Free CIPP-E Practice Test Questions and Answers (2026)

Under the General Data Protection Regulation (GDPR), Articles 33 and 34 specify the minimum information a data controller must provide in a data breach notification. This includes the likely consequences of the breach, the measures being taken to mitigate it, and the contact details of the Data Protection Officer (DPO). However, the GDPR does not explicitly require the controller to provide a detailed description of the specific security safeguards that were in place to protect the data prior to the breach. While the "nature of the breach" must be described, this focuses on what happened, not on a full disclosure of the pre-existing security architecture.

A. This is incorrect. Article 33(3)(c) of the GDPR explicitly requires the controller to "describe the likely consequences of the personal data breach" in the notification to the supervisory authority.
B. This is incorrect. Article 33(3)(d) of the GDPR mandates that the notification must "describe the measures taken or proposed to be taken by the controller to address the personal data breach."
D. This is incorrect. Article 33(3)(b) of the GDPR requires the notification to include "the name and contact details of the data protection officer or other contact point where more information can be obtained."

1. Regulation (EU) 2016/679 (General Data Protection Regulation).

Article 33(3), points (b), (c), and (d) explicitly list the requirements for providing DPO contact details, likely consequences, and measures taken. The regulation does not list "type of security safeguards used" as a mandatory element of the notification.

Article 34(2) references the requirements in Article 33(3) for communication to the data subject.

2. Article 29 Data Protection Working Party, "Guidelines on Personal data breach notification under Regulation 2016/679" (WP250rev.01), 6 February 2018.

Section IV.A, pages 15-17: This section details the "Information to be provided to the supervisory authority." It elaborates on the requirements of Article 33(3) and confirms that information on consequences, remedial measures, and DPO contacts is mandatory. It does not state a requirement to list pre-existing security safeguards.

Binding Corporate Rules (BCRs) are internal data protection policies used by multinational corporate groups for international data transfers. A fundamental requirement under Article 47 of the GDPR is that these rules must be legally binding on every member of the group and their employees. This ensures a consistent and adequate level of data protection for personal data throughout the entire organization, irrespective of the geographical location where the data is processed. The rules create a uniform compliance framework, making them binding in their entirety on all relevant staff to guarantee the protection of personal data transferred within the group.

A. This describes ad hoc contracts or Standard Contractual Clauses (SCCs), which are separate transfer mechanisms, not the group-wide policy framework of BCRs.
C. BCRs establish a uniform, high standard (GDPR-level) across the entire group, which often exceeds the requirements of local laws in non-EU jurisdictions.
D. BCRs are a mechanism for compliance and do not grant any exemption from legal enforcement by supervisory authorities or courts.

1. General Data Protection Regulation (GDPR) (EU) 2016/679:

Article 47(1)(a): States that approved BCRs must "be legally binding on every member concerned of the group of undertakings, or group of enterprises engaged in a joint economic activity, including their employees".

2. European Data Protection Board (EDPB), formerly Article 29 Working Party, "Working Document setting up a table with the elements and principles to be found in Binding Corporate Rules for Controllers (BCR-C)," WP 256 rev.01, adopted on 6 February 2018.

Section 2.1, "Legally Binding": This section explicitly requires that BCRs must be made binding on "each member of the group concerned, and on their employees, through appropriate means (e.g. unilateral declarations, intra-group agreements, clauses in the employment contracts etc.)".

3. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Chapter 15, Section 15.4.2, "Content of the BCRs," p. 361: The text explains that a core requirement for BCRs is that they "must be legally binding for the companies of the group and their employees." This underscores the universal application within the organization. (DOI: 10.1007/978-3-319-57959-7)

The ePrivacy Directive (2002/58/EC), often referred to as the "cookie law," specifically governs the processing of personal data and the protection of privacy in the electronic communications sector. Article 5(3) of this Directive mandates that storing information or gaining access to information already stored in the terminal equipment of a user (such as a mobile device) is only allowed with the user's prior, informed consent. Since cookies involve storing and accessing information on a user's device, a mobile application using them falls directly under this consent requirement.

B. The E-Commerce Directive: This directive focuses on harmonizing rules for online services, including the liability of intermediary service providers and rules for online contracts, not consent for cookies.
C. The Data Retention Directive: This directive, which was invalidated by the CJEU in 2014, concerned the mandatory retention of telecommunications data for law enforcement purposes, not user consent.
D. The EU Cybersecurity Directive: Also known as the NIS Directive, this legislation aims to enhance cybersecurity capabilities and requires operators of essential services to implement security measures; it does not regulate cookie consent.

1. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). See Article 5(3), which establishes the consent requirement for accessing or storing information on a user's terminal equipment.

2. Article 29 Data Protection Working Party, Opinion 2/2013 on apps on smart devices, 00461/13/EN WP 202, 27 February 2013. Page 8, Section 3.1 states, "The consent rule in Article 5(3) of the e-Privacy Directive applies to anyone who stores information or gains access to information stored in the terminal equipment of a user. This rule is technology neutral and applies to any type of information and any type of terminal equipment, including smart devices."

