認証トレーニングPDP9試験問題集テストエンジン [2024]
2024年06月02日ガイド準備でPDP9試験合格
PDP9認定試験は、コンピュータベースのテストで、40の複数選択問題で構成されています。受験者は60分間で試験を完了する必要があり、合格点は65％以上である必要があります。
質問 # 25
How does the GDPR relate to cookies?
- A. The GDPR applies in all cases where cookies are used
- B. Websites only need an opt out of cookies if GDPR applies
- C. Where PECR is engaged only PECR will apply to the processing of personal data
- D. The GDPR only applies where a cookie processes personal data
正解：C
解説：
Explanation
The GDPR and the Privacy and Electronic Communications Regulations (PECR) are two different but related legal frameworks that regulate the use of cookies and similar technologies. Cookies are small text files that are stored on the user's device when they visit a website or use an online service. Cookies can be used for various purposes, such as remembering user preferences, tracking user behaviour, delivering targeted advertising, or enabling online transactions. The GDPR applies to the processing of personal data by cookies and similar technologies, as they can be used to identify or single out individuals, either directly or indirectly. Personal data is any information relating to an identified or identifiable natural person, such as a name, an email address, a location data, or a cookie identifier. The GDPR requires data controllers to obtain the user's consent before using any cookies that are not strictly necessary for the functioning of the website or service, and to provide clear and transparent information about the purposes and legal basis of the processing, the categories and recipients of the personal data, the retention periods, and the rights of the data subjects. The GDPR also requires data controllers to implement appropriate technical and organisational measures to ensure the security and confidentiality of the personal data, and to comply with the principles of data protection by design and by default. The PECR are a set of UK-specific rules that implement the EU ePrivacy Directive, which is a complementary legislation to the GDPR that deals with the privacy and security of electronic communications.
The PECR apply to the use of cookies and similar technologies, as well as to the sending of marketing communications by phone, email, text, or fax, and to the provision of public electronic communications services and networks. The PECR require data controllers to obtain the user's consent before using any cookies or similar technologies, except those that are strictly necessary for the provision of an information society service requested by the user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network. The PECR also require data controllers to provide clear and comprehensive information about the purposes of the cookies or similar technologies, and to offer the user a way to refuse or withdraw their consent. The PECR do not apply to the processing of personal data by cookies or similar technologies, as this is covered by the GDPR. Therefore, the correct answer is C, as where PECR is engaged only PECR will apply to the use of cookies or similar technologies, but not to the processing of personal data by them. The other options are incorrect because:
* The GDPR does not only apply where a cookie processes personal data, but to any processing of personal data by any means, including cookies and similar technologies. The GDPR applies to the processing of personal data by cookies and similar technologies, regardless of whether they are strictly necessary or not, or whether they are first-party or third-party cookies. However, the GDPR does not apply to the use of cookies or similar technologies, as this is covered by the PECR.
* The GDPR does not apply in all cases where cookies are used, but only in cases where cookies are used to process personal data. The GDPR does not apply to the use of cookies or similar technologies that do not process personal data, such as those that are strictly necessary for the functioning of the website orservice, or those that do not identify or single out individuals. However, the PECR still apply to the use of cookies or similar technologies, regardless of whether they process personal data or not, except for some limited exemptions.
