.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Can explicit consent be used as a legal basis for processing employee special category data?

A

No, not freely given

some cases not possible to lift prohibition on special category

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Under what two legal bases can an employer process special category data?

A
  1. Establish, exercise or defend legal claims
  2. Carry out obligations and exercise specific rights under employment law
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who is responsible for personal data processed on an employee’s device for work-related purposes?

A

The employer as the controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are 5 elements of effective management of a BYOD program?

A
  1. Provide notice to employees
  2. Have a BYOD policy - how employees can use BYOD and responsibilities
  3. Know where data is stored and measures to keep secure
  4. Ensure transfer from device is secure
  5. Offboarding procedure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the 4 conditions of lawful monitoring of employees?

A

Necessary - (ie is there a less intrusive)
Legitimate - (ie lawful grounds?)
Proportional - (ie proportionate to the issue)
Transparent - (ie employee informed)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are 3 types of monitoring carried out in employment?

A

Background checks
Data loss prevention
Whistleblowing schemes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the best way to determine if an employee monitoring initiative is compliant ?

(necessary, legitimate and proportionate)

A

Conduct a DPIA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is surveillance?

A

the observation of an individual or group of individuals

can be covert or open or real time or stored

(SNA, data mining, aerial, satellite, telecom, biometric, geoloc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the 10 circumstances where the scope of data subject rights can be limited by legislative measure?

Article 23

A
  1. national security
  2. defense
  3. public security
  4. crime
  5. general public interest of the union
  6. judicial proceedings
  7. regulated professions breach of ethics
  8. regulatory functions
  9. protection of rights and freedoms of others
  10. enforcement of civil claims
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What 2 conditions must apply to restrict the scope of data subject rights under Article 23?

Article 23

A
  1. respect essence of fundamental rights and freedoms
  2. necessary and proportionate measure in a democratic society
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does Recital 66 of the Law Enforcement Protection Directive (LEPD) state?

A

Lawful, fair and transparent personal data processing should not prevent law enforcement authorities from carrying out activities to:

investigate criminal offenses
safeguard public security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is content data versus metadata in electronic communications?

A
  1. Content: content of communication
  2. Metadata: data about the data about communication’s transmission
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What regulation(s) protects the content of e-communication?

A

Freedom of expression

EPrivacy Rules (cant see content without consent of both parties)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What regulation(s) protects the metadata of e-communication?

A

GDPR

falls within definition of personal data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What regulation sets rules about data passing over public electronic communication networks?

A

ePrivacy Directive

governs processing of location, content and traffic data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Does the ePrivacy Directive apply to private communications networks?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is required to obtain location data?

ePrivacy Directive

A

opt-in consent for precise location-based data

(except when data required to provide the service)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does the ePrivacy directive require for content data?

A

Article 5 - confidentiality unless consent from all parties

Article 15 - member states can introduce some exceptions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does the ePrivacy directive require for traffic data?

A

Limit access to traffic data

Can process traffic data for some limited marketing with user’s consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does the ePrivacy directive require for traffic data?

