Introduction to European Data Protection

Origins and historical context of data protection law, human rights foundations, EU institutions, and the European legislative framework.

5 minutes 5 Questions

European Data Protection is a comprehensive legal framework designed to protect individuals' personal data and privacy rights across the European Union (EU) and European Economic Area (EEA). Its foundations are rooted in fundamental rights, particularly Article 8 of the European Convention on Human…

Concepts covered
EU AI Act: Principles, Risk Framework, and RolesNIS and NIS2 Directives and Data ProtectionEuropean Convention on Human Rights and Article 8OECD Privacy GuidelinesRole of the European Commission in Data ProtectionCouncil of the EU and European ParliamentCourt of Justice of the European Union (CJEU)Data Protection Directive 95/46/ECLaw Enforcement Directive (2016/680)Evolution of Data Protection in EuropeConvention 108 (Council of Europe)EU Charter of Fundamental Rights (Articles 7 and 8)GDPR Overview and StructureePrivacy Directive (2002/58/EC)Interaction Between Human Rights and Data ProtectionNational Data Protection Laws Pre-GDPR
Test mode:
Start practice test

CIPP/E - Introduction to European Data Protection Example Questions

Test your knowledge of Introduction to European Data Protection

Question 1

According to the terminology set forth in the OECD Privacy Guidelines, which description accurately defines the concept of personal data?

Correct Answer: Information relating to an identified or identifiable individual, known as the data subject.

The correct answer accurately reflects the OECD Privacy Guidelines, which define personal data broadly as any information relating to an identified or identifiable individual, establishing the foundational term data subject.
The option focusing on public or private activities is too narrow as personal data encompasses any information. Limiting it to structured digital records incorrectly restricts personal data by format and controller type. Restricting it to sensitive attributes incorrectly excludes non-sensitive identifying information.
The key concept tested is the foundational definition of personal data under the OECD Privacy Guidelines.

Question 2

In 2013, an organization decides to outsource its payroll operations to a specialized cloud service provider based in the same EU Member State. To comply with the Data Protection Directive 95/46/EC regarding the security of processing, what specific requirement must the organization fulfill before transferring employee records to the vendor?

Correct Answer: Ensure a formal agreement mandates the provider acts exclusively on instructions and implements appropriate technical security measures.

Under the Data Protection Directive, controllers engaging a data processor must establish a binding contract stipulating that the processor acts only on the controller instructions and implements appropriate technical and organizational security measures.
Registering the outsourcing arrangement with a supervisory authority is not a general requirement for standard processor engagements. Collecting explicit employee consent is unnecessary because payroll processing is required to fulfill the employment contract. Requiring an internal privacy board exceeds the statutory requirements established by the Directive.
Key concept tested: Controller and processor contractual obligations under the Data Protection Directive.

Question 3

A financial company audits its primary data storage provider and discovers multiple data breaches caused by unpatched servers. The company's leadership claims they fulfill the Security Safeguards principle because their internal corporate network is fully secured, and they hold a strict contract making the external provider fully liable for any breaches. Under the OECD Privacy Guidelines, what is the appropriate evaluation of this compliance posture?

Correct Answer: The data controller retains ultimate accountability for ensuring the storage provider implements adequate safeguards to protect personal information from unauthorized access.

Under the OECD Privacy Guidelines, the Accountability principle dictates that the data controller remains responsible for complying with the Security Safeguards principle, even when processing is outsourced to a third-party service provider.
Transferring liability via contract does not absolve the controller of its regulatory accountability, the Individual Participation principle relates to a data subject's right to access and challenge their data rather than consent for external storage, and the guidelines do not require national authorities to certify vendor security standards before data flows occur.
The key concept tested is controller accountability for outsourced data processing under the OECD Privacy Guidelines.

More Introduction to European Data Protection questions
429 questions (total)
Practice 100 questions
One session at a time, always new questions