* Websites do not only need an opt out of cookies if GDPR applies, but also if PECR applies. The GDPR and the PECR both require data controllers to obtain the user's consent before using any cookies or similar technologies that are not strictly necessary, and to offer the user a way to refuse or withdraw their consent. The opt out of cookies is a mechanism that allows the user to exercise their right to object to the use of cookies or similar technologies, and to prevent the processing of their personal data by them. Websites need to provide an opt out of cookies in all cases where the user's consent is required, regardless of whether the GDPR or the PECR applies. References:
* GDPR, Article 4(1)5
* GDPR, Article 6(1)(a)6
* GDPR, Article 13 and 147
* GDPR, Article 328
* GDPR, Article 25
* PECR, Regulation 6
* PECR, Regulation 5
質問 # 26
A privacy notice MUST NOT contain
- A. Details of the processor's staff
- B. The purpose of the processing
- C. The contact details of the controller
- D. Details of the right to lodge a complaint with the supervisory authority
正解：A
解説：
Explanation
A privacy notice is a document that provides individuals with information about how their personal data is processed, as required by Article 13 and 14 of the UK GDPR5. A privacy notice must include the following information, among others:
* the identity and contact details of the controller and, where applicable, the controller's representative and the data protection officer;
* the purposes and legal basis of the processing;
* the categories of personal data concerned;
* the recipients or categories of recipients of the personal data, including any third parties or international organisations;
* where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available;
* the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
* the existence of the rights of the data subject, such as the right to access, rectify, erase, restrict, object or port the data, and the conditions or limitations on those rights;
* the existence of the right to withdraw consent at any time, where the processing is based on consent;
* the right to lodge a complaint with a supervisory authority;
* whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
* the existence of automated decision-making, including profiling, and meaningful information about the
* logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
A privacy notice does not need to contain details of the processor's staff, as this is not relevant or necessary for the data subject to understand how their personal data is processed. However, the controller may need to inform the data subject if their personal data is shared with a processor, and provide the identity and contact details of the processor, as part of the information on the recipients or categories of recipients of the personal data. References:
* Article 13 and 14 of the UK GDPR5
質問 # 27
What is the basis of the accountability and data governance obligation (Article 5 (2) of the GDPR)?
- A. The controller shall appoint a DPO before carrying out large scale processing
- B. Processors have overarching responsibility to ensure their processing is compliant
- C. The controller shall be responsible for. and be able to demonstrate compliance with the data protection principles.
- D. Controllers and Processors each have a responsibility to conduct legitimate interests balancing tests before processing data for direct marketing
正解：C
解説：
Explanation
Article 5(2) of the GDPR introduces the principle of accountability, which requires that the controller is responsible for, and be able to demonstrate compliance with, the data protection principles set out in Article
5(1). These principles are: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and data protection by design and by default. The controller must implement appropriate technical and organisational measures to ensure and demonstrate compliance, such as policies, procedures, records, audits, reviews, and DPIAs. The controller must also cooperate with the supervisory authority and provide any information requested by it. The other options are not the basis of the accountability and data governance obligation, although they may be related to other obligations under the GDPR. References:
* Article 5(2) of the GDPR3
* ICO guidance on accountability and governance4
質問 # 28
An investigation reveals that an individual is defrauding a public authority After a (suspected) tip off from a senior manager, the individual submits a Subject Access Request to the authority asking for a copy of all personal data relating to any investigations that have been carried out What would be the BEST approach?
- A. This is criminal offence data and therefore under the provisions of the Data Protection Act 2018, there is no obligation to disclose
- B. While the right to inform does not apply in relation to criminal acts, they need to disclose the information as this has not yet been passed to the police.
- C. The legal and professional privilege exemption applies to this information, and therefore the information does not need to be disclosed
- D. They do not need to disclose details of the investigation as they can rely on the crime and taxation exemption on the basis that disclosure would prejudice the investigation
正解：D
解説：
Explanation
The crime and taxation exemption in Schedule 2, Part 1, Paragraph 2 of the Data Protection Act 2018 (DPA
2018) provides an exemption from the UK GDPR's transparency obligations and most individual rights, including the right of access, but only if complying with them would prejudice the prevention or detection of crime, or the apprehension or prosecution of offenders. This means that the public authority does not need to disclose details of the investigation to the individual who submitted the subject access request, as doing so would be likely to hinder the investigation and enable the individual to evade justice. The public authority should assess the likelihood of prejudice on a case-by-case basis and document its reasons for relying on the exemption. The other options are incorrect because:
* The legal and professional privilege exemption in Schedule 2, Part 1, Paragraph 19 of the DPA 2018 applies to personal data that is subject to an obligation of confidentiality arising from the provision of legal advice or legal representation, or from the conduct of legal proceedings. This exemption does not apply to the information held by the public authority about the investigation, as it is not related to any legal advice or representation, or any legal proceedings.
