Online Access Free GDPR Exam Questions

Scenario4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc's and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company.Based on this scenario, answer the following question:
Question:
Based on scenario 4, to which of the companies candata subjects exercise their rightsunder GDPR?

• A.Data subjects may exercise their rights againstboth Berc and Unty, regardless of the terms of the arrangement.
• B.None of the above.
• C.Data subjects may exercise their rights againstBerc onlybecause it decided to implement GDPR for data processing activities.
• D.Data subjects may exercise their rights againstonly one of the controllers, as specified in the arrangement.

Scenario:
An organization conducted anonline surveyto gather opinions onglobal warming. The survey collected personal data, includingage, nationality, gender, and city of residence.
Question:
What should be considered whenidentifying this processing activity?

• A.Adescription of data subjectsand thecategories of personal datacollected.
• B.Information on thepersonal data collectedand itssensitivity.
• C.Thesurvey platform's technical security measures.
• D.Information abouthow the data is processed.

Scenario:
An organization suffered apersonal data breachdue to aphishing emailattack, which allowed attackers to access employee names, email addresses, and phone numbers.
Question:
What could theDPO do to preventa similar breach from happening again?

• A.Both A and C.
• B.Classify incidents into categoriesand take decisions based on this categorization.
• C.Create a data breach response planthat includes information onhow breaches should behandled.
• D.Provide training and awareness sessionson data protection within the organization.

Scenario:
Socianis a softwareused to collect medical records of patients, includingname, date of birth, social security number, and other personal data. The system stores data on asecure server with multi-layered security.
An organization usingSocianfor six months wants to ensure that itsprocessing activities comply with GDPR
. TheDPO advised creating a list of processing activitiesrelated toSocian.
Question:
What should beincludedin theprocessing activities registers?

• A.How thesupervisory authorityis notified in case of apersonal data breach.
• B.Theseverity of the risksto therights and freedomsof data subjects.
• C.Adetailed list of every individual who accessed the data.
• D.Thepersonal data protection techniquesused.

Scenario3:
COR Bank is an international banking group that operates in 31 countries. It was formed as themerger of two well-known investment banks in Germany. Their two main fields of business are retail and investment banking. COR Bank provides innovative solutions for services such as payments, cash management, savings, protection insurance, and real-estate services. COR Bank has a large number of clients and transactions.
Therefore, they process large information, including clients' personal data. Some of the data from the application processes of COR Bank, including archived data, is operated by Tibko, an IT services company located in Canada. To ensure compliance with the GDPR, COR Bank and Tibko have reached a data processing agreement Based on the agreement, the purpose and conditions of data processing are determined by COR Bank. However, Tibko is allowed to make technical decisions for storing the data based on its own expertise. COR Bank aims to remain a trustworthy bank and a long-term partner for its clients. Therefore, they devote special attention to legal compliance. They started the implementation process of a GDPR compliance program in 2018. The first step was to analyze the existing resources and procedures. Lisa was appointed as the data protection officer (DPO). Being the information security manager of COR Bank for many years, Lisa had knowledge of the organization's core activities. She was previously involved in most of the processes related to information systems management and data protection. Lisa played a key role in achieving compliance to the GDPR by advising the company regarding data protection obligations and creating a data protection strategy. After obtaining evidence of the existing data protection policy, Lisa proposed to adapt the policy to specific requirements of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of departments. As the DPO, she had access to several departments, including HR and Accounting Department. This assured the organization that there was a continuous cooperation between them. The activities of some departments within COR Bank are closely related to data protection. Therefore, considering their expertise, Lisa was advised from the top management to take orders from the heads of those departments when taking decisions related to their field. Based on this scenario, answer the following question:
Question:
Based on scenario 3,Lisa was advised to take orders from the heads of other departments. Is this acceptable under GDPR?

• A.No, the organization should not influence, nor put pressure on the DPO for any decision taken.
• B.Yes, the DPO shall take instructions and tasks from employee members if required by the organization.
• C.Yes, only heads of departments within a financial institution are allowed to give orders to the DPO.
• D.Yes, the DPO is responsible for following management directives while ensuring GDPR compliance.