Correct Answer: A

Reference: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_en

Correct Answer: B

Compliance. Incorrect. Compliance means meeting rules or standards.

Data protection by design and by default. Correct. By default, the minimum of personal data is to be processed for the shortest possible period, using the best possible security measures to prevent unauthorized access. Data protection by design refers to processing that includes appropriate measures to implement data protection principles. (Literature: A, Chapter 8; GDPR Article 25)

Embedded data protect. Incorrect. Embedded data protection is the result of data protection by design.

Correct Answer: B

Correct Answer: C

In its Article 5, which deals with the Principles concerning the processing of personal data, paragraph 1, the GDPR describes:

1. Personal data shall be:

adequate, relevant and limited to what is necessary in relation to the purposes for which they are

processed (玠ata minimisation?;

In the Article 5 all the principles of GDPR for processing personal data are quoted.

The data minimization principle refers to the purpose of the law that only the data that is required for

processing should be collected.

This is also favorable to businesses. The less data is collected, the less likely violations are to occur and consequently the impacts also decrease. Reference: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

Correct Answer: D

For archiving purposes in the public interest. Incorrect. With the safeguards in place, further processing is allowed for archiving purposes in the public interest.

For direct marketing and commercial purposes. Correct. This is not a purpose that is allowed, if it is not the original legitimate purpose of the processing. (Literature: A, Chapter 2)

For generalized statistical purposes. Incorrect. With the safeguards in place, further processing is allowed for generalized statistical purposes.

For scientific or historical research purposes. Incorrect. With the safeguards in place, further processing is allowed for research purposes.

Correct Answer: C

The numerous powers of the Supervisory Authority are divided into:

-Investigative powers;

-Correcting powers;

-Advisory and authorization powers.

The investigative powers provided for in Article 58, Paragraph 1 are:

a) To order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks; b) To carry out investigations in the form of data protection audits; c) To carry out a review on certifications issued pursuant to Article 42(7); d) To notify the controller or the processor of an alleged infringement of this Regulation; e) To obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks; f) To obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

Correct Answer: A

Article 17

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.

Correct Answer: A

Whenever a new technology is applied, a DPIA must be performed. In addition, a DPIA must be performed before starting the processing of personal data. This is important to check for risks to data subjects since data collection.

In its Article 35 the GDPR legislates on the Impact assessment on data protection.

1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.

Correct Answer: D

To ensure that the user's personal data are stored securely on the server. Incorrect. Cookies are not used to store data on the server.

To personalize the user's experience of the website during the next visit. Correct. This is the main purpose of a persistent cookie. (Literature: A, Chapter 8)

To record every keystroke made by a computer user to find out passwords. Incorrect. Cookies are not malicious by nature, but the mechanism can be exploited maliciously.

To save the pages a user has bookmarked in the user's browser history. Incorrect. The bookmarks and browser history are saved, but not in a cookie.

Correct Answer: A

Because France is located in the middle of Europe. Incorrect. The geographical position of the countries is irrelevant.

Because France is the largest of the three EEA countries. Incorrect. The size of the countries is irrelevant. Because the company has their headquarters in France. Correct. The country of the main establishment determines the lead supervisory authority. The `main establishment' is the place of the central administration of that organization, or in other words: headquarters. (Literature: A, Chapter 7)