Questio n:To evaluate the effectiveness of communication, the DPO of Company ABC reviewed the accuracy and relevance of the information provided to customers regarding personal data processing.Is this a good practice under GDPR?
Answer(s): A
Under Article 39(1)(a) of GDPR, the DPO is responsible for monitoring GDPR compliance, including ensuring transparency in communication with data subjects. This includes verifying that information about data processing is accurate and relevant.Option A is correct because GDPR mandates that data subjects receive clear and accurate information about their personal data processing.Option B is incorrect because accuracy and relevance are key indicators of effective communication under GDPR.Option C is incorrect because evaluating data protection communication is part of the DPO's compliance role.Option D is incorrect because supervisory authority approval is not required for the DPO to conduct such evaluations.
GDPR Article 39(1)(a) (DPO's role in monitoring compliance)GDPR Article 12(1) (Obligation for transparent and clear communication)
Questio n:Based on Article 58 of GDPR, what powers must the supervisory authority have?
Answer(s): B
Under Article 58 of GDPR, supervisory authorities have investigative and corrective powers, including the ability to access premises and equipment used for personal data processing.Option B is correct because supervisory authorities can investigate controllers and processors, including accessing IT systems.Option A is incorrect because supervisory authorities do not appoint DPOs; controllers and processors must do this themselves.Option C is incorrect because supervisory authorities do not manage controllers' or processors' tasks.Option D is incorrect because supervisory authorities do not pre-approve privacy policies.
GDPR Article 58(1)(f) (Supervisory authorities can access premises and data)Recital 129 (Authorities must have investigation powers)
Questio n:Organization XYZ has just appointed a DPO. As such, XYZ needs to establish the DPO's role in the employment contract.Which of the statements below holds true?
Under Article 39(1)(e) of GDPR, the DPO acts as a contact point for supervisory authorities and must be readily accessible for regulatory inquiries and investigations.Option A is correct because GDPR explicitly states that the DPO serves as a liaison between the organization and the supervisory authority.Option B is incorrect because the controller and processor are independent entities under GDPR, and the DPO does not facilitate their relationship.Option C is incorrect because the DPO does not act as a communication channel for internal company matters.Option D is incorrect because DPOs advise and monitor but do not make operational decisions.
GDPR Article 39(1)(e) (DPO is a contact point for the supervisory authority)Recital 97 (DPO's role in ensuring compliance)
Questio n:What is the role of the European Data Protection Board (EDPB)?
Under Article 70 of GDPR, the EDPB is responsible for ensuring consistency in GDPR application and advising the European Commission on data protection matters.Option B is correct because the EDPB provides opinions and guidelines on GDPR implementation.Option A is incorrect because supervision and enforcement are the responsibility of national supervisory authorities, not the EDPB.Option C is incorrect because EU laws are adopted by the European Parliament and Council, not the EDPB.Option D is incorrect because the EDPB does not conduct audits; national data protection authorities do.
GDPR Article 70(1)(b) (EDPB's advisory role)Recital 139 (EDPB ensures consistency in GDPR application)
Questio n:All the statements below regarding the lawfulness of processing are correct, except:
Under Article 6 of GDPR, there are six legal bases for data processing. Consent is only one of them, and processing is not always dependent on obtaining consent.Option B is correct because GDPR does not require consent for all processing activities; processing can also be based on contractual necessity, legal obligations, vital interests, public tasks, or legitimate interests.Option A is incorrect because contractual necessity is a valid legal basis for processing.Option C is incorrect because vital interests (e.g., processing in medical emergencies) are a valid legal basis.Option D is incorrect because legitimate interests can justify processing, provided they do not override the rights of data subjects.
GDPR Article 6(1) (Lawfulness of processing)Recital 40 (Processing should be lawful and justified)
Post your Comments and Discuss PECB GDPR exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the GDPR content, but please register or login to continue.