CIPP/E - Data Protection Concepts – Practice Questions and Answers

Personal data means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified directly or indirectly, in particular be reference to an identifier, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. What is the GDPR definition of 'Personal Data' The four building blocks are: 1) 'Any information' 2) 'relating to' 3) 'an identified or identifiable' 4) 'natural person' What are the four 'building blocks' that comprise the meaning of personal data? No, Information does not have to be true to be considered personal data. Does information have to be true to be considered personal data? Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specifc data subject without the use of additional information, provided that individual information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. What is Pseudonymisation? Sensitive Personal Data is personal data that, fall into special categories, and could reveal racial or ethnic origin, political opinion, religious or philosophical beliefs,or trade union membership and the the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. What is Sensitive Personal Data? Controller, is defined in the Regulation, as: The natural or legal person, public authority, agency or other body, alone or jointly with others, determines the purpose and means of processing personal data. What is the GDPR definition of 'Controller'?