Free CIPP/E Exam Flashcards

Any information relating to an identified or identifiable natural person. Identifiability can be direct (name) or indirect (an ID number, location data, online identifier, or factors specific to the person's identity).

Any operation performed on personal data, whether automated or not — including collection, storage, use, disclosure, structuring, erasure, and destruction. Almost everything done with data counts as processing.

Anonymised data can no longer identify anyone and falls outside the GDPR. Pseudonymised data replaces identifiers with a key but can still be re-linked, so it remains personal data and stays in scope.

Sensitive data needing extra protection: racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic data, biometric data for ID, health data, and data on sex life/orientation. Processing is prohibited unless an Art. 9(2) condition applies.

The GDPR protects only natural persons (living individuals). It does not apply to legal persons such as companies, nor to data about deceased individuals (though member states may add national rules for the deceased).

EU privacy rests on two rights in the Charter of Fundamental Rights: Art. 7 (respect for private and family life) and Art. 8 (protection of personal data). This rights-based foundation distinguishes the EU model from sectoral US law.

The 1981 Council of Europe treaty — the first binding international instrument on data protection. Its 2018 update (Convention 108+) modernised it. It influenced EU law but is separate from the GDPR.

The 1995 Directive required national implementing laws, producing fragmentation. The GDPR replaced it in 2018 as a directly applicable Regulation, harmonising rules across the EU without needing transposition.

A Regulation (like the GDPR) is directly applicable in all member states with no national transposition. A Directive (like the ePrivacy Directive) sets goals each state must implement through its own national law, allowing variation.

2002/58/EC (amended 2009) governs confidentiality of electronic communications, cookies/tracking, and unsolicited marketing. It is lex specialis — it overrides the GDPR where they overlap, e.g. consent for non-essential cookies.

The CJEU interprets EU law and issues binding rulings. Landmark cases include Google Spain (right to be forgotten), Schrems I (struck Safe Harbor), and Schrems II (struck Privacy Shield, conditioned SCC use).

The CJEU invalidated the EU-US Privacy Shield and held that Standard Contractual Clauses remain valid only if exporters assess the destination country's law and add supplementary measures where protection is inadequate (a transfer impact assessment).

Lawfulness, fairness & transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity & confidentiality (security); and accountability. Accountability requires the controller to demonstrate compliance with the other six.

Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes. Reusing data for a new, incompatible purpose generally needs a fresh legal basis.

Personal data must be adequate, relevant, and limited to what is necessary for the stated purpose. Controllers should not collect 'just in case' data that exceeds the actual need.

Personal data must be kept in identifiable form no longer than necessary for the purpose. This drives retention schedules and timely deletion or anonymisation once the purpose is met.

Consent; contract; legal obligation; vital interests; public task (public interest/official authority); and legitimate interests. A controller must identify the appropriate basis before processing — at least one must apply.

Consent must be freely given, specific, informed, and unambiguous, shown by a clear affirmative act. Pre-ticked boxes and silence are invalid. It must be as easy to withdraw as to give, and the controller must be able to prove it.

Legitimate interests requires a balancing test: (1) identify a legitimate interest, (2) show processing is necessary for it, and (3) confirm it is not overridden by the individual's interests, rights, and freedoms. It cannot be used by public authorities for their tasks.

An Art. 6 basis is not enough — you also need a separate Art. 9(2) condition (e.g. explicit consent, employment/social-security law, vital interests, substantial public interest, or health/medical purposes) to process sensitive data lawfully.

For information society services offered directly to children, consent is valid only if the child is at least 16, or the parent/guardian consents below that. Member states may lower the threshold but not below 13.

Data subjects can confirm whether their data is processed and obtain a copy plus information such as purposes, categories, recipients, retention, and their rights. Normally fulfilled free of charge within one month.

Data subjects can have inaccurate personal data corrected and incomplete data completed without undue delay. Where feasible, the controller must inform recipients of the correction.

Individuals can require deletion when data is no longer needed, consent is withdrawn, they object successfully, or processing was unlawful. It is not absolute — it yields to free expression, legal obligations, and public-interest grounds.

Where processing is based on consent or contract and is automated, individuals can receive their data in a structured, commonly used, machine-readable format and transmit it to another controller. It does not apply to data processed under legitimate interests or legal obligation.

