Get BCS PDP9 Exam Dumps

Answer : A

The definitions of ''public authority'' and ''public body'' for the purposes of the UK GDPR and the Data Protection Act 2018 are found in the Freedom of Information Act 2000 and the Data Protection Act 2018 respectively. Section 7 of the Data Protection Act 2018 provides that a public authority or a public body is one that is listed in Schedule 1 to the Freedom of Information Act 2000, or is designated by an order under section 5 of that Act. However, a court or tribunal acting in its judicial capacity is not considered a public authority or a public body under the Data Protection Act 2018.Reference:

Section 7 of the Data Protection Act 20181

Schedule 1 to the Freedom of Information Act 2000

Answer : A

The UK GDPR and the Data Protection Act 2018 set a maximum fine of 17.5 million or 4% of annual global turnover, whichever is higher, for infringements of the data protection principles, the rights of data subjects, or the rules on transfers of personal data to third countries. This is the higher maximum penalty that applies to the most serious breaches of the UK GDPR. A security breach that exposes the details of a hundred thousand members of the public would likely fall under this category, as it would compromise the confidentiality and integrity of personal data, and potentially cause significant harm and distress to the data subjects. Therefore, the maximum fine that the UK public body could receive for this breach is 17.5 million or 4% of gross annual turnover, whichever is higher.Reference:

Penalties3

GDPR Penalties & Fines4

Three years of GDPR: the biggest fines so far5

Answer : C

Article 57(1)(f) of the UK GDPR requires the supervisory authority (the ICO in the UK) to handle complaints lodged by a data subject, investigate the subject matter of the complaint, and inform the complainant of the progress and the outcome of the investigation. It also requires the supervisory authority to cooperate with other supervisory authorities if the complaint involves cross-border processing. However, it does not require the supervisory authority to mediate between the complainant and the controller or processor against which the complaint has been lodged, to resolve the complaint. This is not a task of the supervisory authority under the UK GDPR, although it may be possible in some cases as a way of achieving an amicable solution.Reference:

Article 57(1)(f) of the UK GDPR1

ICO and complaints2

Answer : D

The two businesses are both joint controllers of the information contained in the single order system, because they jointly determine the purposes and means of the processing. They have a shared purpose of selling their products by mail order and they agree on the means of processing by using a single online website and a single order system. Their decisions complement each other and are necessary for the processing to take place. The processing by each party is inseparable and inextricably linked. Therefore, they meet the criteria for joint controllership under the GDPR.Reference:

Article 26 of the GDPR1

Guidelines 07/2020 on the concepts of controller and processor in the GDPR2, pp. 16-24

Answer : C

Providing the controller with corporate information relating to its board members is not a processor obligation under the GDPR. The processor obligations under the GDPR are mainly the following:

To process the personal data only on documented instructions from the controller, unless required by law;

To ensure that persons authorised to process the personal data are bound by confidentiality;

To implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk;

To not engage another processor without the prior authorisation of the controller;

To assist the controller in fulfilling its obligations regarding data subject rights, data protection impact assessments, prior consultations, and data breach notifications;

To delete or return the personal data to the controller at the end of the service, unless required by law to store the data;

To make available to the controller all information necessary to demonstrate compliance and allow for audits and inspections.Reference:

Article 28 of the GDPR1

Guidelines 07/2020 on the concepts of controller and processor in the GDPR2, pp. 37-41