3. Kuner, C., Bygrave, L. A., & Docksey, C. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. In the commentary on Article 95 GDPR (Relationship with Directive 2002/58/EC), the text clarifies that the specific rules of the ePrivacy Directive, such as those on cookies (Art 5(3)), continue to apply alongside the GDPR.

The concept of the “concerned supervisory authority” is a cornerstone of the GDPR's one-stop-shop and cooperation mechanism for cross-border data processing. When a single Lead Supervisory Authority (LSA) takes the lead on an investigation, the processing may still substantially affect individuals in other EU Member States. The GDPR establishes the role of the "concerned supervisory authority" to ensure these other authorities can participate in the decision-making process. Their primary function is to represent the interests and protect the rights of data subjects within their own territory, ensuring local concerns are addressed in a centralized enforcement action.

A. This is a goal of the overall consistency mechanism (Chapter VII), but the specific role of the "concerned SA" is primarily about representation, not a general encouragement of local consistency.
B. This is incorrect. The Lead Supervisory Authority is determined by the controller's main establishment, not chosen by the corporation. The concept actually limits the LSA's unilateral power.
C. While the SA where a representative is located can be competent, this is a specific application of territorial scope, not the main reason for creating the "concerned SA" concept, which applies more broadly.

1. General Data Protection Regulation (EU) 2016/679:

Article 4(22): Defines a ‘concerned supervisory authority’ as one where the controller/processor is established, where data subjects residing in its Member State are substantially affected, or where a complaint has been lodged.

Article 60(3): Mandates that the lead supervisory authority shall submit a draft decision to the other concerned supervisory authorities for their opinion and shall take due account of their views. This codifies their representative role.

2. Article 29 Working Party, Guidelines on the Lead Supervisory Authority, WP244 rev.01, adopted on 5 April 2017, as endorsed by the EDPB.

Section 3.3, "The role of the Concerned Supervisory Authorities (CSAs)": "The CSAs are primarily responsible for representing the interests of the data subjects in their own territory. The GDPR provides the CSAs with the power to object to a draft decision of the LSA... This ensures that the concerns of a CSA about the processing affecting data subjects in its territory are taken into account by the LSA." (Page 15).

The General Data Protection Regulation (GDPR), in Article 45(9), specifies that adequacy decisions adopted by the European Commission under the previous Data Protection Directive 95/46/EC remain in force. Switzerland was granted an adequacy decision under the old Directive. This decision was "grandfathered" and continues to be valid under the GDPR until it is amended, replaced, or repealed by a new Commission decision. Therefore, data can flow from the EU/EEA to Switzerland without requiring additional transfer mechanisms, based on this ongoing adequacy status.

A. Greece: As a member state of the European Union, the GDPR applies directly. Data transfers to Greece are intra-EU and not considered international transfers requiring an adequacy decision.
B. Norway: As a member of the European Economic Area (EEA), the GDPR is incorporated into its national law. Data transfers to Norway are not considered international transfers requiring an adequacy decision.
C. Australia: Australia does not hold a general adequacy decision from the European Commission. Data transfers to Australia require other appropriate safeguards under Chapter V of the GDPR.

1. Regulation (EU) 2016/679 (GDPR):

Article 45(9): "A decision adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article." This provision directly supports the continuation of Switzerland's adequacy status.

2. European Commission, "Adequacy decisions":

The official European Commission webpage on adequacy decisions lists the countries, including Switzerland, whose adequacy findings under Directive 95/46/EC are still in force. It states, "The GDPR continues the adequacy logic of the 1995 Data Protection Directive." (Accessed via the official European Union website, europa.eu).

3. Kuner, C., Bygrave, L. A., & Docksey, C. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press.

Article 45, para. 45.118: The commentary explains that Article 45(9) acts as a transitional provision, ensuring the continued validity of adequacy decisions made under the Directive, explicitly mentioning Switzerland as one of the jurisdictions covered by such a decision.

4. Hijmans, H. (2016). The European Union as a constitutional guardian of internet privacy and data protection. In Fairness, Privacy and Transparency in the Age of Big Data (pp. 42-57). Edward Elgar Publishing.

This academic text discusses the framework for international data transfers, noting the continuity of the adequacy mechanism from the Directive to the GDPR, which is the legal basis for Switzerland's ongoing status. (See discussion on the legal framework for third-country transfers).

Article 9(1) of the GDPR establishes a general prohibition on the processing of "special categories of personal data." This is an exhaustive list that includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation. Financial data, while often considered highly sensitive and subject to strict security requirements under the GDPR (e.g., Article 32), is not included in the specific list of special categories in Article 9(1). Therefore, its processing is not expressly prohibited under this particular article.

A. Personal data revealing ethnic origin is explicitly listed as a special category of data in Article 9(1) of the GDPR.
B. Personal data revealing genetic data is explicitly defined in Article 4(13) and listed as a special category in Article 9(1) of the GDPR.
D. Personal data revealing trade union membership is explicitly listed as a special category of data in Article 9(1) of the GDPR.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, L 119/1.

