GDPR uses the term data breach.

Article 4 paragraph 12

‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction,

loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or

otherwise processed.

Because France is located in the middle of Europe. Incorrect. The geographical position of the

countries is irrelevant.

Because France is the largest of the three EEA countries. Incorrect. The size of the countries is

irrelevant.

Because the company has their headquarters in France. Correct. The country of the main

establishment determines the lead supervisory authority. The ‘main establishment’ is the place of

the central administration of that organization, or in other words: headquarters. (Literature: A,

Chapter 7)

Article 9: Processing of special categories of personal data:

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or

philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data

for the purpose of uniquely identifying a natural person, data concerning health or data concerning a

natural person’s sex life or sexual orientation shall be prohibited.

In its Article 35 the GDPR legislates on the Impact assessment on data protection.

7)

The assessment shall contain at least:

a)

a systematic description of the envisaged processing operations and the purposes of the

processing, including, where applicable, the legitimate interest pursued by the controller;

b)

an assessment of the necessity and proportionality of the processing operations in relation

to the purposes;

c)

an assessment of the risks to the rights and freedoms of data subjects referred to in

paragraph 1; and

d)

the measures envisaged to address the risks, including safeguards, security measures and

mechanisms to ensure the protection of personal data and to demonstrate compliance with this

Regulation taking into account the rights and legitimate interests of data subjects and other persons

concerned.

When a project includes technologies or processes that use personal data. Incorrect. Only for

technologies and processes that are likely to result in a high risk to the rights of data subjects is the

DPIA mandatory.

When processing is likely to result in a high risk to the rights of data subjects. Correct. For processing

operations which are likely to result in a high risk, a DPIA is obligatory to assess those risks and to

design mitigation measures. (Literature: A, Chapter 6; GDPR Article 35)

When similar processing operations with comparable risks are repeated. Incorrect. This is a case in

which a DPIA does not need to be repeated.

Collecting name and address information for a gymnastics club. Incorrect. Collecting is also

considered processing data.

Creating a back-up of biometric data for data security purposes. Incorrect. Storage is also considered

processing data.

Editing personal photographs before printing them at home. Correct. The GDPR is not applicable to

home-use of your own photographs. (Literature: A, Chapter 1; GDPR Article 4)

Implement technical and organizational measures to ensure compliance. Incorrect. This is the task of

the controller.

Investigate security breaches of corporate information. Incorrect. Only breaches of personal data are

a concern of the supervisory authority.

Monitor and enforce the application of the GDPR. Correct. This is the main task of any supervisory

authority. (Literature: A, Chapter 7)

The fundamental right to protection of personal data, regardless of how it was obtained. Incorrect.

This is a definition of data protection.

The right not to be disturbed by uninvited people, nor being followed, spied on or monitored.

Incorrect. This is a definition of physical privacy. However, the GDPR does not concern itself with

physical privacy.

The right to respect for one’s private and family life, home and personal correspondence. Correct.

This is the definition as implicitly used throughout the GDPR. (Literature: A, Chapter 1)

The right to freedom of opinion and expression and to seeking, receiving and imparting information.

Incorrect. This is a short version of Universal Declaration of Human Rights Article 19: freedom of

opinion and expression.