Test 2

21) Which of the following entities are data processors?

• a) Two companies sharing potential client contact data (name, telephone number, email address) in order for each of them to perform a marketing campaign for its own products

• b) Two companies that are using the same cloud tenant for their activities

• c) A company providing network machine learning security solutions together with relevant maintenance to its clients

• d) A company providing a bug identification tool that collects diagnosis data from users when an app crashes and sends it to the developer

22) Which of the following entities are independent data controllers?

• a) A call center company that makes calls to the clients of company A as per agreement with company A

• b) Insurance brokers that refer potential clients to an insurance company (sending name, telephone no., email address for those interested in purchasing insurance from the insurance company)

• c) Website that acts as an intermediary for renting/selling apartments held by individuals or legal entities

• d) A training company that offers trainings to employees of companies that have agreements concluded with this training company, as per the training requirements of such companies

23) Which of the following entities are joint data controllers?

• a) Two companies in the same group sharing the potential client data (interested in products offered by the group) and sending marketing communication for their own products.

• b) Joint marketing campaign made by two companies to offer bundled products (e.g. chocolate offered by a chocolate company and flowers offered by a flower shop)

• c) A website created and used by a bookstore and a furniture store selling libraries containing books

• d) Group-wide IT system used by each group company’s HR department for its own purpose, with a separate tenant for each company

24) Which of the following represent anonymized data by reference to the described database?

• a) The field name is transformed into “AAA” for all clients in a database including only this attribute and the favorite type of chocolate for each individual

• b) The unique national identification number (in Romanian: CNP) is transformed into a random number in a patient database that contains only this attribute and the disease from which the individual suffers

• c) The email addresses are scrambled within a database containing only email addresses, f irst and last names of individuals

• d) None

25) Which of the following represent pseudonymised data?

• a) Replacing the unique national identification number (in Romanian: CNP) with a random number in a database containing 10 attributes about an individual

• b) Hashing with MD5 the email address of a client in the database of an online store

• c) The tokens stored on an user device and used by an internet banking application during the authentication step

26) Who are the data subjects whose personal data is processed in the following scenario/data processing activity: John applies for a loan from a bank and provides to the bank the following requested information: he has relatives working as employees in the bank (in this case yes, his uncle), information about himself, his wife and his children?

• a) The bank

• b) John

• c) John’s uncle

• d) John’s wife

27) Which of the following are special types of personal data under the GDPR?

• a) Health data about an individual

• b) Political preference of an individual

• c) Financial data, such as bank account, salary

• d) Unique identification number (in Romanian: CNP)

28) Why is the location (country) of the servers holding data important?

• a) Storing data outside the EU may be subject to additional requirements

• b) Storing data outside the EEA is prohibited by the GDPR

• c) A company can only store data outside the EU on the servers of an EU company

• d) The need for standard model clauses may need to be analyzed if data is transferred outside the EU

29) What is the processing basis for the following situation: John Smith purchased a laptop from Retail Store. The Retail store inform John Smith via email when it obtained the laptop from its supplier and details about the delivery process/status?

• a) Contract

• b) Legitimate Interest

• c) Public Interest

• d) Consent

30) What is the processing basis for the following situation: John Smith discussed with an insurance broker that he wants an insurance from InsuranceCo Inc, but is not sure about what insurance to opt for. The insurance broker send this information to InsuranceCo Inc in order for InsuranceCo Inc to contact John Smith with details about offers?

• a) Consent

• b) Contract between the insurance broker and the insurance company

• c) Legitimate interest

• d) Legal obligation