PDPF 무료 덤프문제 온라인 액세스

The General Data Protection Regulation (GDPR) is based on the principles of proportionality and subsidiarity.
What is the meaning of "proportionality" in this context?

• A.Personal data can be processed according to the use of requirements.
• B.Personal data can only be processed if there are no other means to achieve the purposes.
• C.Personal data cannot be reused without explicit and informed consent.
• D.Personal data must be adequate, relevant and not excessive in relation to the purposes.

A person is moving from city A to city B, within an EEA member state. In city A he was a patient of the local hospital A.
In city B, he becomes a patient of hospital B.
The patient has opted out of the national electronic patients file system. The patient asks hospital A to forward his medical file directly to hospital B.
According to the GDPR, what is allowed?

• A.The hospital in A cannot send the file, because there is no legitimate ground for processing
• B.The hospital in A can send the medical file to the data subject, but not to another hospital
• C.The hospital in A can send the file to hospital B, before the patient has requested it
• D.The hospital in A can send the data directly to hospital B, as requested by the patient.

A controller asks a processor to produce a report containing customers who have purchased a particular product more than once in the past 6 months.
The processor provides services to several companies (which in this case are the controllers).
When generating the requested report, it uses customer data collected by another controller, that is, for a different purpose.
Fortunately, the error is noticed in time, the report is not sent, and nobody has had access to this dat a. In this case, how does the processor need to proceed and what action should the controller take?

• A.The processor notifies the Supervisory Authority that a violation has occurred. The controller will be notified and must perform a Data Protection Impact Assessment (DPIA).
• B.The processor needs to notify the controller so that the controller notifies the Supervisory Authority of the personal data breach.
• C.The processor needs to notify the controller. And the controller can assess whether there were risks to the data subjects.
• D.As the error was noticed in time and the report was not sent, there is no need for the processor to inform the controller. The processor must delete the wrong report and generate a new one, this time with the correct data.

Which condition below allows personal data to be processed legally?

• A.There must be a legitimate basis for data processing.
• B.Holders' rights must be protected by a privacy policy.
• C.Data processing must be previously authorized by the Supervisory Authority.
• D.A Data Privacy Impact Assessment (DPIA) should be performed prior to data collection.

What is the essence of the principle 'Full Lifecycle Protection'?

• A.Prioritizing the protection of the interests of the individual by offering for example strong privacy defaults, appropriate notice or empowering user-friendly options.
• B.Embedding security measures to protect the data from the moment it is collected, throughout processing until it is destroyed at the end of the process.
• C.Delivering the maximum degree of data protection by default, ensuring that personal data are automatically protected in any given IT system or business practice.
• D.Ensuring that whatever business practice or technology is involved, processing is done according to the stated objectives, subject to independent verification.