Module 3 · Self-test

People's rights

8 questions. Pick one answer for each, then mark yourself. Nothing leaves your browser.

1. Which of these does Section 9(3) forbid a Data Fiduciary to do?Process any personal data of a child for any purposeUndertake tracking or behavioural monitoring of children, or targeted advertising directed at childrenSend a child's parent a notice by emailStore a child's personal data outside the child's home state

2. A parent who is not a registered user of a platform wants to consent for her child. Under Rule 10, how may the platform check she is an identifiable adult?By asking her to tick a box confirming she is over eighteenBy asking the child to confirm the parent's ageBy reference to identity and age details issued by an entity entrusted by law or the Government, or a virtual token mapped to themBy waiting for the Board to verify her

3. A school tracks pupils' attendance and behaviour for its educational activities. What do Rule 12 and Part A of the Fourth Schedule do?Exempt the school from all of Section 9Lift Section 9(1) and 9(3) for that tracking and behavioural monitoring, subject to the stated conditionsRequire the school to register with the Board before trackingNothing; schools are not named in the Fourth Schedule

4. What must a Data Fiduciary give a Data Principal who makes an access request under Section 11(1)?A copy of its internal security policiesOnly a confirmation that it holds some personal data about herA summary of her personal data and the processing activities, and the identities of other Data Fiduciaries and Data Processors it was shared with, with a description of what was sharedThe source code of the systems that process her data

5. A customer asks for her personal data to be erased. Under Section 12(3), when may the Data Fiduciary keep it?Whenever it might be useful for future marketingWhen retention is necessary for the specified purpose or for compliance with a law in forceNever; every erasure request must be carried out in full at onceOnly if she has not paid an erasure fee

6. What does Rule 14(3) require about the time taken to respond to grievances?Each grievance must be answered within twenty-four hoursThere is no time limit, so long as a reply is eventually sentThe Board sets a separate deadline for every grievanceThe Data Fiduciary must prominently publish its response period, a reasonable period not exceeding ninety days

7. Under Section 14, when does a nominee exercise a Data Principal's rights?In the event of the Data Principal's death or incapacityWhenever the Data Principal is travelling abroadOnly after the Board approves the nominationWhenever the Data Fiduciary asks the nominee to

8. Which of these is a duty of the Data Principal under Section 15?To keep her password confidentialTo read every privacy notice in full before using a serviceNot to register a false or frivolous grievance or complaint with a Data Fiduciary or the BoardTo tell the Data Fiduciary about any breach she suspects