* The term "criminal offence data" refers to personal data relating to criminal convictions and offences, or related security measures. This type of data is subject to specific rules under Article 10 of the UK GDPR and Part 3 of the DPA2018. However, this does not mean that there is no obligation to disclose criminal offence data in response to a subject access request. The public authority still needs to consider whether any of the exemptions in the DPA 2018 apply, such as the crime and taxation exemption, before disclosing or withholding the data.
* The right to be informed does apply in relation to criminal acts, as the UK GDPR requires controllers to provide data subjects with information about the processing of their personal data, including the purposes and legal basis of the processing, unless an exemption applies. The fact that the information has not yet been passed to the police does not affect the applicability of the right to be informed or the right of access. References:
* Data Protection Act 2018, Schedule 2, Part 1, Paragraph 21
* ICO Guide to Data Protection, Crime and Taxation2
* Data Protection Act 2018, Schedule 2, Part 1, Paragraph 193
* UK GDPR, Article 104
* Data Protection Act 2018, Part 35
* UK GDPR, Article 13 and 146
質問 # 29
Which of the following is NOT a processor obligation?
- A. To inform the controller of any intended changes of other processors so they can object
- B. To consult the controller prior to appointing any processor.
- C. To provide the controller with corporate information relating to its board members.
- D. To follow the instructions of the controller in processing personal data
正解：C
解説：
Explanation
Providing the controller with corporate information relating to its board members is not a processor obligation under the GDPR. The processor obligations under the GDPR are mainly the following:
* To process the personal data only on documented instructions from the controller, unless required by law;
* To ensure that persons authorised to process the personal data are bound by confidentiality;
* To implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk;
* To not engage another processor without the prior authorisation of the controller;
* To assist the controller in fulfilling its obligations regarding data subject rights, data protection impact assessments, prior consultations, and data breach notifications;
* To delete or return the personal data to the controller at the end of the service, unless required by law to store the data;
* To make available to the controller all information necessary to demonstrate compliance and allow for audits and inspections. References:
* Article 28 of the GDPR1
* Guidelines 07/2020 on the concepts of controller and processor in the GDPR2, pp. 37-41
質問 # 30
In which of the following circumstances does a public authority NOT need to appoint a Data Protection Officer?
- A. Where it processes special category data
- B. Where it is a court acting in its judicial capacity
- C. Where it processes a large amount of personal data
- D. Where it is defined as a public body in the Data Protection Act 2018
正解：B
解説：
Explanation
Under Article 37 of the UK GDPR, a public authority or a public body must appoint a data protection officer (DPO) unless it is a court acting in its judicial capacity. This is the only exception for public authorities or bodies from the obligation to appoint a DPO. The other circumstances listed in the question, such as processing a large amount of personal data, processing special category data, or being defined as a public body in the Data Protection Act 2018, do not exempt a public authority or a public body from appointing a DPO.
References:
* Article 37 of the UK GDPR2
* Data protection officers | ICO2
質問 # 31
What is the Employment Practices Code?
- A. A statutory framework for implementing data protection training for employees.
- B. A set of exemptions that can be used when processing data related to employees
- C. Guidance on the requirements for employing a Data Protection Officer
- D. Guidance on meeting legal requirements of data protection when employing staff
正解：D
解説：
Explanation
The Employment Practices Code is a guidance document issued by the ICO that provides recommendations on how to comply with the data protection principles and the rights of data subjects when processing personal data in the context of employment. The code covers various aspects of employment practices, such as recruitment and selection, employment records, monitoring at work, and information about workers' health.
The code is not legally binding, but it reflects the ICO's interpretation of the Data Protection Act and the UK GDPR, and it may be used as evidence in legal proceedings or investigations. The code is intended to help employers balance their legitimate interests in managing their workforce with the privacy rights of their workers. References:
* The Employment Practices Code
* Quick Guide to the Employment Practices Code
質問 # 32
Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?
- A. It is key to the accountability element of the GDPR.
- B. It fulfils a requirement that data protection is carried out by design and default.
- C. It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO
- D. It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated
正解：C
質問 # 33
What is the meaning of storage limitation in relation to UK GDPR Article 5 (1 )(e)?
- A. Storing data in a secure format only permitting access to those with a business need
- B. Only storing data in locations within the EU. except where there is an adequacy decision.