Individuals can object to processing based on legitimate interests or public task, forcing the controller to stop unless it shows compelling legitimate grounds. For direct marketing, an objection is absolute — processing must stop immediately.

In certain situations (e.g. contested accuracy or a pending objection) the data may be stored but not otherwise processed. It acts as a temporary 'pause' while a dispute is resolved.

Individuals have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, unless it is necessary for a contract, authorised by law, or based on explicit consent — with safeguards including human intervention.

Controllers must respond without undue delay and within one month of receiving the request. This can be extended by up to two further months for complex or numerous requests, with notice to the individual.

The controller determines the purposes and means of processing. The processor processes data on the controller's behalf and instructions. The controller carries primary accountability; the processor has direct obligations only for specific duties.

Two or more controllers that jointly determine purposes and means. They must agree, in a transparent arrangement, who is responsible for which obligations — but data subjects may exercise their rights against any of them.

A controller may only use processors giving sufficient guarantees, bound by a written contract covering subject matter, duration, nature, purpose, data types, confidentiality, security, sub-processor rules, assistance, deletion/return, and audit rights.

Controllers must build data protection into systems from the outset (by design) and ensure that, by default, only data necessary for each purpose is processed (by default) — e.g. the most privacy-friendly settings on without user action.

Controllers and processors must maintain an internal record of their processing (purposes, categories of data and recipients, transfers, retention, security). Generally required for organisations with 250+ employees, or for risky, non-occasional, or special-category processing.

Controllers and processors must implement appropriate technical and organisational measures to ensure a level of security matching the risk — considering measures such as pseudonymisation, encryption, confidentiality, integrity, availability, resilience, and regular testing.

At the point of collection, the controller must give the individual the controller's identity, contact details (and DPO if any), purposes and legal basis, recipients, transfer details, retention period, their rights, and the right to complain to a DPA.

The European Commission can decide that a non-EU country, territory, or sector ensures an adequate level of protection. Transfers there need no further safeguard. Examples include the UK, Switzerland, Japan, and the EU-US Data Privacy Framework.

Pre-approved European Commission contract templates used to transfer data to countries without adequacy. After Schrems II, exporters must also run a transfer impact assessment and add supplementary measures where the destination's law is inadequate.

Internal data protection policies, approved by a lead supervisory authority, that permit intra-group transfers within a multinational across borders. They are legally binding and enforceable but take significant time to get approved.

Where no adequacy decision or appropriate safeguard applies, transfers may rely on narrow exceptions such as explicit consent, contract necessity, important public interest, legal claims, or vital interests. They are interpreted strictly and not for large-scale, repetitive transfers.

Required after Schrems II when using SCCs or BCRs: assess whether the destination country's laws (especially government surveillance access) undermine EU-equivalent protection, and add supplementary technical, contractual, or organisational measures if needed.

The 2023 adequacy mechanism replacing Privacy Shield. US organisations that self-certify and comply with DPF principles can receive EU personal data without additional safeguards, supported by new US redress and surveillance limits.

Each member state has an independent Data Protection Authority that monitors and enforces the GDPR — handling complaints, conducting investigations, issuing guidance, imposing corrective measures, and levying administrative fines.

For cross-border processing, the DPA of the controller's main establishment acts as the single 'lead' authority. It coordinates with other concerned DPAs, giving organisations one primary regulator rather than 27 separate ones.

The EU body composed of national DPA heads and the EDPS. It ensures consistent GDPR application by issuing guidelines, opinions, and binding dispute-resolution decisions under the consistency mechanism.

Lower tier: up to 10 million euros or 2% of global annual turnover (whichever is higher) for duties like records and security. Upper tier: up to 20 million euros or 4% of global annual turnover for breaches of principles, rights, or transfer rules.

Controllers must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to risk individuals' rights and freedoms. Processors must notify their controller without undue delay.

When a breach is likely to result in a high risk to individuals' rights and freedoms, the controller must inform affected data subjects without undue delay in clear language — unless data was encrypted, the risk is mitigated, or it would require disproportionate effort.

A risk assessment required before processing likely to result in high risk — e.g. large-scale special-category processing, systematic monitoring, or new technologies. If high risk remains unmitigated, the controller must consult the DPA before proceeding (Art. 36).

A DPO is required when the processor/controller is a public authority, or its core activities involve regular and systematic large-scale monitoring, or large-scale processing of special-category or criminal-conviction data. The DPO must be independent and report to top management.