CIPP/E: Certified Information Privacy Professional/EuropeDemo

By IAPP · Question Mode

QuestionQ13

Compliance with European Data Protection Law and Regulation

Under the GDPR, which party would be least likely to be permitted to collect, use, and disclose a data subject’s sensitive medical information without that data subject’s knowledge or consent?

  • A A member of the judiciary involved in adjudicating a legal dispute involving the data subject and concerning the health of the data subject.
  • B A public authority responsible for public health, where the sharing of such information is considered necessary for the protection of the general populace.
  • C A health professional involved in the medical care for the data subject, where the data subject’s life hinges on the timely dissemination of such information.
  • D A journalist writing an article relating to the medical condition in question, who believes that the publication of such information is in the public interest.
Explanation

Data concerning health is special-category personal data. The GDPR provides specific exceptions for processing necessary for legal claims, vital interests, health care, and public-health purposes, each subject to its applicable conditions and safeguards. Processing for journalistic purposes instead depends on Member State rules that reconcile data protection with freedom of expression; a journalist’s personal belief that publication serves the public interest does not by itself authorize processing sensitive medical data without the data subject’s knowledge or consent.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!