Article 9(1): "Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited." This text directly supports that options A, B, and D are prohibited categories, while C is absent from the list.

2. Kuner, C., Bygrave, L. A., & Docksey, C. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press.

Commentary on Article 9, Section 9.24: This section clarifies that the list of special categories in Article 9(1) is exhaustive. It notes that other types of sensitive data, such as financial data, are not included, although they may be subject to heightened protection obligations under other GDPR provisions.

3. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Chapter 3, Section on "Special Categories of Personal Data," pp. 99-101: This guide explicitly discusses the scope of Article 9, confirming the enumerated list and distinguishing it from other sensitive data types like financial information, which fall under the general definition of personal data in Article 4(1) but not the special categories of Article 9.

This scenario requires a DPIA because it involves multiple high-risk processing criteria as outlined by the European Data Protection Board (EDPB). Building a dating app that creates profiles based on location data and third-party data constitutes:
1. Profiling and evaluation on a large scale: Creating candidate profiles for matching.
2. Combining datasets: Merging location data with data from other sources.
3. Automated decision-making with a significant effect: The app's algorithm determines potential partners, which can significantly affect an individual's personal and social life. This combination of factors, particularly the profiling for automated decisions with significant effects, makes the processing "likely to result in a high risk" under GDPR Article 35(3)(a), thus mandating a DPIA.

A. While combining data for personalization involves profiling, it does not inherently rise to the level of "high risk" or "similarly significant effect" that mandates a DPIA.
B. Inferring purchasing habits is a form of profiling, but it is generally considered a lower-risk marketing activity compared to profiling that affects social opportunities or legal rights.
D. Although this involves systematic monitoring of employees, the stated purpose is operational efficiency, which is a legitimate interest. It is less likely to be considered high-risk than the scenario in C, which has a more direct and significant impact on an individual's personal life.

1. General Data Protection Regulation (EU) 2016/679, Article 35(3)(a): A DPIA is required for "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person". The dating app scenario directly aligns with this provision.

2. European Data Protection Board (EDPB), Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679 (WP248 rev.01), Section IV.B, page 10-12: These guidelines list criteria for identifying high-risk processing. The scenario in option C meets multiple criteria, including "Evaluation or scoring," "Automated-decision making with legal or similar significant effect," and "Matching or combining datasets." The guidelines state that meeting two or more criteria generally indicates the need for a DPIA.

3. Kamara, I., de Hert, P., & Tzanou, M. (2020). The EU General Data Protection Regulation: A Commentary. Oxford University Press. Commentary on Article 35, Section 35.31: This academic commentary explains that profiling which significantly affects individuals, such as determining access to social benefits or opportunities (which can be analogized to a dating app's matching function), is a clear trigger for a DPIA.

The primary aim of Directive 95/46/EC was to resolve the tension between two core objectives of the European Union: establishing a single internal market and protecting fundamental human rights. Before the Directive, differing national data protection laws created barriers to cross-border data flows, hindering economic activity. The Directive sought to harmonize these laws, thereby facilitating the free movement of personal data between member states, which is essential for the internal market. Simultaneously, it aimed to ensure that this free flow did not come at the expense of a high, consistent level of protection for individuals' fundamental rights and freedoms, particularly their right to privacy concerning the processing of personal data.

A. The Directive's scope was specific to data protection to facilitate the internal market, not to harmonize the implementation of the entire European Convention on Human Rights.
B. While influenced by the OECD Guidelines, the Directive's purpose was to create binding EU law for the internal market, not merely to implement non-binding international guidelines.
C. The Directive did not aim to prevent transfers but to regulate them by setting conditions (e.g., adequacy) to ensure protection when data left the European Economic Area.

1. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Official Journal L 281, 23/11/1995 P. 0031 - 0050.

Recital (3): States that the internal market requires "...not only that personal data should be able to flow freely from one Member State to another, but also that the fundamental rights of individuals should be safeguarded."

Article 1(1) & 1(2): Explicitly state the dual objective: Member States shall protect fundamental rights (1) and shall not restrict or prohibit the free flow of personal data between Member States for reasons connected with that protection (2).

2. Kuner, C. (2013). European Data Protection Law: Corporate Compliance and Regulation (2nd ed.). Oxford University Press.

Chapter 2, Section 2.3.2, p. 43: Explains that the Directive was based on the EU's internal market powers and "was intended both to ensure the free flow of personal data within the EU, and to provide a harmonised and high level of protection for it."

3. Bygrave, L. A. (2014). Data Privacy Law: An International Perspective. Oxford University Press.

Chapter 3, p. 60: Notes that the Directive's "twin aims" were "to facilitate the transborder flow of personal data within the European Economic Area... and to ensure a high and harmonised level of protection for data subjects throughout this region."

