PDPF · Question #96
A controller asks a processor to produce a report containing customers who have purchased a particular product more than once in the past 6 months. The processor provides services to several…
The correct answer is B. The processor needs to notify the controller. And the controller can assess whether there were. In the example there is likely to be no risk to the data subjects or if it exists it will be very low, but this does not exempt the processor from notifying the Controller. However, at least the Controller should assess whether there is a need to notify the Supervisory Authority.
Question
A controller asks a processor to produce a report containing customers who have purchased a particular product more than once in the past 6 months. The processor provides services to several companies (which in this case are the controllers). When generating the requested report, it uses customer data collected by another controller, that is, for a different purpose. Fortunately, the error is noticed in time, the report is not sent, and nobody has had access to this dat
Options
- AThe processor notifies the Supervisory Authority that a violation has occurred. The controller will
- BThe processor needs to notify the controller. And the controller can assess whether there were
- CThe processor needs to notify the controller so that the controller notifies the Supervisory
- DAs the error was noticed in time and the report was not sent, there is no need for the processor to
How the community answered
(40 responses)- A15% (6)
- B55% (22)
- C5% (2)
- D25% (10)
Explanation
In the example there is likely to be no risk to the data subjects or if it exists it will be very low, but this does not exempt the processor from notifying the Controller. However, at least the Controller should assess whether there is a need to notify the Supervisory Authority.
Topics
Community Discussion
No community discussion yet for this question.