Module 1 - Understanding GDPR

1. What is the purpose of the General Data Protection Regulation?

CHOOSE ALL THAT APPLY

• To ensure all personal data is stored in one place

• To protect personal data & strengthen privacy rights of EU citizens

• To allow organisations to freely use individuals’ personal data for any purpose they deem necessary

• To give data subjects more control over their personal data

• To allow government agencies to track data stored on individuals

Who does GDPR apply to?

CHOOSE ALL THAT APPLY

• Anyone over the age of 18

• Everyone; worldwide

• Anyone who is a UK passport holder

• Anyone resident in the EU

• All organisations worldwide providing goods/services in the EU

What category of data subjects are covered by GDPR?

CHOOSE ALL THAT APPLY

• Vendors

• Suppliers

• General Public

• Employees

What size Company is mainly affected by GDPR?

CHOOSE ONE ANSWER

• With more than 100 employees

• With more than 500 employees

• With less than 100 employees

• With more than 1000 employees

• Size isn’t relevant

Data protection helps individuals protect & control use of their personal data. What is considered to be ‘personal data’?

CHOOSE ONE ANSWER

• Name, email address, date of birth and passport number

• All of option 1 plus bank account details, social network posts, medical information and computer IP address.

• All of option 1 and option 2 above, and under certain circumstances images of your face and information about your relatives and other data

• Information related to health, religious beliefs and political persuasion.

• Anything an individual chooses to define as being personal to them.

What data falls under ‘special category’ personal data and requires further security measures for processing?

CHOOSE ALL THAT APPLY

• Biometric

• Online identifiers (e.g. customer account number(s))

• Genetic

• Bank account details

• Health

There are 6 lawful basis for processing personal data. Which one of these is not a lawful basis.

CHOOSE ONE ANSWER

• Consent; an individual has given clear consent by opting in

• Direct marketing; to sell goods/services etc

• Vital interest; necessary to protect someone’s life

• Public task; required by law or to exercise an official

• Contract; required for the provision of a service

When can you legally use a data subject’s personal data for processing?

CHOOSE ONE ANSWER

• Immediately after they have logged on to our website for the first time

• Immediately if they don’t deselect a pre-ticket box asking for consent

• As soon as they have opened an account with People’s Energy

• Once we have explained how their data will be used and they have purposefully ticked a box agreeing to consent

• All of the above

What kind of cookies do not require opt-in consent?

CHOOSE ONE ANSWER

• Analytics (insight into how data subjects navigate our website site)

• Targeting (show how often data subjects visit our website/pages they visit)

• Functionality (used to manage choices made by data subjects and helps us support LiveChat)

• Strictly necessary (required to service a contract)

• Third party cookies (other companies services e.g. marketing and advertising)

Which of the following is NOT considered to be a data breach?

CHOOSE ONE ANSWER

• Lost data

• Stolen data

• Data inadvertently disclosed to a third party in error

• Failure to reply to an email from a data subject

• Computer failure