The requirement for a controller to document personal data breaches is mandated by Article 33(5) of the GDPR, not Article 30. Article 30 specifically outlines the requirements for maintaining Records of Processing Activities (RoPA). While documenting breaches is a critical GDPR obligation, it is a separate and distinct requirement from the RoPA. The RoPA serves as an inventory of data processing, whereas the breach log documents incidents and the response to them.

B. Data inventory or data mapping exercises that have been conducted. This is incorrect because the records required by Article 30 constitute the formal output of a data inventory or data mapping exercise. Therefore, maintaining these records is effectively a requirement to document the results of such exercises.
C. Categories of recipients to whom the personal data have been disclosed. This is incorrect as it is an explicit requirement listed under Article 30(1)(d) for the controller's records of processing activities.
D. Retention periods for erasure and deletion of categories of personal data. This is incorrect as it is an explicit requirement listed under Article 30(1)(f), which states records must include, "where possible, the envisaged time limits for erasure of the different categories of data." ---

1. Regulation (EU) 2016/679 (General Data Protection Regulation)

Article 30(1)(d) & (f): Specifies that the controller's records shall contain "the categories of recipients to whom the personal data have been or will be disclosed" and "where possible, the envisaged time limits for erasure of the different categories of data." This directly refutes options C and D.

Article 33(5): States, "The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken." This confirms that the requirement in option A exists but falls under a different article than the one specified in the question.

2. Information Commissioner's Office (ICO), UK. "Guide to the UK General Data Protection Regulation (UK GDPR), Documentation."

Section: Records of processing activities (Article 30): This section details the specific information that must be included in the RoPA, aligning with the text of Article 30 and confirming that options C and D are required. It describes the RoPA as the output of data mapping, making option B an implicit requirement.

Section: Logging and records of breaches (Article 33): This section is distinct from the Article 30 guidance and explicitly states, "You must document all breaches, regardless of whether or not you need to notify." This clearly separates the breach documentation requirement from the Article 30 RoPA.

3. European Data Protection Board (EDPB). "Guidelines 01/2021 on Examples regarding Data Breach Notification."

Page 6, Paragraph 13: "According to Article 33(5) GDPR, the controller has to document any personal data breaches... This documentation must be distinguished from the records of processing activities according to Article 30 GDPR." This official guidance explicitly distinguishes the two record-keeping obligations, confirming that the breach log (Option A) is not part of the Article 30 record.

Article 14(3)(a) of the GDPR specifies the timeframe for providing information when personal data is not obtained directly from the data subject. The controller must provide the information "within a reasonable period after obtaining the personal data, but at the latest within one month." While other conditions in Article 14(3) can shorten this period (e.g., at the time of first communication or disclosure), the one-month deadline serves as the absolute latest point in time under the general rule, making this option the most accurate and comprehensive answer.

A. This is incorrect because "as soon as possible" is too vague. The GDPR provides a more specific outer limit of one month, which is a critical part of the requirement.
B. This is incorrect because it misrepresents the rule. The information must be provided at the latest at the time of the first communication, not after. It is also only one of three potential deadlines, not the general rule.
D. This is incorrect because the maximum period stipulated by the GDPR is one month, not eight weeks.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 14(3)(a). The official text states the controller shall provide the information: "within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed".

2. European Data Protection Board (EDPB), Guidelines on Transparency under Regulation 2016/679 (WP260 rev.01), adopted on 29 November 2017, as last revised and adopted on 11 April 2018, Page 29. The guidelines clarify: "Article 14(3) requires that the information must be provided to the data subject within a 'reasonable period' after obtaining the data, but at the latest within one month."

3. Bygrave, L. A. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. In the commentary on Article 14, it is explained that the default position for the timing of information provision is a "reasonable period" not exceeding one month from the point of data acquisition. (Specific reference to commentary on Article 14, paragraph 3).

The General Data Protection Regulation's (GDPR) requirement for parental consent, as outlined in Article 8, applies specifically when processing a child's data for information society services is based on the legal basis of consent (Article 6(1)(a)). However, processing can be lawful under other legal bases. The provision of preventive or counselling services directly to a child is often carried out in the public interest or as part of a legal obligation related to child welfare and protection (Article 6(1)(e) or 6(1)(c)). In these situations, consent is not the legal basis for processing, and therefore the parental consent requirements of Article 8 do not apply, allowing these vital services to be provided confidentially.

A. Market research is a commercial activity; this interest would not override the fundamental rights and specific protections afforded to children under the GDPR.
C. While educational, if the materials are provided via an "information society service," parental consent would likely be required if consent is the chosen legal basis.
D. Legitimate interest is generally not an appropriate legal basis for processing children's data, as their rights and interests are given special weight and are likely to be overriding.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 8(1). This article specifies that the rules for parental consent apply "Where point (a) of Article 6(1) [consent] applies, in relation to the offer of information society services directly to a child". This clarifies that the rule is tied to consent as the legal basis.

2. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 6(1)(c) and 6(1)(e). These articles provide alternative lawful bases for processing, such as compliance with a "legal obligation" or for the "performance of a task carried out in the public interest," which are often the bases for child protective services.

3. European Data Protection Board (EDPB), Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1, adopted on 4 May 2020, paragraph 130. The guidelines state: "Article 8 only applies to information society services offered directly to a child. It does not apply to the processing of children’s personal data in other contexts, such as processing operations by public authorities for education or child protection purposes."

4. Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 38. This recital emphasizes that "Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights". This underpins why commercial interests (A, D) are unlikely to justify processing without robust safeguards like parental consent.

The extraterritorial effect of the GDPR is primarily established by Article 3(2). This article extends the regulation's scope to controllers or processors not established in the European Union (EU) if their processing activities relate to either: (a) the offering of goods or services to data subjects who are in the Union, or (b) the monitoring of the behavior of data subjects as far as their behavior takes place within the Union.
Option D perfectly describes the scenario in Article 3(2)(a). A non-EU business that "targets EU customers" is engaging in the "offering of goods or services" to data subjects in the Union, thus triggering the GDPR's application regardless of the business's location.

A. The GDPR does not apply to processing for law enforcement purposes, which is governed by the Law Enforcement Directive (EU 2016/680).
B. The GDPR's scope is determined by the location of the data subject (in the Union), not their citizenship. A non-EU controller processing data of an EU citizen living outside the EU would not necessarily be subject to the GDPR.
C. For the monitoring criterion of Article 3(2)(b) to apply, the behavior being monitored must take place within the Union. This option specifies the behavior occurs outside the EU. ---

1. General Data Protection Regulation (EU) 2016/679, Article 3(2): "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union."

2. European Data Protection Board (EDPB), Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), Version 2.1 (Adopted 12 November 2019), Paragraph 16: "The application of the targeting criterion is not limited by the nationality or legal status of the data subject... The wording 'data subjects who are in the Union' implies that the location of the data subject in the territory of a Member State is the determining factor for the application of Article 3(2)." This directly refutes the citizenship-based logic in option B.

3. European Data Protection Board (EDPB), Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), Version 2.1 (Adopted 12 November 2019), Paragraph 19: This section clarifies that for the "offering of goods or services" criterion to be met, there must be an element of targeting individuals in the EU. This supports the wording "targets EU customers" in option D as the trigger.

4. General Data Protection Regulation (EU) 2016/679, Article 2(2)(d): This article explicitly states that the GDPR does not apply to the processing of personal data "by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties..." This makes option A incorrect.

To determine if Frank's new processing is permissible, Anna must assess its lawfulness under the GDPR. This requires evaluating the purpose limitation principle (Article 5(1)(b)) and, if relying on the original legal basis, conducting a compatibility test as outlined in Article 6(4). This test requires Anna to consider the reasonable expectations of the data subjects (what students were told in the privacy notice) and the link between the original and new purposes (how the research will be used). Without this information, she cannot determine if the new purpose is compatible with the original purpose for which the data was collected, making it impossible to establish the processing's permissibility.

A. More information about Frank’s data protection training. Frank's level of training is irrelevant to the inherent lawfulness of the processing activity itself; the legal requirements remain the same regardless of his knowledge.
B. More information about the extent of the information loss. This information is critical for managing the subsequent data breach (risk assessment and notification), not for determining the a priori permissibility of the processing project.
C. More information about the algorithm Frank used to mask student numbers. While the strength of the pseudonymization is a safeguard considered in the compatibility test, it is not the primary information needed. The fundamental question of purpose and transparency must be answered first.

1. General Data Protection Regulation (EU) 2016/679, Article 6(4): This article outlines the criteria for assessing whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected. It explicitly requires the controller to take into account "(b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;" and "(d) the possible consequences of the intended further processing for data subjects;". This directly relates to what students were told and how the research will be used.

2. General Data Protection Regulation (EU) 2016/679, Article 5(1)(b): This section establishes the "purpose limitation" principle, stating data must be "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes". Anna needs to know the specifics of the new purpose to assess this compatibility.

3. General Data Protection Regulation (EU) 2016/679, Recital 50: This recital elaborates on the compatibility test, stating, "The controller should... ensure that the further processing is compatible with the purposes for which the data were initially collected... In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller... should take into account... the reasonable expectations of data subjects based on their relationship with the controller." This highlights the importance of knowing what students were originally told.

4. Bygrave, L. A. (2020). Data Privacy Law: An International Perspective. Oxford University Press. In Chapter 8, Section 8.4.2, "The purpose-limitation principle," the text discusses the compatibility assessment under the GDPR, emphasizing the need to consider the data subject's reasonable expectations and the context of the original data collection, which aligns directly with the information sought in option D.

