Exam CIPP-E topic 1 question 31 discussion

Actual exam question from IAPP's CIPP-E

Question #: 31
Topic #: 1

Article 5(1)(b) of the GDPR states that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.” Based on Article 5(1)(b), what is the impact of a member state’s interpretation of the word “incompatible”?

A. It dictates the level of security a processor must follow when using and storing personal data for two different purposes.
B. It guides the courts on the severity of the consequences for those who are convicted of the intentional misuse of personal data.
C. It sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data.
D. It indicates the degree of flexibility a controller has in using personal data in ways that may vary from its original intended purpose.

Show Suggested Answer

Suggested Answer: D 🗳️

by aliblabla at April 8, 2024, 8:48 a.m.

Comments

Submit Cancel

POPO1907

6 months, 3 weeks ago

Selected Answer: D

D. Degree of flexibility allowed to data controllers: it impacts whether and how personal data can be processed for purposes beyond those initially stated as long as the new purpose are compatible with the original one.

upvoted 1 times

...

Ssourav

11 months ago

Selected Answer: D

D. It indicates the degree of flexibility a controller has in using personal data in ways that may vary from its original intended purpose. GDPR Article Reference: Article 5(1)(b): Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall, in accordance with Article 89(1), not be considered incompatible with the initial purposes.

upvoted 1 times

...

aliblabla

1 year, 2 months ago

If you want to process data for another purpose then afgreed on, this new purpose has first to be agreed on before processing the data according to that new purpose

upvoted 1 times

...

aliblabla

1 year, 2 months ago

d is wrong because the GDPR tries to prevent that Controllers us the data for anything other then the specified purpose. Check clause 5 GDPR. So C is the answer.

upvoted 1 times

...