What is the scope/goals of GDPR?
- Protect fundamental rights
- Free movement of personal data
GDPR aims to safeguard individuals’ personal data and ensure its free flow within the EU.
What does Art 2 of GDPR cover?
- Processing of personal data
- Wholly/partly automated systems
- Non-automated filing systems
This article defines the material scope of GDPR.
When does GDPR apply according to Art 3?
- EU establishments
- Offering goods/services in the EU
- Monitoring behavior of persons in the EU
This article outlines the territorial scope of GDPR.
Define the key terms in Art 4 of GDPR.
- Personal data
- Processing
- Controller
- Processor
- Consent
- Special categories
- Pseudonymisation
These definitions are crucial for understanding GDPR.
List the principles relating to processing as per Art 5.
- Lawfulness
- Fairness
- Transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity/confidentiality
- Accountability
These principles guide the processing of personal data.
What are the legal bases for processing under Art 6?
- Consent
- Contract
- Legal obligation
- Vital interests
- Public task
- Legitimate interests
These bases justify the lawful processing of personal data.
What conditions must be met for consent according to Art 7?
- Freely given
- Specific
- Informed
- Unambiguous
- Recordkeeping
- Easy withdrawal
Consent must be clear and easily revocable.
What is the age threshold for parental consent under Art 8?
Default 16, can be lowered to 13
This applies to information society services.
Under what conditions can special categories of data be processed according to Art 9?
- Explicit consent
- Employment law
- Vital interests
- Public interest
Processing of special categories is generally prohibited except for specific exceptions.
What does Art 10 state about processing of criminal conviction data?
- Only under official authority
- Safeguards required
- Member State law needed
This article regulates the handling of sensitive criminal data.
When is a controller not required to identify a data subject as per Art 11?
When identification is not possible
This limits the rights of data subjects in such cases.
What must a controller provide under Art 12?
- Concise information
- Transparent communications
- No undue delay
This ensures data subjects are informed about their rights and processing.
What information is required when data is collected from the data subject as per Art 13?
- Identity
- Purposes
- Legal basis
- Recipients
- Retention
- Rights
- Transfers
This article mandates transparency at the point of data collection.
What additional information must be provided when data is not collected from the data subject according to Art 14?
- Source info
- Categories of data
- Lawful basis
- Possible lack of access reasons
This ensures transparency even when data is sourced externally.
What rights does a data subject have under Art 15?
- Confirm processing
- Access copies
- Purposes
- Categories
- Recipients
- Retention
- Rights
- Source
- Profiling info
This article outlines the right of access for data subjects.
What is the right to rectification as per Art 16?
Right to correct inaccurate or incomplete data without undue delay
This ensures data accuracy for individuals.
What conditions apply to the right to erasure under Art 17?
- Consent withdrawn
- Unlawful processing
- Compliance with legal obligation
This is also known as the right to be forgotten.
What does Art 18 state about the right to restriction of processing?
- Temporarily limit processing when accuracy contested
- Unlawful processing
- Pending legal basis dispute
This right allows individuals to restrict how their data is used.
What is the notification obligation regarding rectification/erasure/restriction in Art 19?
Controller must inform recipients of changes unless impossible or disproportionate
This ensures accountability and transparency.
What is the right to data portability as per Art 20?
Right to receive personal data in structured, commonly used, machine-readable format
This allows individuals to transmit their data to another controller.
What does Art 21 state about the right to object?
- Object to processing based on public interest
- Object to direct marketing at any time
This right empowers individuals to control their data usage.
What does Art 22 say about automated individual decision-making?
Right not to be subject to solely automated decisions with legal/effective significant effects
There are exceptions to this right.
What are the restrictions mentioned in Art 23?
Member State or Union law may restrict certain GDPR rights for public interests
These restrictions must be under safeguards.
What is the responsibility of the controller as per Art 24?
Implement appropriate technical/organizational measures for compliance
This ensures accountability in data processing.