The General Data Protection Regulation (GDPR) establishes a "one-stop-shop" mechanism for cross-border data processing. This designates a Lead Supervisory Authority (LSA) to handle investigations. The LSA is the authority of the controller's "main establishment." According to Article 4(16) of the GDPR, while the main establishment is typically the place of central administration (Germany), if the decisions on the purposes and means of a specific processing activity are made in another establishment, that establishment is considered the main one for that activity. Since T-Craze's French affiliate is responsible for all marketing and sales, the French supervisory authority (CNIL) is the LSA for this marketing-related complaint. The Spanish authority is a "concerned" authority and must notify the LSA.

A. T-Craze has a French affiliate. The mere existence of an affiliate is not sufficient; its specific role in making decisions about the data processing is the determining factor for LSA competence.
B. The French affiliate procured the services of Right Target. This is a specific action, but the underlying reason for the French authority's competence is the affiliate's overall responsibility for making marketing decisions, not just this single procurement.
D. The Spanish supervisory authority is providing a courtesy notification not required under the GDPR. This is incorrect. Under Article 60 of the GDPR, cooperation between concerned supervisory authorities and the LSA is a mandatory legal requirement, not an optional courtesy.

1. General Data Protection Regulation (EU) 2016/679, Article 4(16)(a): Defines 'main establishment' for a controller as "the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment where such decisions are taken is to be considered to be the main establishment".

2. General Data Protection Regulation (EU) 2016/679, Article 56(1): "Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor..."

3. General Data Protection Regulation (EU) 2016/679, Article 60(3): "A supervisory authority shall, without delay, communicate any relevant information on a matter to the lead supervisory authority. It shall submit a draft decision to the lead supervisory authority for its opinion and shall take into account the views of the lead supervisory authority."

4. European Data Protection Board (EDPB), Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority, Version 2.0 (24 May 2023), para. 16: "In order to identify the main establishment, it is therefore necessary to look at the place where the decisions about the purposes and means of the processing are taken. This place must have the power to have these decisions implemented." This directly supports that the location where marketing decisions are made (France) determines the LSA.

The most fundamental difference between the European Council and the Council of the European Union lies in their composition and, consequently, their primary roles. The European Council is composed of the heads of state or government of the 27 EU member states, the President of the European Council, and the President of the European Commission. Its main function is to define the EU's overall political direction and priorities; it does not exercise legislative functions. In contrast, the Council of the European Union is composed of national ministers from each member state, who meet in various configurations depending on the topic (e.g., agriculture ministers, finance ministers). This composition reflects its role as a co-legislator with the European Parliament.

A. The European Council has a full-time President, whereas the presidency of the Council of the European Union rotates among the member states every six months.
B. While it is a key function of the Council of the European Union to exercise legislative power, the more foundational difference is the composition, which dictates this function.
C. This describes the primary focus of the Council of Europe, which is a separate international organization and not an EU institution like the European Council.

1. Consolidated Version of the Treaty on European Union (TEU), Official Journal of the European Union, C 326, 26 October 2012.

Article 15(1) and 15(2): "The European Council shall provide the Union with the necessary impetus for its development and shall define the general political directions and priorities thereof. It shall not exercise legislative functions. ... The European Council shall consist of the heads of state or government of the Member States, together with its President and the President of the Commission." (Supports correct answer D and refutes B as the key difference).

Article 16(1) and 16(2): "The Council shall, jointly with the European Parliament, exercise legislative and budgetary functions. ... The Council shall consist of a representative of each Member State at ministerial level..." (Explains the legislative role and composition of the Council of the EU).

Article 16(9): "The Presidency of Council configurations, other than that of Foreign Affairs, shall be held by Member State representatives in the Council on the basis of equal rotation..." (Refutes option A).

2. Chalmers, D., Davies, G., & Monti, G. (2019). European Union Law: Text and Materials (4th ed.). Cambridge University Press.

Chapter 3, Section 3.2 'The European Council' and Section 3.3 'The Council': This chapter clearly distinguishes the two bodies, emphasizing that the European Council is a "summit of the national political leaders" setting strategic direction, while the Council is the "main legislative and decision-making institution," composed of ministers. This supports the distinction based on composition (D) as fundamental.

3. The European Council. (n.d.). European Council. Europa.eu.

On its official website, the European Council is described as the institution that "brings together EU leaders to set the EU's political agenda." The composition is explicitly stated as "heads of state or government of the EU countries, the European Council President, and the European Commission President." This directly validates option D.

The most significant aspect of the GDPR ensuring consistent implementation is its legal form as a Regulation. Under EU law, a Regulation is directly applicable and binding in its entirety across all Member States without requiring national transposition. This creates a single, harmonized set of data protection rules throughout the EU. This contrasts sharply with its predecessor, Directive 95/46/EC, which set out goals but allowed Member States to implement them through their own national laws, leading to significant fragmentation and inconsistency across the Union. The choice of a Regulation was a deliberate act to remedy this fragmentation and establish a uniform legal framework.

