CIPP-E > Data Processing Principles & Special Categories of Data > Flashcards

Data Processing Principles & Special Categories of Data Flashcards

Understand the core principles of lawful data processing and the rules for handling sensitive personal data. (69 cards)

Study These Flashcards
1
Q

What are the principles listed in GDPR Article 5?

A
  • Lawfulness, fairness, and transparency
  • Purpose limitation
  • Data minimization
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality
  • Accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What mnemonic device helps to remember the GDPR processing principles?

A

Llamas parade drowsily as Smurfs implode accidentally.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

When is processing of personal data lawful under GDPR?

A

Only when a legal basis exists and processing is fair and transparent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the 6 legal bases for processing personal data under GDPR?

A
  1. Consent
  2. Contract performance
  3. Vital interests
  4. Legal obligation
  5. Public interest
  6. Legitimate interest

Mnemonic: Crazed clowns vandalize long purple limos.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does fairness in data processing require?

A
  • Transparency
  • Informed decision-making
  • Impact assessment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is ‘justified detriment’ in data processing?

A

Processing with negative effects that remains fair.

Examples: investigations or tax assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is required of controllers under the principle of transparency?

A
  • Clear
  • Open
  • Understandable to individuals
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

When must fair processing information be provided if data is collected directly from the data subject?

A

At the point or time of collection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How should fair information processing notices be designed?

A
  • Accessible
  • In plain language
  • Appropriate for the audience
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

When is notification not required for directly collected data?

A

When the data subject is already aware of the collection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are exceptions to notification for data collected from other sources?

A
  • Disproportionate effort or impossibility
  • To protect legitimate interests (e.g., fraud prevention)
  • To protect data confidentiality (e.g., legal privilege)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the principle of purpose limitation under GDPR?

A

Personal data must be collected for specified, explicit, and legitimate purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is secondary/further processing?

A

Use of personal data beyond the original purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When is further processing permitted under GDPR?

A

Only when compatible with the original purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What factors determine the lawfulness of secondary processing?

A
  • Connection between purposes
  • Processing context
  • Reasonable expectations
  • Data’s nature
  • Consequences on data subject
  • Safeguards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the principle of data minimization?

A

Controllers must collect and process only data that is relevant, necessary, and adequate to accomplish a stated purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the 2 key implementation concepts for data minimization?

A
  1. Necessity
  2. Proportionality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does necessity mean in data minimization?

A

Data must be strictly required to achieve a specific, legitimate purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does proportionality mean in data minimization?

A

Interference with privacy must not exceed what is necessary to achieve the purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What factors are considered under proportionality?

A
  • Scope and amount of data collected
  • Impact on individual
  • Availability of less intrusive alternatives
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the principle of accuracy under the GDPR?

A

Controllers must ensure personal data is correct, complete, and current.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are ‘reasonable measures’ in the context of accuracy?

A

Implementing data quality processes throughout the data life cycle.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What should controllers do during data collection to ensure accuracy?

A
  • Verify data authenticity
  • Evaluate source reliability
  • Consider potential adverse impacts of inaccuracies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What should controllers do to maintain accuracy?

