#GDPRQuiz - Twitter Hashtag

over 5 years ago

Do you think you know #GDPR by heart? Then listen in to our @PodPrivacy podcast when we put our guest to the true test in our #gdprquiz. In this case episode you can hear the great efforts of @PrivacyFin: https://t.co/hL9BHRmbKd

0

9

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #24: Greece or France (45%). Rec.145 and art.79(2) #GDPR. However, where the controller has establishments in several Member States, the language of the GDPR suggests that the data subject may forumshop, as “relevant” is missing from the text.

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. #privacy #eudatap #GDPR 24. A data subject living in Greece who want to sue a controller in France may bring the action before the court in:

0

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #22: No (21%). Rec. 151 #GDPR: “The legal systems of Denmark and Estonia do not allow for administrative fines as set out in this Regulation.” In Denmark, the fines are criminal fines imposed by the court. #privacy #eudatap

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz (weekend edition). #privacy #eudatap 22. Any data protection authority in the EU may issue administrative fines up to 20 million or 4% of global turnover under art. 83 #GDPR.

0

1

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #20: No (42%). Other legal acts that are binding on the processor are also allowed (art. 28.3 #GDPR), e.g. an SLA, SoW, service contract clauses or a processor’s T&C’s. Also codes of conduct or certification schemes are sufficient (art.28.5)

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. #GDPR #privacy #eudatap 20. A controller must close a data processor contract with a processor.

0

1

0

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #19: 32(1) #GDPR (10%). I admit the EDPB is ambiguous here (WP250rev01, p11). Not timely investigating an incident (see rec.87) is part of art.32(1) (appropriate security), not 33(1). Not that it matters wrt the level of the fine (art. 83(3)).

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. #GDPR #privacy #eudatap 19. If your employee reports a lost USB-device and you decide to look into it after your 3-week holiday and it later turns out sensitive data were stored on it, your company risks getting a fine for violating:

0

1

0

1

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. #privacy #eudatap #GDPR 16. The right of erasure also applies to public archives.

0

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz - Correction. Answer to #14: Yes (52%). Other than its predecessor the Art. 29 Working Party, the #EDPB has legal personality (art. 68(1) #GDPR). As a consequence, its decisions may be reviewed by the CJEU (art. 263 TFEU, not 265). #privacy #eudatap

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #14: Yes (52%). Other than the previous Art.29 Working Party, the #EDPB has “legal personality” (art. 68(1) #GDPR). This has been introduced to allow lawsuits against the EDPB directly before the Court of Justice of the EU (art.265 TFEU, par.3).

1

2

0

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #14: Yes (52%). Other than the previous Art.29 Working Party, the #EDPB has “legal personality” (art. 68(1) #GDPR). This has been introduced to allow lawsuits against the EDPB directly before the Court of Justice of the EU (art.265 TFEU, par.3).

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. #privacy #eudatap #GDPR 14. One could, if one wishes, sue the European Data Protection Board (#EDPB) in court.

0

1

0

1

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #13: (my mistake, ambiguous answers). WP248rev01 states that (high risk) processing already authorized prior to May 2018 does not need a DPIA, provided the conditions did not change. Same for processing required by law. #GDPR #privacy #eudatap

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. #eudatap #privacy #GDPR 13. Processing that has been authorized by a Data Protection Authority prior to May 25th 2018 does not require a DPIA.

0

1

0

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #12: Yes (26%). WP248rev01: Some data -other than special data- are by their nature so sensitive that they require a DPIA before processing and a notification if breached (e.g. financial data, location, monitoring, life logging) #GDPR #privacy

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. - #privacy #eudatap 12. The #GDPR contains 3 types of personal data: ‘Special data’ being a subset of ‘Sensitive data’ being a subset of ‘Personal data’.

0

1

0

3

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #11: Yes (58%). Art. 3(2) #GDPR also applies to non-EEA processors. Art. 27 requires that, if art. 3(2) applies, a representative must be appointed in the Member State where the data subjects are. The SCC’s are irrelevant here. #privacy #eudatap

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz weekend edition. #privacy #eudatap #GDPR 11. A US processor which, on the basis of standard contractual clauses, monitors online behavior of German consumers on behalf of a German controller must designate a representative in Germany.

0

2

0

3

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz weekend edition. #privacy #eudatap #GDPR 11. A US processor which, on the basis of standard contractual clauses, monitors online behavior of German consumers on behalf of a German controller must designate a representative in Germany.

0

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #9: It depends (27%). A deceased person is not a "natural person" (see art. 4(1) #GDPR), so their data are not personal data, so art. 2(1) does not apply. Except when the law in a Member State states otherwise (recital 27, e.g. in #Denmark)

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. #privacy #eudatap #GDPR 9. The #GDPR applies to data relating to deceased persons.

0

1

0

2

6

1

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to #8: No (32%). Recital 50 states that data may be further processed for incompatible purposes if required by law or with data subject's consent. It's also allowed under the Member State laws implementing art. 23 #GDPR. #privacy #eudatap

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. #privacy #eudatap #GDPR 8. Further processing of personal data (aka ‘secondary use’) must always be compatible with the purpose for which the data was collected.

0

1

0

3

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. (2/2) ...(see rec.23 #GDPR), “offer” in art.8 should have the same meaning: an information society service directly targeting children. Since a weather app is targeted to the general public, the use of such app by a child does not trigger art.8. #privacy

0

4

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. Answer to nr. 6: No (50%). Art. 3(2) #GDPR requires that goods or services must be “offered”. See recital 23 and CJEU case ‘Alpenhof’. The webshop must target customers in the EU. A mere purchase is not sufficient to trigger the application of the GDPR.

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz. #eudatap #privacy 6. The application of the #GDPR is already triggered if a person living in the EU merely buys something online in the US.

0

1

0

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz #4: Austria. A data breach must be notified to the Lead DPA (WP250rev01) = DPA in the country of the ‘main establishment’ (art.4(16) #GDPR). A multinaltional may have multiple Lead DPA’s, depending on how it organizes the decision-making... (1/2) #privacy

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz: #privacy #eudatap 4. A data breach of Austrian salary data in the Dutch data center of a Dutch multinational with an HR shared service center for Germany and Austria based in Munich, must be notified to the DPA in:

1

2

0

1

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz: #privacy #eudatap 4. A data breach of Austrian salary data in the Dutch data center of a Dutch multinational with an HR shared service center for Germany and Austria based in Munich, must be notified to the DPA in:

1

2

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz: #privacy #eudatap 3. Loosing somebody else’s business card is a data breach under the #GDPR.

1

3

4

0

Jeroen Terstegge 🇪🇺🇳🇱 @PrivaSense

almost 8 years ago

Daily Summer #GDPRquiz: #privacy #eudatap 2. Binding Corporate Rules (BCRs) are a compliance framework under art. 24 #GDPR (demonstrable compliance)

0

2

1

0

Top Tweets for #GDPRQuiz

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users