Online Access Free PDP9 Practice Test

Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?

• A.It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated
• B.It is key to the accountability element of the GDPR.
• C.It fulfils a requirement that data protection is carried out by design and default.
• D.It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO

If a complainant disagrees with the decision of the UK's supervisory authority, how do they appeal this decision?

• A.To the First Tier Tribunal (Information Rights)
• B.To the European Data Protection Supervisor.
• C.To the Information Commissioner
• D.To the European Commission

A company has twenty retail outlets in France and thirty retail outlets in Belgium The payroll department and the Data Protection Officer are based in Poland.The Company Board and administrative functions are based in Germany. Determine where the company's 'mainestablishment' would be

• A.Poland
• B.Germany
• C.France
• D.Belgium

An individual applies for a job as a security guard The employer has had significant issues with the sickness record of past recruits They therefore decide to offer the position to the individual on the basis they request a copy of their medical record so that the employer can be assured that they are in a good state of health.
The Data Protection Officer has been asked to advise. What advice is MOST appropriate?

• A.Providing the medical evidence is used for a legitimate purpose, and that the information is securely destroyed on verification that the employee is healthy, this is an acceptable action.
• B.This is a criminal offence under the Data Protection Act 2018 No individual should be asked to make a subject access request in order to obtain health records in these circumstances.
• C.While requesting and viewing medical evidence may be legitimate, they should ask for evidence that the individual consents to the proposition that they make the request
• D.In requesting information that is more than they necessary require to verify the medical condition of the individual they will have breached the data minimisation principle

Which of the following statements MOST accurately describes why a risk-based approach to the use of Al is necessary?

• A.Al's benefits make accepting all arising risks necessary.
• B.Al carries new and complex risks not present in other technologies
• C.Al is unlawful
• D.Al is inherently negative and its use should be limited