GDPR Quiz

What is the GDPR?

• A European Union regulation that aims to standardise the governance of personal information, particularly in terms of the security and protection of personal data.

• A European regulation on data sharing within companies.

• A European law obliging major browsers to comply on the use of personal data.

What does the GDPR require by law?

• Organisations must put in place technical and organisational measures to continuously ensure optimal data protection and be able to demonstrate this by documenting their compliance.

• Companies must share all user data with the European institutions in the interests of transparency.

• Organisations must keep data on European Internet users for a minimum of 5 years.

How does the GDPR define ‘personal data’?

• Any information relating to an identified or identifiable natural person

• Your IP addresses and all personal online information

• Your personal bank details and postal address

Who is primarily concerned by the GDPR?

• EU citizens and all bodies processing their data.

• Company employees.

• The major tech companies

What is considered as lawful consent in the GDPR?

• The simple act of downloading a document from a site or mobile application.

• A continuation of navigation on a site or a mobile application by a simple scroll.

What is the maximum fine for GDPR non-compliance?

• 50 million (€) and 50% of annual worldwide turnover.

• 20 million (€) or up to 4% of annual worldwide turnover.

• 10 million (€) and 2% of annual worldwide turnover.

• 5 million (€) and 1% of annual worldwide turnover.

What is the highest fine to date that has been handed out for GDPR non-compliance?

• 35 million to Amazon in December 2020.

• 50 million to Google in January 2019.

• 100 million to Google in December 2020.

• 75 million to Facebook in November 2019.

Does a data controller have to notify a data breach to the CNIL?

• Yes, only under certain conditions.

• No, they only need to inform the persons concerned.

• Yes, always.

• No, never.

Out of the data gathered by your digital analytics provider, which of the following categories of data are considered to be of a personal nature?

• IP addresses only.

• IP addresses, cookies, name of the site consulted and time of page consultation.

• Cookies only.

• Email addresses only.

In digital analytics, how long should data be kept?

• 37 months.

• 6 months.

• To be defined on a case-by-case basis by each organisation.

• 12 months.