Data Privacy: US, EU, GDPR

Podcast

Play an AI-generated podcast conversation about this lesson

Download our mobile app to listen on the go

Get App

Questions and Answers

A multinational corporation headquartered outside the EU processes personal data of EU residents. Under what conditions does GDPR apply to this corporation?

GDPR applies only if the corporation has a physical office within the EU.
GDPR never applies to organizations outside the EU, regardless of the data they process.
GDPR applies only if the corporation voluntarily complies with GDPR standards.
GDPR applies only if the data processing is directly related to offering goods or services to EU residents, or monitoring their behavior within the EU. (correct)

A data controller relies on 'legitimate interest' as the justification for processing personal data. Which of the following scenarios would most likely be considered an invalid application of 'legitimate interest' under GDPR?

Processing customer data to prevent fraud and ensure network security, where the benefits are balanced against the individual's privacy expectations.
Processing personal data for direct marketing purposes without providing individuals an easy and consistent opt-out mechanism. (correct)
Processing employee data for payroll and human resources management purposes, as required by local labor laws.
Processing data to comply with a legal obligation to which the controller is subject.

A data breach occurs at a company that processes personal data on behalf of a controller. Under GDPR, what are the potential liabilities and obligations of the data processor?

The data processor is only liable if the data processing agreement explicitly states so; otherwise, the controller bears full responsibility.
The data processor's liability is limited to the fees paid by the data controller under their contract.
The data processor is jointly and severally liable with the controller, and they must notify the controller without undue delay after becoming aware of a data breach. (correct)
The data processor has no direct liability to data subjects; only the data controller can be held liable.

A company intends to collect and process biometric data (facial recognition) of its employees for security purposes. Which of the following conditions would be considered a valid justification for processing this special category of data under GDPR?

The processing is necessary for carrying out the obligations and exercising specific rights of the controller or the data subject in the field of employment law, provided it is authorized by Union or Member State law. (A) Signup and view all the answers

A data subject exercises their 'right to be forgotten' (right to erasure) under GDPR. In which of the following scenarios might the controller legitimately refuse the erasure request?

The processing is necessary for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject. (B) Signup and view all the answers

A U.S.-based company collects personal data from EU citizens. The company stores and processes this data exclusively in the U.S. Which legal mechanism is MOST appropriate for ensuring GDPR compliance regarding the transfer of this data?

Implementation of Standard Contractual Clauses (SCCs) approved by the European Commission, combined with supplementary measures to ensure equivalent protection in the U.S. (B) Signup and view all the answers

A research institution plans to use anonymized patient data for a study on a rare disease. After the data is fully anonymized, does GDPR still apply to this research?

No, if the data is truly anonymized in such a manner that the data subject is no longer identifiable, GDPR does not apply. (D) Signup and view all the answers

A company updates its privacy policy to comply with GDPR. If a user continues to use the company's services after the updated policy goes into effect, is this considered valid consent under GDPR?

No, consent must be a clear affirmative act (e.g., ticking a box) and freely given; continued use is not sufficient. (D) Signup and view all the answers

A large social media company suffers a data breach affecting millions of users. While the company quickly contains the breach and notifies affected users, it delays notifying the supervisory authority beyond the 72-hour deadline. What are the potential consequences under GDPR?

The company may face a fine of up to 2% of its annual global turnover for failing to notify the supervisory authority within the required timeframe, in addition to other potential penalties related to the breach itself. (D) Signup and view all the answers

A company is establishing a data retention policy for customer data. Under GDPR principles, what is the MOST appropriate approach?

Retain customer data only for as long as necessary to fulfill the purposes for which it was collected, and securely delete or anonymize it after that period. (D) Signup and view all the answers

In the context of US data privacy laws, which of the following statements accurately reflects a key difference between state and federal approaches?

State laws often introduce broader, more general data privacy rights (like CCPA), whereas federal laws tend to be sector-specific. (D) Signup and view all the answers

A small business in the US experiences a data breach affecting customer data. What factors will determine the business's legal obligations following the breach?

The business must consider a combination of federal laws (if applicable), state data breach notification laws, and potentially sector-specific regulations depending on the nature of the data and the industry. (C) Signup and view all the answers

A hospital uses AI to predict patient readmission rates. The AI uses patient demographics, medical history, and social determinants of health. How does GDPR's principle of 'fairness' apply in this context?

GDPR's fairness principle requires the hospital to ensure the AI does not perpetuate or amplify existing societal biases, leading to discriminatory outcomes based on race, gender, or socioeconomic status. (B) Signup and view all the answers

A technology company collects location data from users through its mobile app. Which scenario poses the MOST significant risk of violating the GDPR principle of 'purpose limitation'?

Storing location data indefinitely and using it for unspecified future research purposes without obtaining new explicit consent. (D) Signup and view all the answers

A consumer living in California requests that a company delete their personal data under the California Consumer Privacy Act (CCPA). However, the company refuses the request, claiming that it needs the data to complete a pending transaction that the consumer initiated. Is the company's refusal justified under the CCPA?

Yes, the CCPA allows businesses to retain personal information if it is necessary to complete the transaction for which the personal information was collected. (B) Signup and view all the answers

An organization collects browsing history data to profile users for targeted advertising, arguing that it increases ad relevance and user satisfaction. What is a critical challenge this organization faces in justifying this processing under GDPR?

Demonstrating legitimate interests while ensuring users can easily object to profiling without detriment. (A) Signup and view all the answers

A data controller processes personal data based on consent. Which of the following scenarios would render that consent invalid under GDPR?

The consent was obtained through a pre-ticked box on a website form. (D) Signup and view all the answers

A company suffers a data breach and determines that the most sensitive data exposed was encrypted using an industry-standard encryption algorithm. However, the encryption keys were stored on the same server as the encrypted data. What GDPR principle is MOST directly implicated by this scenario?

Integrity and Confidentiality (B) Signup and view all the answers

An AI algorithm is used by a bank to automatically assess loan applications. The algorithm disproportionately denies loan applications from individuals in a specific ethnic group. Which of the following GDPR principles is most clearly violated?

Lawfulness, fairness and Transparency (C) Signup and view all the answers

What is the main impact of the Schrems II ruling on data transfers between the EU and the US?

It invalidated the Privacy Shield framework and requires companies to assess whether the laws in the recipient country offer equivalent protection to EU law when relying on Standard Contractual Clauses (SCCs). (B) Signup and view all the answers

Flashcards

Data privacy and processing regulations

Rules governing collection and processing of data that can identify a natural person.

General Data Protection Regulation (GDPR)

An EU regulation designed to protect the data and privacy of all individuals within the European Union.