- C. Keeping identifiable personal data for no longer than is necessary for the intended processing
- D. Limiting the number of records stored in any single repository to minimise risk surface.
正解：C
解説：
Explanation
Storage limitation is one of the principles of data protection under the UK GDPR. It means that personal data should not be kept in a form that allows identification of data subjects for longer than is necessary for the purposes for which the data are processed. The UK GDPR does not specify any fixed time limits for different types of data, but rather requires data controllers to determine and justify the appropriate retention periods for their processing activities, taking into account factors such as the nature, scope, context and purposes of the processing, the risks to the rights and freedoms of data subjects, and the legal obligations and expectations of the data controller. Data controllers should also have a policy setting out standard retention periods where possible, and review the data they hold regularly to ensure that it is erased or anonymised when it is no longer needed. Data subjects have the right to request the erasure of their personal data if the data controller no longer has a lawful basis or a legitimate interest for keeping it. The UK GDPR allows for some exceptions to the storage limitation principle, such as when the personal data is processed solely forarchiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to appropriate safeguards for the rights and freedoms of data subjects. References:
* UK GDPR, Article 5 (1) (e) and (2)4
* UK GDPR, Article 175
* UK GDPR, Article 896
* ICO Guide to Data Protection, Storage Limitation7
質問 # 34
Which of the following is NOT a key requirement of independent supervisory authorities?
- A. They must operate independently.
- B. Their leadership must change every four years
- C. They must provide each other with mutual assistance
- D. They review DPIAs in cases of unmitigated high risk
正解：B
解説：
Explanation
Independent supervisory authorities are public authorities that supervise, through investigative and corrective powers, the application of the data protection law. They provide expert advice on data protection issues and handle complaints lodged against violations of the UK GDPR and the relevant national laws. The UK GDPR sets out the key requirements for independent supervisory authorities in Chapter VI, which include the following:
* They must operate independently and remain free from external influence, whether direct or indirect, and must neither seek nor take instructions from anybody.
* They must have adequate human, technical and financial resources to perform their tasks and exercise their powers effectively.
* They must review data protection impact assessments in cases of unmitigated high risk and provide prior consultation to controllers on such processing operations.
* They must provide each other with mutual assistance and cooperate with each other and the European Data Protection Board to ensure the consistent application of the UK GDPR across the EU.
* They must handle complaints lodged by data subjects or by bodies, organisations or associations representing them, and investigate the subject matter of the complaint to the extent appropriate.
* They must adopt binding decisions on matters concerning the application of the UK GDPR and impose effective, proportionate and dissuasive administrative fines for infringements of the UK GDPR.
The UK GDPR does not specify any fixed term for the leadership of independent supervisory authorities, nor does it require their leadership to change every four years. However, it does require that the members of the supervisory authority must be appointed by means of a transparent procedure by the parliament, the government or the head of state of the Member State concerned, and that they must act with integrity, refrain from any action incompatible with their duties and not engage in any incompatible occupation during and after their term of office. The UK GDPR also allows Member States to provide for rules regarding the establishment, appointment, duration of the term and dismissal of the head or members of the supervisory authority. References:
* UK GDPR, Chapter VI7
* ICO website, About the ICO8
質問 # 35
Article 9(2)(c) of UK GDPR condition of processing special category data in the vital interests of the data subject is only applicable in which of the following circumstances:
- A. When the data subject is physically unable to be present
- B. When the data subject refuses to consent
- C. When a data subject is incapacitated
- D. When another lawful basis applies.
正解：C
解説：
Explanation
Article 9(2) of UK GDPR allows the processing of special category data when it is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent. This means that the data subject is unable to exercise their right to consent or object to the processing, either because they are unconscious, in a coma, suffering from a severe mental disorder, or otherwise unable to communicate their wishes. This condition is intended to cover emergency situations, such as life-threatening medical interventions, where the data subject's consent cannot be obtained in time. It does not apply when another lawful basis applies, when the data subject is physically absent but still capable of giving consent, or when the data subject refuses to consent. References:
* Article 9(2) of UK GDPR1
* ICO guidance on special category data2
質問 # 36
Which of the following statements MOST accurately describes the potential impact of Al on the principle of transparency?
