CIPP-E · Question #52
SCENARIO Please use the following to answer the next question: Zandelay Fashion (`Zandelay') is a successful international online clothing retailer that employs approximately 650 people at its…
The correct answer is B. An explanation of the purposes and means of the intended processing. According to Article 36 of the GDPR, when a controller intends to process personal data that would result in a high risk to the rights and freedoms of data subjects, and a data protection impact assessment under Article 35 indicates that the risk cannot be mitigated by the…
Question
SCENARIO Please use the following to answer the next question:
Zandelay Fashion (`Zandelay') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation. The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers. In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures. Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme. Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay's business plan and associated processing activities. What must Zandelay provide to the supervisory authority during the prior consultation?
Options
- AAn evaluation of the complexity of the intended processing.
- BAn explanation of the purposes and means of the intended processing.
- CRecords showing that customers have explicitly consented to the intended profiling activities.
- DCertificates that prove Martin's professional qualities and expert knowledge of data protection law.
How the community answered
(32 responses)- A6% (2)
- B88% (28)
- C3% (1)
- D3% (1)
Explanation
According to Article 36 of the GDPR, when a controller intends to process personal data that would result in a high risk to the rights and freedoms of data subjects, and a data protection impact assessment under Article 35 indicates that the risk cannot be mitigated by the controller, the controller must consult the supervisory authority before processing. The purpose of this prior consultation is to seek the advice of the supervisory authority on whether the processing complies with the GDPR and what measures can be taken to ensure compliance. During the prior consultation, the controller must provide the supervisory authority with the following information: the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings; the purposes and means of the intended processing; the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to the GDPR; the contact details of the data protection officer, if any; the data protection impact assessment provided for in Article 35; and any other information requested by the supervisory authority. Therefore, the correct answer is B. An explanation of the purposes and means of the intended processing. This information is essential for the supervisory authority to understand the nature and scope of the processing and to assess its compliance with
Topics
Community Discussion
No community discussion yet for this question.