Certified Information Privacy Professional CIPPE · Free Practice Question Medium
Question 20
People’s Bank is established in France but also has offices in Ireland, Germany, Sweden, and Portugal. The bank has a privacy notice and provides customers with information on how they can exercise their data subject rights.
To exercise their right of access, customers have the option of:
1Filling a form and submitting it electronically
2Dropping the form into the local branch
3Mailing the form
4Contacting the bank
5Submitting a request via Chat
To exercise their right to update information the customers can use Self-Service options available in the bank app or submit change of address or contact detail forms.
To delete their data, restrict the processing of personal data, and object to the processing of their information, customers have to complete a deletion request form, attach their signature, save it as a PDF and submit it electronically to the bank.
Fred, a German EU resident and customer of People’s Bank contacts the bank via mail to request access to his bank account statements. When the request is delivered, it is routed to the marketing department. Nina, the Chief Privacy Officer, is informed about Fred’s request after 3 months. Nina reviews Fred’s request and notes that it will take another month to compile all the information he has requested. She works with the bank's Data Protection Officer to prepare a response to his request. Because of the delay in receiving his information, Fred files a complaint with the French Supervisory Authority.
Phil, an EU resident who is also a People's Bank customer initially uses the bank's chat tool to request access to his bank's statements. People’s Bank complies with the request within 10 days via mail and sends it to Phil’s old mailing address. Clare, the new tenant at Phil’s old apartment, accidentally opens the envelope addressed to Phil. She realizes her mistake when she notices that the bank statements are addressed to Phil. She notifies the bank and she is advised to return Phil's statements to People’s Bank.
What is true regarding People's Bank when it received Fred’s request ?
-
A
People's Bank should have responded to Fred's request without undue delay and within 30 days of receipt of the request
-
B
People's Bank should have responded to Fred's request within 90 days
-
C
People's Bank should have responded to Fred's request within 60 days
-
D
People's Bank should have responded to Fred's request within 15 days
Reveal correct answer
Correct answer: A
Explanation
Under Article 15, right of access requests should be responded to without due delay and latest within 30 days. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests.
Nina will need to work with People's Bank Counsel to respond to Fred’s request without undue delay as it has been more than 30 days since he submitted the request. The Bank should respond to Fred’ request without undue delay and provide reasons for the delay.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