A
  • Correct errors
  • Keep records of errors and corrections
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is the principle of **storage limitation** under GDPR?
Data **must not be retained any longer than needed** for the purpose for which it was collected.
26
What should happen to data once it is **no longer needed**?
It should be **securely deleted**.
27
When can data be retained **longer than necessary**?
* Public interest * Scientific * Historical * Statistical purposes
28
What **determines retention period** when no statutory law applies?
The organization’s **internal policy**.
29
What does the principle of **integrity** require?
Data must remain accurate, complete, and **unaltered** throughout its life cycle.
30
What does the principle of **confidentiality** require?
Data must be protected from: * Unauthorized modification * Access * Disclosure * Exfiltration
31
What **safeguards** support integrity and confidentiality?
* Pseudonymization * Encryption * Adherence to international standards ## Footnote Example standards: ISO/IEC 27001 and NIST
32
When is processing allowed under the **contract basis**?
When **necessary to fulfill a contract with the data subject** or at their request before entering a contract.
33
What is the **vital interest basis** used for?
**Protecting life**, usually in emergencies.
34
What qualifies as a **legal obligation** for processing?
Compliance with EU **law obligations**. ## Footnote Examples: tax or social security obligations
35
What does the **public interest** basis cover?
Tasks **performed in the public interest** or **under official authority**. ## Footnote Examples: elections or censuses
36
What is the **legitimate interest** basis?
Processing **necessary for a controller’s or third party’s interest**, unless overridden by data subject's rights. ## Footnote Examples: fraud prevention, ensuring network security
37
What is the **UK ICO 3-part test** for legitimate interest?
1. Identify the interest 2. Show processing is necessary 3. Balance against data subject’s rights and freedoms
38
What are the **4 main requirements** for **valid consent** under GDPR?
1. Freely given 2. Specific 3. Informed 4. Unambiguous
39
What is an example of '**freely given**' consent?
Options to **accept or decline** using an unchecked checkbox.
40
What is a bad example of '**freely given**' consent?
Access to service is **conditional** on unnecessary processing.
41
What is an example of '**specific**' consent?
**Separate consent** for marketing emails and third-party data sharing.
42
What is a bad example of '**specific**' consent?
Single checkbox **covering multiple data uses**.
43
What is an example of '**informed**' consent?
Notice includes: * Who is collecting data * Purpose * How to withdraw * Written in plain language
44
What is a bad example of '**informed**' consent?
* Notice uses vague, jargon-filled language * Omits the controller's identity
45
What is an example of '**unambiguous**' consent?
A clear 'I agree' statement or **affirmative checkbox**.
46
What is a bad example of '**unambiguous**' consent?
**Pre-checked box** or implied agreement without action.
47
How must consent be **presented**?
Clearly distinguishable from other matters. ## Footnote Example: Separated from terms of service
48
Why is the **power dynamic between** controller and data subject important for consent?
An imbalance (e.g., employer-employee) may invalidate consent.
49
What should controllers do when consent **may be revoked**?
Have a contingency plan in place for an **alternative legal basis** to process.
50
Why is opt-out **not valid consent**?
* Consent requires action * Passive inaction or pre-checked boxes do not qualify
51
What renders consent **invalid**?
* Consent given under **duress or coercion** * Where **vulnerable populations** lack capacity
52
What populations may have **questionable capacity** for valid consent?
* Children * Elderly * Individuals with mental health disorders * Asylum seekers * People with disabilities
53
When is **parental consent required** under GDPR?
For **children under 16** when consent is the legal basis and services are offered directly to the child.
54
Can member states **lower the age** for valid child consent?
**Yes**, to as low as 13, but not lower.
55
What does the UK ICO recommend regarding **consent renewal**?
Consent should be refreshed **every 2 years**.
56
When must **new consent be obtained**?
When the **scope** or **nature of processing changes**.
57
When are photographs considered **biometric data** under GDPR?
When used to **uniquely identify or authenticate** an individual.
58
What must controllers comply with when processing **special categories of data**?
Requirements under both **Articles 6** and **9** of GDPR.
59
What are the **10 exceptions** for processing special categories of data?
1. Consent 2. Employment/social protection law 3. Vital interests 4. Not-for-profit bodies 5. Public data 6. Legal claims 7. Substantial public interest 8. Health/social care 9. Public health 10. Archiving/research/statistics ## Footnote Mnemonic: Cats eat very nice pizza, lions share honey providing aid
60
What does '**explicit consent**' entail?
A **clear, express statement** such as written, digital, or verbal confirmation.
61
When is processing allowed under **employment-related exception**?
When necessary for employment, social security, or social protection law.
62
What types of organizations are covered under the **not-for-profit exception**?
* Religious * Political * Civil society groups
63
When is processing allowed under the **legal claims exception**?
When required to **establish, exercise, or defend legal claims** with a significant connection to the need.
64
What is the meaning of '**substantial public interest**'?
A **real and significant societal benefit**, not a vague public good. ## Footnote Examples: preventing unlawful acts, safeguarding children, protecting public from dishonesty, misconduct, regulatory or oversight functions
65
What are **health and social care** exceptions?
* Preventive or occupational medicine * Working capacity assessments * Diagnosis * Health/social care services and management
66
What is included under **public health exception**?
* Health status * Morbidity * Disability
67
What safeguards must be in place for **archiving, research, and statistics**?
Technical and organizational measures under Article 89. ## Footnote Examples: pseudonymization or anonymization
68
What types of data are considered **crime-related** under GDPR?
Convictions and offenses
69
What types of data are considered **security-related** under GDPR?
* Penalties * Restrictions * Conditions from the criminal justice process ## Footnote Examples: cautions, parole, bail, or electronic tagging
CIPP-E
flashcards
Decks in class (11)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions