A grade school is planning to use facial recognition to track student attendance. Which of the following may provide a lawful basis for this processing?

In which of the following cases would an organization MOST LIKELY be required to follow both ePrivacy and data protection rules?

An organization receives a request multiple times from a data subject seeking to exercise his rights with respect to his own personal dat a. Under what condition can the organization charge the data subject a fee for processing the request?

What must be included in a written agreement between the controller and processor in relation to processing conducted on the controller's behalf?

A Spanish electricity customer calls her local supplier with Questions: about the company's upcoming merger. Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?