Law and Data Protection_Data Subject Rights

Sarah notices that an online retailer's marketing emails keep addressing her as "Steve." She wants this corrected.

   Which GDPR right should Sarah invoke?

• Right to erasure

• Right to rectification

• Right to object

• Right to access

A fitness app has collected Marcus's workout data for two years. He wants to switch to a new fitness platform and transfer all his historical workout data.

   What GDPR right supports Marcus's request?

• Right to data portability

• Right to access

• Right to be informed

• Right to object

Elena discovers that her ex-employer still has her data five years after she left the company. All legal retention periods have expired.

   What GDPR right can Elena exercise?

• Right to restrict processing

• Right to be forgotten

• Right to object

• Right to rectification

A bank uses an AI system to reject loan applications automatically. James was denied a loan without any human review.

   What right allows James to challenge this decision?

• Right to object

• Right to human intervention in automated decision-making

• Right to access

• Right to rectification

Lisa receives marketing emails from a company she never interacted with. They got her email from a partner organisation.

   What immediate right can Lisa exercise?

• Right to be informed of the data source

• Right to object to direct marketing

• Right to erasure

• All of the above

Tom's medical records at his local clinic contain information about a condition he never had.

   What rights apply in this situation?

• Right to rectification only

• Right to rectification and right to restrict processing while accuracy is verified

• Right to erasure only

• Right to object only

An online store suffers a data breach exposing customer data. They notify Maria 45 days after discovering the breach.

   What GDPR requirement was violated?

• Right to be informed within 72 hours

• Right to access within 30 days

• Right to object within 48 hours

• Right to erasure within 60 days

David requests his data from a social media company. They send him only his basic profile information, excluding his post history and likes.

   Is this response compliant?

• Yes, basic profile information is sufficient

• No, they must provide all personal data they process

• Yes, if they delete the other information

• Yes, if they inform him why other data is excluded

A research organisation wants to keep processing Anna's data despite her objection, claiming scientific research purposes.

   Can they do this?

• No, objections must always be honoured

• Yes, if they can demonstrate compelling legitimate grounds

• Yes, without any conditions

• No, unless Anna withdraws her objection

Peter requests his data be erased from a government tax database.

Should his request be honored?

• Yes, it's his fundamental right

  
  

• No, tax records are required by law

• Yes, if he pays his taxes first

• No, unless he moves abroad