- A. Transparency requirements do not apply to Al, as there is a relevant exemption
- B. Transparency requirements do not apply to Al, as it is always compatible with original purposes
- C. Al can lead to invisible processing, with data subjects not being aware of its presence.
- D. Data subjects should generally expect Al to be present in processing activities
正解：C
解説：
Explanation
The principle of transparency requires that any processing of personal data is fair, lawful and transparent to the data subjects. This means that data subjects should be informed about the existence, nature, purpose and consequences of the processing, as well as their rights and choices regarding their data. Transparency is essential for ensuring accountability, trust and compliance in data processing. However, the use of AI can pose challenges to the principle of transparency, as AI can lead to invisible processing, with data subjects not being aware of its presence, or the logic, significance and implications of the processing. For example, AI can be used to profile, infer, predict or influence the behaviour, preferences, interests, emotions or personality of data subjects, without their knowledge or consent. AI can also be used to make automated decisions that affect data subjects, such as credit scoring, recruitment, health diagnosis or social benefits, without providing meaningful explanations or opportunities for human intervention. Therefore, it is important to ensure that data subjects are informed and empowered when AI is involved in the processing of their data, and that they can exercise their rights, such as the right to access, rectify, object, restrict, erase or port their data, or the right to challenge or contest automated decisions56. References:
* Guidance on AI and data protection5
* Explaining decisions made with AI6
質問 # 37
When does a personal data breach need to be reported to a supervisory authority?
- A. Only where a disclosure is of special category data
- B. All personal data breaches must be reported to a supervisory authority
- C. When the controller's right of freedom of expression outweighs the data subject's right to a private home and family life.
- D. Where the personal data breach is likely to result in a risk to the rights and freedoms of natural persons.
正解：D
解説：
Explanation
Article 33 of the UK GDPR requires controllers to notify the supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. This means that not all personal data breaches need to be reported to the supervisory authority, only those that pose a risk to individuals. The risk should be assessed in terms of the potential negative consequences for individuals, such as discrimination, identity theft, fraud, financial loss, damage to reputation, loss of confidentiality, or any other significant economic or social disadvantage. The UK GDPR also requires controllers to communicate the personal data breach to the affected data subjects without undue delay, where the breach is likely to result in a high risk to their rights and freedoms. The other options are incorrect because:
* The UK GDPR does not require all personal data breaches to be reported to the supervisory authority, only those that pose a risk to individuals. However, controllers must document all personal data breaches, regardless of whether they are reported or not, as part of their accountability obligations.
* The UK GDPR does not make a distinction between personal data and special category data when it comes to reporting personal data breaches. Special category data is a type of personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or that concerns health, sex life or sexual orientation, or biometric or genetic data for the purpose of uniquely identifying a natural person. The processing of special category data is subject to stricter conditions and safeguards under the UK GDPR, but the reporting of personal data breaches involving such data is subject to the same criteria as any other personal data breach, namely the risk to individuals.
* The UK GDPR does not provide an exemption from reporting personal data breaches based on the controller's right of freedom of expression. The right of freedom of expression is a fundamental right that is recognised and protected by the UK GDPR, but it is not an absolute right that overrides the rights and freedoms of data subjects. The UK GDPR allows Member States to provide for exemptions or derogations from certain provisions of the UK GDPR for the processing of personal data carried out for journalistic purposes or the purpose of academic, artistic or literary expression, where such exemptions or derogations are necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information. However, these exemptions or derogations do not apply to the obligation to report personal databreaches to the supervisory authority, unless the Member State law specifies otherwise. References:
* UK GDPR, Article 334
* UK GDPR, Article 34
* UK GDPR, Article 9
* UK GDPR, Article 85
質問 # 38
Under which circumstances can the 'domestic purposes' exemption be used to justify non-compliance with the Data Protection Act 2018?
A)An individual sells make up products for commission and uses social media to promote products to friends and family B)A couple are planning their daughter's wedding and use excel to store contact details and dietary needs of the guests C)An individual employs a babysitter and stores her bank details in an encrypted document in order to make payments D)A pansh council keeps a spreadsheet to manage bookings of the village hall, it contains only contact information and time slots E)A group of students are arranging a house party and using social media to invite people that they do and do not know
- A. B. C. D, and E
- B. B,and C
- C. A. B.C. and D
- D. A,B, C, and E.
