A secretary at a pediatric cardiology clinic instead of sending the doctor the list of patients scheduled for the day, sends it to all those responsible registered for the children with scheduled appointments.
According to the GDPR, does the Supervisory Authority need to be notified? And those responsible for the data holders?

• A. There is no need to notify the Supervisory Authority or those responsible for the data subjects, as whoever had access to the data is also someone in the same situation.
• B. The Supervisory Authority must be notified and also those responsible for the holders who had their data exposed.
• C. The Supervisory Authority must be notified, but there is no need to notify those responsible for the data subjects, as whoever had access to the data is also someone in the same situation.
• D. There is no need to notify the Supervisory Authority, however those responsible for the holders who had their data exposed must be notified.

解説: (PassTest メンバーにのみ表示されます)

A shopkeeper wants to register how many visitors enter his shop every day. A system detects the MAC- address of each visitor's smartphone. It is impossible for the shopkeeper to identify the owner of the phone from this signal, but telephone providers can link the MAC-address to the owner of the phone. According to the GDPR, is the shopkeeper allowed to use this method?

• A. Yes, because the shopkeeper cannot identify the owner of the telephone
• B. No, because the telephone's MAC-address must be regarded as personal data.
• C. Yes, because the visitor has automatically consented by connecting to the Wi-Fi
• D. No, because the telephone providers are the owners of the MAC-addresses.

解説: (PassTest メンバーにのみ表示されます)

Which of the parts below can implement data protection by design (from conception)?

• A. The supervisory authority.
• B. The data subject.
• C. The processor.
• D. The Data Protection Officer (DPO).

解説: (PassTest メンバーにのみ表示されます)

A good practice is to lock the computer automatically or manually when you are away from the workstation.
The company's DPO realizes that this procedure is not being followed by employees. This occurrence should be classified in which category?

• A. Classified as a security incident
• B. There is no specific category.
• C. Classified as a security vulnerability
• D. Classified as a data breach

解説: (PassTest メンバーにのみ表示されます)

The Traffic Department of a city wants to know how many cars travel daily in order to plan the number of spaces needed to implement a rotating parking system.
To do this, cameras were installed at strategic points. Through image recognition software it is possible to capture the license plate and know how many cars traveled in the city. A monthly report is issued with the average number of cars present each day.
Signs and posters were spread around the city informing drivers and citizens what is the purpose of processing and that the data will be stored for up to five years, for future comparison.
What basic principle of legitimate processing of personal data is being violated in this case?

• A. Personal data must be processed transparently in relation to the data subject.
• B. Personal data must be collected for specific, explicit and legitimate purposes and must not be further processed for incompatible purposes.
• C. Personal data must be processed in a way that guarantees the appropriate security of personal data.
• D. Personal data must be kept in a way that allows the identification of data subjects for a period not longer than necessary.

解説: (PassTest メンバーにのみ表示されます)