SCENARIO Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting…

Question

Options

• ANot more than one month of receipt of Mike's request.
• BNot more than two months after verifying Mike's identity.
• CWhen all the information about Mike has been collected.
• DNot more than thirty days after submission of Mike's request.

• A
  92% (24)
• C
  4% (1)
• D
  4% (1)

Explanation

: According to the GDPR, the right of access by the data subject is one of the rights granted to individuals to obtain information about the processing of their personal data by a data controller. The data controller must provide a copy of the personal data undergoing processing and additional information, such as the purposes, the categories, the recipients, the retention period, the rights, the source, and the automated decision-making of the processing. The data controller must also inform the data subject of the existence of the right to access and the means to exercise it. The GDPR also specifies the time limit for responding to a data subject access request. The data controller must provide the information without undue delay and in any event within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests, but the data controller must inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. The data controller must also verify the identity of the data subject before providing the information, but this verification should not extend the time limit for responding to the request. In this scenario, Mike is an EU resident who has booked travel itineraries through XYZ Travel Agency and stayed at ABC Hotel Chain's locations. Both companies are U.S.-based multinational companies that use a common platform for collecting and sharing their customer data. Mike has signed the agreement to be a rewards program member of XYZ Travel Agency. Mike wants to know what personal information the company holds about him and sends an email requesting access to his data. Assuming that both companies are subject to the GDPR, either because they offer goods or services to individuals in the EU or because they monitor the behavior of individuals in the EU4, they must comply with the right of access by the data subject and provide Mike with the information he requests. The time period in which Mike should receive a response to his request is not more than one month of receipt of his request, unless there are grounds for extending the period by two further months. The companies must also verify Mike's identity before providing the information, but this verification should not affect the time limit for responding to the request. Therefore, the correct answer is A. Not more than one month of receipt of Mike's

No community discussion yet for this question.