A

Limit access to traffic data

Can process traffic data for some limited marketing with user’s consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Does CCTV require prior authorization?
In many countries CCTV triggers requirement to notify local regulator and in some cases seek authorization
26
When is a DPIA required for CCTV?
high-risk systematic monitoring of publicly accessible area on a large scale if required by SA of list of data processing operations that require DPIA
27
Is location data within the GDPR definition of personal data?
Yes, if can be used alone or in combination with other information to identify
28
What are the 3 main areas of location data identified by Google?
implicit location - search terms internet traffic - IP device-based location - google maps
29
What is biometrics data?
personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm unique identification
30
What are the two uses of biometrics systems?
1. Identification - who are you 2. Authentication - are you who you claim to be
31
When is biometric data considered special category data (article 9)?
when the purpose is for uniquely identifying an individual
32
What is considered direct marketing?
directed to a particular individual must process personal data to communicate the message not service-related in nature
33
Which laws regulate direct marketing?
ePrivacy Directive: marketing over electronic networks (phone, fax, email or SMS) GDPR: all channels, including online targeting based on browsing history
34
What right does GDPR establish for direct marketing?
absolute right to object to any form of marketing
35
What does GDPR require of controllers related to direct marketing?
1. notice of right to opt out 2. allow individuals to opt out 3. honor opt out requests in timely fashion and no cost 4. remove personal data and profiling after opt out 5. ensure compliance with GDPR
36
What is the best practice when an individual opts out of direct marketing?
To suppress rather than delete contact details to avoid reacquiring individual's details later
37
Is postal marketing subject to ePrivacy Directive?
No
38
Is telemarketing subject to ePrivacy Directive?
yes Article 13: member states decide if opt-in or opt-out Individuals must have means to opt-out for free Check opt-out registers against call lists
39
Is email marketing subject to ePrivacy Directive?
Yes: email and SMS Prior consent required
40
In what cases is email marketing exempt from opt-in under ePrivacy Directive?
in the context of a sale of product or service controller must market its own similar products/services individuals must be able to opt out at time of collection individuals must be reminded of ability to opt out
41
Are web cookies subject to GDPR?
if they collect personal data
42
Who is the controller of web cookies?
Data gathered by first party cookies --> website operator Data gathered by third party cookies --> third party
43
Which cookies are exempt from consent under ePrivacy Directive?
strictly necessary cookies and those used for solely carrying out communication transmission
44
What does Article 5 of the ePrivacy Directive state regarding cookies?
organizations must obtain prior informed consent for storage or access to information stored on user's terminal equipment
45
What did the GDPR change regarding consent for cookies?
GDPR requires specific, informed and unambiguous indication of consent and must be presented separate from other matters. CJEU clarified that consent must be obtained through active behavior (opt in)
46
What is Online Behavioral Advertising?
website advertising targeted at individuals based on the observation of their behavior
47
When does GDPR apply in cloud computing relationships?
When processing relates to activities of an EU establishment of the controller Processing relates to offering goods or services to individuals in the EU, or monitor their behavior even when controller/processor not in the EU
48
Who is a controller of personal data processed by search engines?
Search engines: determine the purpose and means of processing data about their users
49
What was decided in Google vs AEPD regarding Google's obligation to honor right to be forgotten?
Established Google as controller and required to remove links to a 1998 article about the plaintiff
50
Are search engines outside the EU subject to the GDPR?
likely to be for processing of personal data contained in third party websites if they have an EU establishment with economic activities linked to search engine core activities
51
Are search engine marketers considered controllers?
yes, when web traffic data is processed by search engines and provided as analytics to search engine marketers
52
Who are considered controllers in social networking services?
1. Social networking services 2. Authors of applications designed for SNS platforms 3. Users acting on behalf of organization 4. Users extending access to personal data beyond contacts
53
What is required to publish sensitive personal data on the internet?
Data subject -- to know it's voluntary Third party -- explicit consent
54
What is required to publish third party personal data on SNS?
Must have legal bases
55
Can third party data of individual who are not members of the SNS be aggregated to form a profile?
No
56
What is required to process children's data on SNS?
Parental consent (under 16, member states can lower to 13)
57
What does Recital 43 state with regard to consent as a valid legal ground?
consent is not valid where there is a clear imbalance of power
58
Can an employer compile blacklists as part of background checks?
This is considered to be a significant intrusion of privacy and generally illegal
59
Is use of a DLP tool considered employee monitoring?
Yes
60
What 4 principles must a controller ensure if it will engage in workplace monitoring?
