WorksheetsLaw and Data Protection_Data Subject Rights
Total questions: 24
Worksheet time: 12mins
Sarah notices that an online retailer's marketing emails keep addressing her as "Steve." She wants this corrected.
Which GDPR right should Sarah invoke?
Right to erasure
Right to rectification
Right to object
Right to access
A fitness app has collected Marcus's workout data for two years. He wants to switch to a new fitness platform and transfer all his historical workout data.
What GDPR right supports Marcus's request?
Right to data portability
Right to access
Right to be informed
Right to object
Elena discovers that her ex-employer still has her data five years after she left the company. All legal retention periods have expired.
What GDPR right can Elena exercise?
Right to restrict processing
Right to be forgotten
Right to object
Right to rectification
A bank uses an AI system to reject loan applications automatically. James was denied a loan without any human review.
What right allows James to challenge this decision?
Right to object
Right to human intervention in automated decision-making
Right to access
Right to rectification
Lisa receives marketing emails from a company she never interacted with. They got her email from a partner organisation.
What immediate right can Lisa exercise?
Right to be informed of the data source
Right to object to direct marketing
Right to erasure
All of the above
Tom's medical records at his local clinic contain information about a condition he never had.
What rights apply in this situation?
Right to rectification only
Right to rectification and right to restrict processing while accuracy is verified
Right to erasure only
Right to object only
An online store suffers a data breach exposing customer data. They notify Maria 45 days after discovering the breach.
What GDPR requirement was violated?
Right to be informed within 72 hours
Right to access within 30 days
Right to object within 48 hours
Right to erasure within 60 days
David requests his data from a social media company. They send him only his basic profile information, excluding his post history and likes.
Is this response compliant?
Yes, basic profile information is sufficient
No, they must provide all personal data they process
Yes, if they delete the other information
Yes, if they inform him why other data is excluded
A research organisation wants to keep processing Anna's data despite her objection, claiming scientific research purposes.
Can they do this?
No, objections must always be honoured
Yes, if they can demonstrate compelling legitimate grounds
Yes, without any conditions
No, unless Anna withdraws her objection
Peter requests his data be erased from a government tax database.
Should his request be honored?
Yes, it's his fundamental right
No, tax records are required by law
Yes, if he pays his taxes first
No, unless he moves abroad
A 15-year-old created an account on a gaming platform using parental consent. She wants to withdraw consent.
What should happen?
Nothing; the original parental consent remains valid
The platform must stop processing and potentially erase the data
New parental consent is required
Wait until she turns 18
An insurance company takes 45 days to respond to Clara's access request, citing many requests.
Is this acceptable?
No, they must respond within 30 days
Yes, if they informed Clara about the extension
Yes, high volume automatically extends the deadline
No, they must respond within 72 hours
Mark requests his data from a company, but they ask him to pay a €50 fee first.
Is this allowed?
Yes, companies can charge any fee
Yes, but only if the request is complex
Only if this is a repeated request
No, access requests must be free
A retail company profiles customers' purchasing habits for personalised recommendations. Sophie wants to understand how this affects her.
What right allows her to understand this profiling?
Right to be informed about automated decision-making
Right to access profiling criteria
Right to object to profiling
All of the above
John's bank refuses his portability request for his transaction history, saying the format is too complex.
Is this valid?
Yes, if the data format is truly complex
Yes, but only for transactions over 12 months old
No, but they can charge a fee
No, they must provide the data in a machine-readable format
A company responds to Maria's access request by asking her to prove her identity with multiple documents.
Is this appropriate?
No, they should trust her email address
Yes, they can request reasonable ID verification
No, GDPR prohibits ID verification
Only if she's requesting sensitive data
A photography company published Robert's photo in their portfolio. He requests its removal.
What factors determine if they must comply?
Balance between Robert's privacy rights and the company's legitimate interests
Only whether Robert paid for the photo
Only the photo's commercial value
Whether the photo is artistic
Emma discovers her data is being processed by a third-party processor she never heard of.
What are her rights?
She can only contact the leading company
She can exercise her rights directly with the processor
She has no rights against processors
She must go to court
Due to technical limitations, A company tells Paul they need 6 months to fulfil his erasure request.
Is this acceptable?
Yes, if technical limitations are genuine
No, erasure must be done without undue delay
Yes, if they stop processing meanwhile
Only if Paul agrees
Sandra's gym shares her attendance data with her health insurance for discounts.
What rights should she have been informed about?
Only the right to object
Only the right to withdraw consent
All her GDPR rights plus the legal basis for sharing
No rights as this benefits her
A video surveillance company operates cameras in a shopping mall. Maya notices her image appears in their promotional materials, showing their security system's effectiveness.
What GDPR rights can Maya exercise?
Only right to erasure
Right to object and right to erasure
No rights as it's public space footage
Only right to compensation
Carlos discovers that several companies are still processing his deceased father's data.
What is the correct approach under GDPR?
GDPR rights automatically transfer to the next of kin
GDPR doesn't cover deceased individuals' data, but national laws might apply
Rights can only be exercised through a court order
Companies must automatically delete deceased persons' data
An AI company uses LinkedIn profile photos to train its facial recognition system. Jennifer wants to know if her photo is in the training dataset.
Which combination of rights applies?
Right to access only
Right to access and right to object to this processing
Right to access, right to object, and right to erasure
No rights as the data is publicly available
A freelancer's client shares their invoice (containing personal data) with their accountant and tax advisor.
Is this a GDPR violation?
No, as it's necessary for legal obligations
Yes, but it's exempt from requiring consent
Yes, and the freelancer should have been informed about this sharing
No, as invoices aren't personal data
