CIPP-E · Question #131
SCENARIO Please use the following to answer the next question: The fitness company Vigotron has recently developed a new app called M-Health, which it wants to market on its website as a free…
The correct answer is C. Direct marketing requires explicit consent, whereas the registration form only provides for a right. According to the GDPR, personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. This means that data controllers must inform data subjects about the purposes of data…
Question
Options
- AIt is not legal to include fields requiring information regarding health status without consent.
- BProcessing health data requires explicit consent, but the form does not ask for explicit consent.
- CDirect marketing requires explicit consent, whereas the registration form only provides for a right
- DThe provision of the fitness app should be made conditional on the consent to the data
How the community answered
(26 responses)- A15% (4)
- B8% (2)
- C58% (15)
- D19% (5)
Explanation
According to the GDPR, personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. This means that data controllers must inform data subjects about the purposes of data processing and obtain their consent or another lawful basis for any new or different purposes. In the scenario, Brady transferred his customers' personal data to Hermes Designs, a third-party contractor, to fulfill a requested service. However, Hermes Designs used the data for a new purpose that was not disclosed to the customers: creating sample customized banner advertisements and conducting direct marketing. This is a violation of the purpose limitation principle and could expose Brady to legal risks and customer complaints.
Topics
Community Discussion
No community discussion yet for this question.