1. necessity 2. legitimacy 3. proportionality 4. transparency
61
Can an employer take action against a rogue employee for actions caught through monitoring if notice of monitoring wasn't provided?
probably not requirement to notify is critical to how courts see these cases
62
What are 4 types of surveillance data?
1. communications 2. video 3. biometric 4. location
63
What are examples of surveillance?
employee monitoring social networks analysis daa mining and profiling aerial surveillance satellite imaging telecommunications surveillance mobile telecommunications location data CCTV geolocation or GPS
64
Who regulates governmental surveillance activities for national security or law enforcement?
mostly member states
65
What are the European essential guarantees for surveillance measures?
assess whether member state surveillance laws maintain the level of privacy and data protection expected by the EU Charter of Fundamental Rights
66
What are the 4 considerations for conducting surveillance activities?
1. processing based on clear, precise and accessible rules 2. necessity and proportionality need to be demonstrated 3. independent oversight mechanism 4. effective remedies for individual
67
What conditions are necessary when restricting the right to privacy in specific situations?
necessity and proportionality and due process connected
68
What two categories of personal data do electronic communications generate?
1. Content of communication 2. Metadata of communication
69
What are examples of communications metadata?
1. Traffic Data 2. Location Data 3. Subscriber Data
70
Under what legal basis is CCTV commonly used?
Legitimate interest. Therefore, a balancing exercise must be carried out to ensure CCTV doesn't override rights and freedoms
71
What must a controller do when relying on legitimate interest as the legal basis?
Demonstrate interest exists, weigh against rights and freedoms of data subjects
72
What should happen before the use of CCTV?
evaluate feasibility of using other less-intrusive methods and a finding of them to be inapplicable or inadequate
73
Why should DPIAs be conducted before implementing video surveillance?
if video surveillance considered high risk involves systematic monitoring of a publicly accessible area on a large scale process special category data on a large scale if on list of processing activities that require a DPIA (per SA)
74
What is the definition of direct marketing?
any form of sales promotion, including charities and political organizations that is **directed to particular individuals**
75
What is NOT considered direct marketing?
marketing communications not directed at individuals messages that are purely service related
76
Which marketing does GDPR apply to?
direct marketing communications - post, phone, fax, electronic mail, web browsing targeting
77
Which marketing does the ePrivacy Directive apply to?
direct marketing communicated over electronic means - phone, fax, email, SMS | does NOT apply to postal
78
Is the right to refuse (or opt out) of direct marketing absolute?
Yes. if based on consent, can withdraw consent if based on legitimate interest, exercise right to object (article 21)
79
What does GDPR require for opt-ing out?
* individuals are always informed of their right to opt out * marketers must allow individuals to opt out of all channels * opt-out requests must be honored in a timely fashion and at no cost * must delete all personal information on record (unless compelling legitimate grounds) * profiling must be removed
80
Should controllers suppress or delete data related to an opt-out request?
Suppress. to ensure they don't reacquire individuals and remarket to them
81
What is the general rule for digital marketing under the ePrivacy Directive?
prior opt-in consent required
82
What is the exception to consent for the ePrivacy Directive?
email marketing to individuals whose data was collected in the context of a sale of a product or service
83
What is required to obtain valid consent for the use of cookies?
1. information about use and purpose of the cookie provided to user 2. consent before placement of cookie in a clear affirmative manner 3. user must have a choice whether to give consent
84
What criteria exists to determine if information was made manifestly public on Social Media platforms?
whether the user took a step to change default private settings to public whether the social media platform is intended to connect close acquaintances or wider scope accesibility of page with special category data prominence of notice by the SMP that special category data will be made public whether special category data was published by SMP user or third party
85
What does Article 95 state with regard to the relationship between the GDPR and ePrivacy Directive?
GDPR shall not impose additional obligations in relation to processing in connection with provision of publicly available electronic communication services
86
Which has stronger consent requirements for digial marketing - ePrivacy or GDPR?
GDPR
87
What does ePrivacy Directive Article 5 require related to consent and cookies?
prior informed consent must be provided before placing the cookie on the user's device
88
What are the compliance responsibilities under GDPR for direct marketing activities?
1. Ensure lawful basis (consent or legitimate interest) 2. Provide fair processing information (data will be used for marketing) 3. Appropriate technical and organizational measures 4. No export outside of EEA without adequate protection 5. Satisfy other compliance duties under GDPR
89
What regulations apply to background checks?
data protection and employment laws, which can vary between member states

European Data Protection CIPP E (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions