The GDPR principles
The seven principles of article 5: what each one forbids, the measure that respects it and the reference retention periods, so as to recognise the principle a practice violates.
- 24 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the timeline
- Scenarios
A few cards from the deck
Lawfulness, fairness, transparency: what is it?
Show the answer
Data must be processed on a ground the regulation provides, without misleading the person, who must be clearly informed.
Three requirements in one: a legal ground, no hidden or deceptive practice, and clear information about what is done with the data.
A site collects customers' e-mails to confirm orders, then uses them to send a partner's advertising. Which principle does this practice violate?
- Purpose limitation: a use incompatible with the collection
- Minimisation: the e-mail was not needed for the confirmation
- Accuracy: the e-mail address was not updated
- Storage limitation: the address is kept too long
Show the answer
Purpose limitation: a use incompatible with the collection
The e-mail was indeed needed for the confirmation. The flaw is the later use for an unrelated aim, which the person could not foresee.
Article 5 sets seven principles; the last, …, requires being able to … compliance with the other six.
Show the answer
Article 5 sets seven principles; the last, accountability, requires being able to demonstrate compliance with the other six.
Complying is not enough: during an inspection, it is up to the controller to show its registers, assessments and procedures.
Purpose limitation: what is it?
Show the answer
Data are collected for a specified, explicit and legitimate aim, and may not then be used for an aim incompatible with it.
Addresses collected to deliver a parcel cannot be used, without a new ground, to send a partner's advertising.
An audit finds that an application's database holds users' passwords in clear text. Which principle is at stake and what measure is expected?
- Minimisation; stop asking users for a password
- Accuracy; make users change their passwords every month
- Storage limitation; delete passwords after a year
- Integrity and confidentiality; store a salted hash with a dedicated algorithm
Show the answer
Integrity and confidentiality; store a salted hash with a dedicated algorithm
A secret readable by anyone with access to the database is a data security flaw. A salted hash is the usual measure: even a leak does not hand out the passwords.