A. That it essentially functions as a one-stop shop mechanism This mechanism harmonizes enforcement for cross-border processing by a lead authority, but it does not create the consistent law itself.
C. That it makes notification of large-scale data breaches mandatory This is a specific, harmonized obligation within the GDPR, but it is only one component, not the foundational reason for the consistent implementation of the entire law.
D. That it makes appointment of a data protection officer mandatory Similar to breach notification, this is a specific, harmonized rule for certain entities, not the overarching legal instrument that ensures EU-wide consistency.

1. Official Journal of the European Union, Regulation (EU) 2016/679 (GDPR), Recital 10: "In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules...should be ensured throughout the Union." Recital 13 further notes the need to avoid "a serious risk of circumvention" that could arise from legal fragmentation.

2. European Commission, "Types of EU law": "Regulations are binding legislative acts. They must be applied in their entirety across the EU... A directive sets out a goal that all EU countries must achieve. However, it is up to the individual countries to devise their own laws on how to reach these goals." This official source distinguishes the legal effect of a Regulation from a Directive, highlighting the former's role in creating uniform law.

3. Kuner, C., Bygrave, L. A., & Docksey, C. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. In Chapter 1, Section 1.34, the authors state, "The most important feature of the GDPR is that it is an EU regulation, meaning that it is directly applicable in the law of all EU Member States... This is intended to lead to greater harmonisation of data protection law in the EU than was the case under the Data Protection Directive."

4. De Hert, P., & Papakonstantinou, V. (2016). The new General Data Protection Regulation: Still a sound system for the protection of individuals? Computer Law & Security Review, 32(2), 179–194. In Section 2, the article discusses the rationale for the GDPR, noting, "The choice for a Regulation is the most important element of the reform as it aims to put an end to the fragmentation of the data protection framework in the Union." (DOI: https://doi.org/10.1016/j.clsr.2016.02.006)

Under the ordinary legislative procedure of the European Union, the European Commission holds the exclusive "right of initiative." This means it is the primary institution responsible for drafting and proposing new legislation, including regulations and directives in the field of data protection. The GDPR itself was initiated as a proposal from the Commission. While other institutions can request the Commission to act, the formal power to propose new laws on its own initiative is vested in the Commission, which acts as the EU's executive arm and guardian of the Treaties.

A. The European Council: This institution defines the EU's overall political direction and priorities but does not have the power to propose legislation.
B. The European Parliament: The Parliament can request the Commission to submit a proposal, but it does not possess the general right of legislative initiative itself. Its primary role is to amend and adopt laws.
D. The Council of the European Union: This body, representing member state governments, negotiates and adopts legislation alongside the Parliament, but it does not have the competence to propose it.

1. European Commission. (n.d.). What the European Commission does: Proposing new laws. Official website of the European Union. Retrieved from the European Commission's official site, which states: "The Commission is the sole EU institution tabling laws for adoption by the Parliament and the Council that: ... The European Commission has the 'right of initiative'."

2. European Parliament. (n.d.). Legislative powers: The ordinary legislative procedure. Official website of the European Parliament. Retrieved from the European Parliament's official site, which outlines the process: "The Commission submits a proposal to the Parliament and the Council. This is the first step in the ordinary legislative procedure."

3. Craig, P., & de Búrca, G. (2020). EU Law: Text, Cases, and Materials (7th ed.). Oxford University Press. In Chapter 3, "The Commission," the text extensively discusses the Commission's functions, stating, "The most important of the Commission's powers is its power of legislative initiative... the Treaties grant the Commission a virtual monopoly on legislative initiative" (p. 78).

4. Consolidated Version of the Treaty on the Functioning of the European Union (TFEU). Article 294. This article details the ordinary legislative procedure, starting with "the Commission shall submit a proposal to the European Parliament and the Council." This is the legal basis for the Commission's role.

The accountability principle, as defined in GDPR Article 5(2), requires that the controller is not only responsible for complying with the data protection principles but must also be able to demonstrate this compliance. Conducting regular audits is a fundamental organizational measure to review, assess, and document the effectiveness of the data protection program. The results of these audits serve as tangible evidence for supervisory authorities, directly fulfilling the requirement to "be able to demonstrate compliance." The other options are examples of compliance with other specific principles, but they do not, in themselves, demonstrate the overarching accountability framework.

A. Anonymizing special categories of data is a technique to comply with data minimization and security principles, not a mechanism to demonstrate overall program compliance.
C. Getting consent is an act of compliance with the principle of lawfulness for a specific processing activity, not a demonstration of the entire accountability framework.
D. Encrypting data is a technical security measure to ensure integrity and confidentiality (Article 5(1)(f)), not a process for demonstrating accountability as required by Article 5(2). ---

1. General Data Protection Regulation (EU) 2016/679:

Article 5(2): "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability')." This establishes the core requirement to demonstrate compliance.

Article 24(1): "...the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary." This explicitly links accountability to implementing and reviewing measures, of which audits are a primary example.

2. Kuner, C., Bygrave, L. A., & Docksey, C. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press.

Commentary on Article 24, page 537, para. 24.31: The commentary explains that accountability requires a "verifiable, documented approach." It lists examples of measures, including "internal or external audits," as a way for controllers to demonstrate that their data protection program is effective and compliant.

