Pop-Up Game Quiz: Data Privacy Edition

Which of the following is considered personal data?

•   A. IP address

• B. Email address

• C. Employee ID

• D. All of the above

Ana, a Henkel employee in the Philippines, works in the Sales department. She receives a request from a long-time business partner asking for the mobile number and email address of another Henkel colleague, Mark, to discuss an urgent client-related concern. Wanting to help, Ana quickly shares Mark’s contact details via email without notifying him, believing it’s part of regular business operations.

Question:

  Which of the following best describes Ana’s action under the Philippine Data   Privacy Act of 2012 (RA 10173)?

• A. Ana did nothing wrong because the request came from a trusted partner and it       was work-related.

• B. Ana is allowed to share the information since it’s already known internally   within Henkel.

• C. Ana violated data privacy principles because she shared personal data without            consent or proper authorization.

• D. Ana complied with data privacy rules because sharing work contact                     information is considered part of “legitimate business interest.”

What should you do if you receive a suspicious email asking for login credentials?

• A. Reply and ask for more info

• B. Click the link to verify

• C. Report it to IT Security

•   D. Ignore it

What does GDPR stand for?

• A. General Data Protection Regulation

• B. Global Data Privacy Rules

• C. Government Data Protection Rights

• D. General Digital Privacy Regulation

Miguel, an HR assistant, receives a call from someone claiming to be a government auditor asking for the list of employees' home addresses for verification purposes. The caller insists it is urgent and provides an official-sounding job title, but no written request or official ID. Wanting to comply quickly, Miguel sends the file via email.

Question:

  Which of the following best describes Miguel's action under the Philippine Data   Privacy Act of 2012 (RA 10173)?

• A. Miguel acted correctly because the request came from a government representative.

• B. Miguel violated data privacy principles by sharing personal data without verifying the       request's legitimacy or securing proper authorization.

• C. Miguel complied with data privacy rules because government audits are allowed to             bypass consent requirements.

•   D. Miguel did nothing wrong because addresses are not sensitive data.

What is the main purpose of data privacy laws like the Data Privacy Act of 2012?

• A. To protect individuals' personal data and ensure lawful           processing

• B. To allow free sharing of data between companies

• C. To make all data publicly available

• D. To store as much data as possible

Which of the following is considered personal data?

•   A. Employee ID number

• B. Email address

•   C. Birthday

• D. All of the above

You receive an email requesting employee information. What should you do before responding?

• A. Send the data immediately

•   B. Verify the senders' identity and authorization

•   C. Ignore the email

• D. Forward it to everyone

Liza, a marketing coordinator, is preparing a presentation for a client. To make it more impressive, she includes a slide showing a screenshot of Henkel's internal dashboard that contains partial employee names and sales figures. She shares the presentation over email to an external client without removing the personal data.

Question:

  Which of the following best describes Liza's action under the Philippine Data   Privacy Act of 2012 (RA 10173)?

• A. Liza violated data privacy principles because she shared personal data externally            without a lawful basis or anonymizing it.

• B. Liza's action is acceptable because the information is only partial and work-related.

•   C. Liza did nothing wrong because sales figures are not personal data.

•   D. Liza is allowed to share the information if the client agrees to keep it confidential.