CIPP/E: Certified Information Privacy Professional/EuropeDemo

By IAPP · Question Mode

QuestionQ77

European Data Processing

How should the refinement of the CreditPlaya Information Tracking System (ITS) be treated as a processing activity?

  • A Explained in the privacy notice, with a list of the special categories of applicants' data.
  • B Specified in the Terms and Conditions document sent to applicants.
  • C Capable of allowing applicants to exercise their Right to Object.
  • D Subject to the explicit consent of the applicants.
Explanation

Using applicants’ data to refine insurance-policy rates is profiling for a controller’s purposes. Where such processing relies on legitimate interests, GDPR Article 21 gives the data subject a right to object to processing, including profiling based on those grounds; explicit consent is not automatically required.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!