3. Voigt, P., & von dem Bussche, A. (Eds.). (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Chapter on Article 5, Section 3.2.7, page 101: The authors state, "The accountability principle requires the controller to be able to demonstrate compliance with the principles of data processing... This can be done, for example, by means of documentation, logs, certifications or audit reports." This directly identifies audits as a method for demonstrating accountability.

The General Data Protection Regulation (GDPR) requires a valid legal basis for processing personal data. While consent is one such basis, it is not the only one. For activities like documentary filmmaking, which fall under journalistic or artistic expression, the legal basis of "legitimate interests" under Article 6(1)(f) of the GDPR is often more appropriate. Article 85 of the GDPR specifically mandates that Member States reconcile the right to data protection with the freedom of expression and information. Therefore, the production company can argue that its legitimate interest in creating a documentary for public interest (freedom of expression) is not overridden by the fundamental rights of the individuals filmed in a public street, thus negating the requirement for consent.

A. "Disproportionate effort" is an exemption under GDPR Article 14(5)(b) from the obligation to provide information to data subjects, not a legal basis for processing their data.
B. Consent under the GDPR must be freely given, specific, informed, and unambiguous. Local legislation cannot redefine this core principle to make it "voluntary" in a way that bypasses its requirements.
C. The GDPR applies to the personal data of all natural persons. The requirement for a lawful basis for processing applies equally to adults and minors, although additional safeguards exist for children.

1. Regulation (EU) 2016/679 (General Data Protection Regulation).

Article 6(1)(f): Establishes "legitimate interests" as a lawful basis for processing, provided they are not overridden by the data subject's rights and interests.

Article 85(1): "Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression."

2. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Chapter 3, p. 103, on Article 6(1)(f): The book explains that freedom of the press and freedom of expression can be considered legitimate interests.

Chapter 9, p. 367, on Article 85: This section details how Member States must create exemptions for journalistic and artistic purposes, allowing for a balance against data protection rights, often obviating the need for consent.

3. European Data Protection Board (EDPB), Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, Version 2.0 (Adopted 08 October 2019).

Paragraph 18: While discussing a different legal basis, the EDPB reiterates the principle that controllers must determine the appropriate legal basis before processing and that the six bases of Article 6 are alternatives. This supports the idea that consent is not the only option.

Both the General Data Protection Regulation (GDPR) and the Council of Europe Convention 108 establish a legal framework for the protection of personal data, which includes specific provisions for cross-border data flows. The GDPR dedicates Chapter V (Articles 44-50) to the "Transfers of personal data to third countries or international organisations," setting out conditions for such transfers. Similarly, Article 12 of the original Convention 108 (and Article 14 of the modernised Convention 108+) specifically addresses "transborder data flows," establishing principles to ensure that the protection of individuals is not undermined when their data is transferred abroad.

B. Both govern the manual processing of personal data Convention 108 applies primarily to the "automatic processing" of personal data. While member states may choose to extend its rules to manual files, this is not a mandatory requirement of the Convention itself.
C. Both only apply to European Union countries Convention 108 is a Council of Europe treaty, which is a separate entity from the EU with 46 member states. The Convention is also open to accession by non-member states, and several non-European countries have ratified it.
D. Both require notification of processing activities to a supervisory authority This was a requirement under the GDPR's predecessor, Directive 95/46/EC. Both the GDPR and the modernised Convention 108+ have replaced this general notification system with the principle of accountability, which includes obligations like maintaining records of processing activities (GDPR Article 30).

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Chapter V, Articles 44-50. This chapter explicitly lays out the legal framework and conditions for transferring personal data outside the European Economic Area.

2. Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108), Strasbourg, 28.I.1981.

Article 12 – Transborder data flows: "A Party shall not, for the sole purpose of the protection of privacy, prohibit or subject to special authorisation transborder flows of personal data going to the territory of another Party." This article directly governs international transfers.

Article 3 – Scope: "The Parties undertake to apply this Convention to automated personal data files and automatic processing of personal data in the public and private sectors." This establishes the primary scope, with extensions to manual files being optional.

3. Explanatory Report to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Council of Europe, 1981, Paragraph 64. "This article [Article 12] deals with the classic problem of transborder data flows... It seeks to reconcile two conflicting interests: the interest of the free flow of information, regardless of frontiers, and the interest of protecting personal privacy."

4. European Union Agency for Fundamental Rights and Council of Europe, Handbook on European data protection law, 2018 Edition.

Page 40: "Convention 108 is a treaty of the Council of Europe... The Council of Europe has 47 member states [note: now 46], including all EU Member States... Convention 108 is also open for accession by countries that are not members of the Council of Europe." This confirms that its geographic scope is not limited to the EU.

Page 139: "The GDPR has abolished the general obligation to notify processing operations to the supervisory authority, which existed under the DPD [Data Protection Directive 95/46/EC]." This confirms the inaccuracy of option D for the GDPR.