Which of the following would require designating a data protection officer?

In which situation would a data controller most likely be able to justify the processing of the data of a child without parental consent?

Under the GDPR, where personal data is not obtained directly from the data subject, a controller is exempt from directly providing information about processing to the data subject if?

A U.S.-based online shop uses sophisticated software to track the browsing behavior of its European customers and predict future purchases. It also shares this information with third parties. Under the GDPR, what is the online shop's PRIMARY obligation while engaging in this kind of profiling?

Which was NOT one of the five priority areas listed by the Federal Trade Commission in its 2012 report,
''Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers"?