pnandapackirisamyCIPPE-Data Processing Principles & Special Categories of Data

Question 1

What does fairness principle under GDPR encompass?

Answer 1

The requirement that the controller take into account the interests and reasonable expectations of data subjects in the processing purposes

Question 2

Which legal basis do not apply to processing personal data for right to erasure of the data subject?

Answer 2

Legal Obligation and Public Interest

Question 3

Which legal basis do not apply to processing personal data for right to portability of the data subject?

Answer 3

Legal Obligation, Vital Interest, Public Interest and Legitimate Interest

Question 4

On what conditions do the legal basis apply to processing personal data for right to be subject to a decision based solely on automated data processing of the data subject?

Answer 4

It applies to the legal bases such as Consent, Contract and Legitimate interest provided suitable measures to safeguard the data subject rights and freedoms and legitimate interests atleast the right to obtain human intervention

Question 5

Public Authorities cannot rely on which legal bases when processing data in the performance of their tasks?

Answer 5

legitimate interest

Instead, they must rely on Article 6(1)(e) — because their processing must be grounded in law, not consent or legitimate interests. Their tasks are mandated by public authority, and GDPR requires a legal basis rooted in EU or Member State law for such processing.

Article 6(1)(e) requires a legal basis in Member State or EU law
This ensures:

Democratic legitimacy

Predictability

Accountability

Rule of law

Public authorities must be able to point to the specific law that empowers their processing.

Question 6

What is the relationship between legal bases for processing special categories of personal data in relationship between articles 6 and 9 of the GDPR?

Article 9 - Special categories and Article 6 - general legal bases

Answer 6

One of the conditions specified in Article 9 of the GDPR (special categories of personal data) has to be supported by a legal basis under Article 6 of the GDPR (general legal bases for processing personal data)

Question 7

What is the difference between right to erasure and right to be forgotten?

Answer 7

Right to Erasure refers to the ability to request the erasure of data and Right to be Forgotten refers to the obligation of the data controller to take reasonable steps to erase that data to the extent that it has been made public

Question 8

When does right to object not apply?

Answer 8

Where the legal basis for the processing is consent or performance of contract

Question 9

What are the two legal bases through which the right to object can be exercised?

Answer 9

Legitimate interest or Public Interest/Official Authority

Question 10

What is principle of lawfulness?

Answer 10

The principle of lawfulness requires processing only when a legal basis exists, and transparency demands informing data subjects via a privacy notice.

Question 11

What are the top 3 conditions that must be met in order for a data controller to claim legitimate interest under GDPR?

Answer 11

A legitimate interest pursued by the controller or a third party is the first condition for using legitimate interest as a basis, Necessity of processing is the second condition, ensuring data handling is proportionate, Balancing against data subject rights is the third condition for claiming legitimate interest.

Question 12

What is Legitimate Interest Assessment?

Answer 12

An LIA is a balancing test required under the GDPR when relying on legitimate interests as a legal basis. It assesses whether the interest is lawful, the processing is necessary and the impact on data subjects is proportionate

Question 13

What is the term of the Supervisory Authorities?

Answer 13

No less than 4 years

Question 14

What is the timeframe for the Supervisory authority to respond to a consultation when DPIA has demonstrated a high risk that cannot be mitigated?

Answer 14

Within a period of upto 8 weeks and can be extended by another six weeks in case of more complex

Question 15

Is the concept of Lead Supervisory Authority present under the Law Enforcement Directive (LED)?

Answer 15

No. Individual country Supervisor is competent and responsible in their own member state

Question 16

Which lawful basis is never available for processing special category data?

Answer 16

Legitimate interest

Question 17

When is hospital processing health data without explicit consent lawful?

Answer 17

Yes, if processing is necessary for medical diagnosis or provision of health care under Art. 9(2)(h).

Question 18

What is required for a political party to process ethnicity data for targeted campaigning? Which Art. 9 condition might apply?

Answer 18

Explicit consent (if freely given and specific).

Question 19

A company infers sexual orientation from browsing behaviour. Does this count as special category data?

Answer 19

Yes — inferred data can become special category if it reveals sensitive traits

Question 20

A controller wants to reuse data for a new purpose. What test applies?

Answer 20

Compatibility test (Art. 6(4)).

Question 21

A controller processes special category data for scientific research. Which condition applies?

Answer 21

Art. 9(2)(j) — research with safeguards under Art. 89.

Question 22

A company uses AI to infer health conditions. Is this special category processing?

Answer 22

Yes — inferred health data is treated as special category.

Question 23

A controller claims “we may use your data for any future business purpose.” Which principle is violated?

Answer 23

Purpose limitation

Question 24

A company deletes identifiers but keeps IP addresses. Is this anonymisation?

Answer 24

No — IP addresses are personal data

Question 25

A controller processes special category data without meeting an Art. 9 condition. What is the consequence?

Answer 25

Processing is unlawful regardless of Art. 6 lawful basis.

Question 26

A company processes criminal conviction data without meeting Art. 10 requirements. What is required?

Answer 26

Processing must be under official authority or authorised by EU/national law.

Question 27

A controller uses “legitimate interest” for behavioural advertising. What recent trend affects this?

Answer 27

EDPB & CJEU rulings (e.g., Meta) restrict Legitimate Interest for behavioural ads

Question 28

A controller processes special category data for employment law obligations. Which condition applies?

Answer 28

Art. 9(2)(b).

Question 29

A company processes genetic data for ancestry testing. What is required?

Answer 29

Explicit consent (Art. 9(2)(a)).

Question 30

A controller uses CCTV with facial recognition in a shopping mall. Which principle is most at risk?

Answer 30

Necessity & proportionality (linked to data minimisation).

Question 31

A company claims “we comply with GDPR because we encrypt data.” Which principle is misunderstood?

Answer 31

Accountability — compliance requires more than technical measures.

Question 32

A controller processes special category data for public health. Which condition applies?

Answer 32

Art. 9(2)(i).

Question 33

A company uses AI to profile individuals for creditworthiness. Which principle is most relevant?

Answer 33

Fairness

Question 34

A controller stores special category data in plain text. Which principle is violated?

Answer 34

Integrity and confidentiality.

Question 35

A company processes data for a purpose not disclosed in the privacy notice. Which principle is violated?

Answer 35

Transparency & purpose limitation

Question 36

A controller processes special category data based on “contract.” Is this valid?

Answer 36

No — contract is not an Art. 9 condition.

Question 37

A company uses “soft opt‑in” for marketing. Does this apply to special category data?

Answer 37

No — special category data always requires Art. 9 condition

Question 38

A company processes political opinions for analytics. Which condition applies?

Answer 38

Explicit consent or substantial public interest (if authorised by law)

Question 39

A controller uses “public interest” as a lawful basis. What must be true?

Answer 39

The processing must be grounded in EU or Member State law.

Question 40

What is required for criminal conviction data processing?

Answer 40

Art. 10 — official authority or law.

Question 41

What principle is violated by “collect everything now, decide later”?

Answer 41

Purpose limitation + data minimisation.

Question 42

What principle is most relevant to DPIAs?

Answer 42

Accountability

Question 43

What principle is most relevant to AI profiling?

Answer 43

Fairness