Free CIPP-E flashcards

When a solely automated decision with legal or similarly significant effects is permitted on the basis of contractual necessity, what safeguards must the controller provide?

At minimum the controller must implement the data subject's right to obtain human intervention, to express their point of view, and to contest the decision. These suitable measures attach to the contract-necessity route precisely because no fresh consent is needed there, so they are what protect the individual from an unchallengeable automated outcome.

A solely automated decision needed for a contract still requires fresh explicit consent before the controller can rely on it.

Tempting because consent is one possible basis for solely automated decisions. But where the decision is necessary for entering into a contract, the rules permit it without separate explicit consent, provided suitable safeguards such as human intervention and the right to contest are in place.

How does the consent standard in Article 9(2)(a) differ from ordinary Article 6(1)(a) consent for special category data?

Article 9(2)(a) demands explicit consent: an express statement of agreement to the specific special category processing. It cannot be inferred from conduct or a pre-ticked box, which raises the bar above ordinary Article 6 consent.

Collecting unused survey fields breaches purpose limitation, because the responses are processed for an undisclosed secondary purpose.

Purpose limitation is plausible because excessive collection can hint at hidden uses, but nothing here shows a second purpose. The fields are simply collected and ignored, which is a minimisation failure.

Before a national supervisory authority's list of processing operations requiring a DPIA takes effect, which Union body must it involve and why?

The list goes to the European Data Protection Board under the consistency mechanism. The Board issues an opinion so that comparable processing is treated consistently across Member States, reflecting the EDPB's harmonising mandate rather than approval by the Commission or a court.

A DPO who also chairs IT procurement threatens the data minimisation principle, so the fix is to reduce the volume of patient data the DPO can access.

Data minimisation concerns limiting collected data to what is necessary and is unrelated to the DPO's organisational position. This misdiagnoses the issue as a data-volume problem rather than the conflict of interest it actually is.

When a system processes facial templates to uniquely identify people, what does the GDPR require beyond an ordinary lawful basis?

Biometric data processed for the purpose of uniquely identifying a person is special category data under Article 9(1), so the processing is prohibited unless an Article 9(2) condition applies. The controller must layer a special category condition, typically explicit consent, on top of an Article 6 lawful basis.

A photograph only becomes special category data once it is published, so Article 6 alone governs facial recognition at boarding gates.

This conflates a plain photograph with biometric processing. Publication is irrelevant; once an image is processed through specific technical means for unique identification it becomes biometric special category data, so Article 6 alone is insufficient and an Article 9 condition is also required.