Online Access Free PDP9 Exam Questions

When does a personal data breach need to be reported to a supervisory authority?

• A.Only where a disclosure is of special category data
• B.When the controller's right of freedom of expression outweighs the data subject's right to a private home and family life.
• C.Where the personal data breach is likely to result in a risk to the rights and freedoms of natural persons.
• D.All personal data breaches must be reported to a supervisory authority

An individual applies for a job as a security guard The employer has had significant issues with the sickness record of past recruits They therefore decide to offer the position to the individual on the basis they request a copy of their medical record so that the employer can be assured that they are in a good state of health.
The Data Protection Officer has been asked to advise. What advice is MOST appropriate?

• A.Providing the medical evidence is used for a legitimate purpose, and that the information is securely destroyed on verification that the employee is healthy, this is an acceptable action.
• B.In requesting information that is more than they necessary require to verify the medical condition of the individual they will have breached the data minimisation principle
• C.While requesting and viewing medical evidence may be legitimate, they should ask for evidence that the individual consents to the proposition that they make the request
• D.This is a criminal offence under the Data Protection Act 2018 No individual should be asked to make a subject access request in order to obtain health records in these circumstances.

If a complainant disagrees with the decision of the UK's supervisory authority, how do they appeal this decision?

• A.To the European Commission
• B.To the First Tier Tribunal (Information Rights)
• C.To the European Data Protection Supervisor.
• D.To the Information Commissioner

A company has twenty retail outlets in France and thirty retail outlets in Belgium The payroll department and the Data Protection Officer are based in Poland.The Company Board and administrative functions are based in Germany. Determine where the company's 'mainestablishment' would be

• A.Belgium
• B.France
• C.Poland
• D.Germany

In the terms of their relevance under data protection legislation, how can CCTV images recorded in a supermarket BEST be described'?

• A.They are personal data as they can be used to identify living human beings
• B.The GDPR is only engaged where these are accompanied by text or other identifier
• C.They are special category data as they identify special characteristics
• D.They are biometric data in the terms of the definition stipulated in the GDPR.