正解：B
解説：
Explanation
The domestic purposes exemption applies to personal data processed by an individual only for the purposes of their personal, family or household affairs. This means that theprocessing has no connection to any professional or commercial activity. Examples of such processing include writing to friends and family, taking pictures for personal enjoyment, or keeping an address book. However, the exemption does not apply if the individual processes personal data outside the reasonable expectations of the data subject, or if the processing causes unwarranted harm to the data subject's interests. Therefore, the exemption can be used to justify non-compliance with the Data Protection Act 2018 in scenarios B and C, where the processing is purely personal and does not affect the rights and freedoms of others. However, the exemption cannot be used in scenarios A, D and E, where the processing has a professional or commercial element, or involves sharing personal data with third parties without consent or legitimate interest. References:
* Data Protection Act 2018, Schedule 2, Part 1, Paragraph 21
* ICO Guide to Data Protection, Domestic Purposes2
* ICO Guide to Data Protection, Exemptions3
質問 # 39
Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?
- A. It is key to the accountability element of the GDPR.
- B. It fulfils a requirement that data protection is carried out by design and default.
- C. It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO
- D. It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated
正解：C
解説：
Explanation
A DPIA is not required to fulfil the requirement that all DPIAs are submitted to the ICO, because this is not a requirement under the GDPR. The GDPR only requires that the controller consults the ICO before carrying out processing that is likely to result in a highrisk to individuals, if the controller cannot mitigate that risk. This means that not all DPIAs need to be submitted to the ICO, only those that identify a high residual risk that cannot be reduced. The other options are valid purposes of carrying out a DPIA, as they help the controller to comply with the GDPR, ensure data protection by design and by default, and identify and mitigate the main risks to individuals' rights and freedoms. References:
* Article 35 and 36 of the GDPR3
* ICO guidance on DPIAs5
質問 # 40
Describe the act of processing under the authority of a controller or processor as stipulated in UK GDPR Article 29.
- A. The processor shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.
- B. A processor shall not process those data except on instructions from the controller, unless required to do so by domestic law
- C. The processor shall consult the supervisory authority prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the processor to mitigate the risk.
- D. Each processor and, where applicable, the processors representative shall maintain a record of all categories of processing activities earned out on behalf of a controller.
正解：B
解説：
Explanation
Article 29 of UK GDPR states that the processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by domestic law. This means that the processor must follow the controller's directions on how to handle the personal data, and cannot use it for its own purposes or deviate from the agreed terms. The only exception is when the processor is obliged by law to process the data in a different way, for example, to comply with a court order or a legal obligation. The other options are not related to Article 29, but to other articles of UK GDPR, such as Article 25 (data protection by design and by default), Article 30 (records of processing activities), and Article 36 (prior consultation). References:
* Article 29 of UK GDPR1
* ICO guidance on controllers and processors2
質問 # 41
What factors should be considered when looking at security of processing under Article 32 of the GDPR?
Select the INCORRECT answer
- A. The most secure option available
- B. Lawfulness of processing
- C. Adherence to an approved code of conduct
- D. The likelihood of a risk to the rights of the data subjects
正解：B
解説：
Explanation
Lawfulness of processing is not a factor that should be considered when looking at security of processing under Article 32 of the GDPR. Lawfulness of processing is a separate requirement that applies to all processing of personal data, regardless of the level of security. Security of processing under Article 32 of the GDPR should be based on the following factors:
* The state of the art and the costs of implementation of the security measures;
* The nature, scope, context and purposes of the processing;
* The risk of varying likelihood and severity for the rights and freedoms of natural persons;
* Adherence to an approved code of conduct or an approved certification mechanism (as an element to demonstrate compliance). References:
* Article 32 of the GDPR1
* Guidelines 07/2020 on the concepts of controller and processor in the GDPR2, p. 36
質問 # 42
......
究極のガイドPDP9認証試験準備BCS Practitioner：https://jp.fast2test.com/PDP9-premium-file.html