Week 8 - GDPR Compliance Case Studies

Case Study 1: British Airways Data Breach

Scenario:
In 2018, British Airways experienced a data breach that exposed the personal information of approximately 400,000 customers. Hackers exploited weaknesses in BA’s security measures, leading to the unauthorized access of customer names, payment details, and addresses. Following the incident, the British Data Protection Authority (DPA) investigated the breach under GDPR regulations.

• I read it

• I read it

What GDPR principle was most directly violated in the British Airways data breach?

• Data Minimization

• Integrity and Confidentiality

• Purpose Limitation

• Storage Limitation

Under GDPR, British Airways is required to notify the DPA of the data breach within what timeframe?

• 24 hours

• 48 hours

• 72 hours

• 1 week

Which of the following actions would best demonstrate GDPR compliance after a data breach?

• Issuing a public apology without further action

• Implementing additional security measures and notifying affected individuals

• Changing the data controller’s position

• Storing breached data on a more secure server without notifying individuals

What right do the data subjects affected by the BA data breach have under GDPR in this scenario?

• Right to Portability

• Right to Object

• Right to Access

• Right to be Informed

Case Study 2: Google’s Consent Violation

Scenario:
Google was fined €50 million by the French Data Protection Authority (CNIL) for not obtaining valid consent for personalized advertising. The consent process was not transparent, and users found it challenging to navigate the privacy settings. CNIL ruled that Google’s consent mechanisms did not meet GDPR’s standards.

• I read

• I read

Under GDPR, which condition must be met for consent to be valid?

• Consent must be implied from the user’s activity.

• Consent must be freely given, specific, informed, and unambiguous.

• Consent must be required only when sensitive data is collected.

• Consent must be given verbally.

What key GDPR principle was violated by Google according to CNIL?

• Data Minimization

• Transparency

• Purpose Limitation

• Storage Limitation

Which of the following would make Google’s consent process GDPR-compliant?

• Automatically enrolling users in personalized ads

• Providing detailed and accessible explanations of data use in clear language

• Placing consent information in fine print in the terms and conditions

• Only offering a single opt-in option for all data processing activities

If users wish to withdraw their consent for personalized advertising, what GDPR right are they exercising?

• Right to Rectification

• Right to Erasure

• Right to Object

• Right to Data Portability