CIPM: Certified Information Privacy ManagerDemo

By IAPP · Question Mode

QuestionQ291

Privacy Operational Lifecycle: Assess

Under the General Data Protection Regulation (GDPR), which situation is LEAST likely to require a Data Protection Impact Assessment (DPIA)?

  • A A health clinic processing its patients’ genetic and health data
  • B The use of a camera system to monitor driving behavior on highways
  • C A Human Resources department using a tool to monitor its employees’ internet activity
  • D An online magazine using a mailing list to send a generic daily digest to marketing emails
Explanation

A routine mailing list that sends a generic daily marketing digest is ordinarily low-risk processing and does not, by itself, involve the high-risk characteristics that trigger a DPIA. GDPR Article 35 specifically identifies large-scale special-category-data processing and large-scale systematic monitoring of publicly accessible areas as processing that requires a DPIA; systematic monitoring of employees may also create a high risk.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!