Certified Information Privacy Professional CIPPE · Free Practice Question Medium
Question 17
VideoCorp is a data controller that creates online video games. VideoCorp is concerned about the loss of market share as a result of emerging social platforms where users can easily download video games created by its competitors.
VideoCorp identifies and teams up another video company CoolApps to promote and market their video games on popular social media platforms.
Both VideoCorp and CoolApps procure services of a popular marketing firm, SocialCorp.
The Agreement between VideoCorp and CoolApps (Video game companies) and SocialCorp includes the following clauses:
1Video game companies instruct SocialCorp to process Company Personal Data
2SocialCorp shall in relation to the Video game companies’ Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk.
3SocialCorp shall not appoint (or disclose any Company Personal Data to) any Sub-processor unless required or authorized by VideoCorp
4SocialCorp shall promptly notify Video game Companies if it receives a request from a Data Subject under any Data Protection Law
5SocialCorp shall notify Video game Companies upon SocialCorp becoming aware of a Personal Data Breach affecting Company Personal Data
6Once SocialCorp completes the marketing campaign, it should delete all copies of the customer information provided by the Video game Companies
Both VideoCorp and CoolApps provide SocialCorp with access to their customer database to create the marketing campaign for its video games. CoolApps decides to use the customer database to identify eligible customers to test a new video game. CoolApps creates the list of eligible participants and emails them an invitation to test the game.
VideoCorp and CoolApps notice a week after SocialCorp's campaigns that sales of its video games have increased.
During that week, VideoCorp also receives a data deletion request from a VideoCorp customer that no longer wishes to receive any VideoCorp marketing campaigns.
CoolApps receives a complaint from Customer Z who has received marketing communications from VideoCorp. Customer Z has never interacted or purchased video games from VideoCorp. Customer Z would like to know how VideoCorp obtained his email address.
A week after the marketing campaign ends, Social Corp decides to pseudonymize VideoCorp and CoolApps’s customer information for three months to conduct a research study on customers who purchase video games.
What is true about SocialCorp's decision to pseudonymize VideoCorp and CoolApps’s customer information to conduct a research study?
-
A
SocialCorp's decision to pseudonymize VideoCorp and CoolApps’s customer information violates the GDPR
-
B
SocialCorp will be fined 20 million Euros for violating the GDPR
-
C
SocialCorp does not violate GDPR as pseudonymization is permitted under the GDPR
-
D
SocialCorp is acting as the sub-processor when it pseudonymizes the data
Reveal correct answer
Correct answer: A
Explanation
Though pseudonymization is permitted under the GDPR, SocialCorp was legally obligated under the data processing agreement that it signed to delete the customer data of VideoCorp and CoolApps. When SocialCorp pseudonymized the data instead of deleting it, it violated the terms of the Data Processing Agreement.
The GDPR states explicitly that some violations are more severe than others.
The less severe infringements could result in a fine of up to €10 million, or 2% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher. They include any violation of the articles governing:
Controllers and processors (Articles 8, 11, 25-39, 42, and 43) — Organizations that collect and control data (controllers) and those that are contracted to process data (processors) must adhere to rules governing data protection, lawful basis for processing, and more.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
