Scenario 5:Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared. The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond. Based on this scenario, answer the following Questio n:Questio n:Which statement regarding the material scope of the GDPR is incorrect?
Answer(s): B
The material scope of the GDPR is outlined in Article 2. It applies to the processing of personal data by automated means and to non-automated processing if the data is part of a filing system. The GDPR does not apply to activities outside the scope of Union law, such as national security activities, which are excluded under Recital 16.Option B is correct because the GDPR does not apply to activities falling outside the scope of Union law, such as law enforcement operations covered by the Law Enforcement Directive (EU 2016/680).Option A is incorrect because automated processing is explicitly covered by GDPR.Option C is incorrect because data processing by Member States under TEU (e.g., national security and defense) is excluded.Option D is incorrect because GDPR applies to controllers/processors established in the EEA, even if data subjects are outside the EEA (Article 3(1)).
GDPR Article 2(2)(a) (Exclusion of activities outside EU law)GDPR Article 3(1) (Territorial scope)Recital 16 (GDPR does not apply to national security)
Questio n:A patient gave consent for the use of their laboratory tests to defend a clinical laboratory against a lawsuit. As a result, the court required the collection and processing of the patient's health data, and such information was revealed in court.Is this compliant with GDPR's lawfulness of processing requirements?
Answer(s): A
Under Article 9(2)(f) of GDPR, the processing of special categories of data (e.g., health data) is permitted without consent if it is necessary for the establishment, exercise, or defense of legal claims.Option A is correct because GDPR allows processing of special category data for legal claims, even without explicit consent.Option B is incorrect because processing for legal claims is not restricted to public health institutions.Option C is incorrect because GDPR explicitly allows such processing for legal claims.Option D is incorrect because anonymization is not required when data is processed under Article 9(2)(f).
GDPR Article 9(2)(f) (Processing of special categories of data for legal claims)Recital 52 (Legal grounds for processing sensitive data in court cases)
Questio n:You work in a company that provides training services. One of the clients requests access to information about the categories of recipients to whom their personal data will be disclosed.What actions should you take to be compliant with GDPR?
Answer(s): D
Under Article 15(1)(c) of GDPR, data subjects have the right to access information about the recipients or categories of recipients who have received their personal data.Option D is correct because GDPR mandates transparency regarding data sharing.Option A is incorrect because authorization from recipients is not required before disclosing their categories.Option B is incorrect because identity verification applies to access requests but is not a prerequisite for providing recipient information.Option C is incorrect because denying access to this information violates the data subject's right under GDPR.
GDPR Article 15(1)(c) (Right of access to recipient categories)Recital 63 (Transparency in processing and access rights)
Questio n:Which of the following options is the DPO's responsibility when processing personal data related to criminal convictions is carried out by an official authority?
Answer(s): C
Under Article 39(1)(b) of GDPR, the DPO monitors compliance with GDPR and other applicable laws, including Member State laws on criminal conviction data.Option C is correct because DPOs must ensure processing aligns with national legal requirements.Option A is incorrect because determining processing locations is a technical decision, not a DPO responsibility.Option B is incorrect because DPOs do not assess the necessity of identity disclosure.Option D is incorrect because approving security measures is the responsibility of controllers and processors, not the DPO.
GDPR Article 39(1)(b) (DPO's role in ensuring legal compliance)Recital 97 (DPO responsibilities in public and private sectors)
Scenario:BookSt is an online bookshop that collects personal data before selling its products. Sarah signed up for an account, providing her name, email, and password. To purchase a book, Sarah was required to provide her shipping address and payment information, which is needed to calculate shipping costs and complete the transaction.Questio n:Does the company have a legal basis for processing Sarah's data?
GDPR Article 6(1)(b) (Processing necessary for contract performance)Recital 44 (Contractual necessity as a legal basis)
Post your Comments and Discuss PECB GDPR exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the GDPR content, but please register or login to continue.