PC-DP sample questions

Question 1

A local municipal council, the Borough of Oakhaven, installs covert surveillance cameras in a public park to identify individuals engaging in persistent fly-tipping (illegal waste dumping). A local civil liberties group challenges this action, citing a breach of the individuals' right to respect for private and family life. Under the context of the Human Rights Act 1998 and the European Convention on Human Rights (ECHR), which of the following statements is technically accurate regarding this scenario?

Accepted Answer

The right to a private life under Article 8 of the ECHR is a qualified right, meaning the state can interfere with it provided the action is lawful, necessary in a democratic society, and proportionate to a legitimate aim.

Answer

The right to a private life under Article 8 of the ECHR is an absolute right; therefore, the council's covert surveillance is inherently unlawful regardless of the justification.

Answer

The Human Rights Act 1998 strictly prohibits public authorities from utilizing covert surveillance unless explicit consent has been obtained from the individuals being recorded.

Answer

Data protection legislation supersedes the Human Rights Act 1998, meaning the council only needs to satisfy the UK GDPR lawful basis requirements, completely ignoring ECHR provisions.

Question 2

True or False: A cloud software provider headquartered exclusively in Tokyo, Japan, with no offices or representatives in the United Kingdom, offers a specialized accounting application. The application allows users to select 'Great British Pounds (GBP)' as a currency, provides a dedicated UK customer service phone line, and actively runs targeted social media campaigns aimed at London-based financial firms. Under Article 3 of the UK GDPR, the Tokyo-based provider is completely exempt from UK data protection legislation because they have no physical establishment in the UK.

Accepted Answer

False

Answer

True

Question 3

Following the UK's departure from the European Union, the legislative framework for data protection in the UK underwent significant structural changes. Which of the following best describes the core mechanism that established the 'UK GDPR'?

Accepted Answer

The EU GDPR was retained in domestic law by the European Union (Withdrawal) Act 2018 and subsequently amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 to create the UK GDPR.

Answer

The UK Parliament drafted an entirely new bill from scratch known as the Data (Use and Access) Act, which immediately replaced all EU regulations on January 1, 2021.

Answer

The UK reverted entirely to the Data Protection Act 1998, with minor amendments to accommodate modern cloud computing environments.

Answer

The Council of Europe Convention 108 was directly elevated to act as the primary statutory data protection framework in the UK, superseding the Data Protection Act 2018.

Question 4

HealthScan Diagnostics is conducting a clinical trial. To protect patient privacy, the data engineering team strips all direct identifiers (names, NHS numbers) from the dataset and replaces them with a unique alphanumeric string (e.g., 'Patient-77X9'). The mapping table that links 'Patient-77X9' back to the individual's actual identity is kept on an isolated, highly secure server accessible only by the Chief Medical Officer.

Which of the following statements accurately categorizes this dataset under the UK GDPR?

Accepted Answer

The dataset has undergone pseudonymisation. Because the additional information (the mapping table) exists that allows the data to be attributed to specific data subjects, the dataset remains personal data and is subject to the UK GDPR.

Answer

The dataset is considered completely anonymized because the researchers working with the data do not have access to the mapping table. Therefore, the dataset falls entirely outside the scope of the UK GDPR.

Answer

The dataset is classified as biometric data because it relates to health outcomes, and therefore it is automatically exempt from standard UK GDPR processing principles.

Answer

The dataset is considered non-personal data as long as the Chief Medical Officer signs a non-disclosure agreement preventing the release of the mapping table.

Question 5

A retail banking institution originally collected customer transaction data solely for the purpose of executing payments and preventing financial fraud. Two years later, the marketing department wants to extract this transaction data, aggregate it, and feed it into an external AI marketing tool to predict future consumer purchasing trends and send highly targeted third-party advertisements.

When evaluating this new processing activity against the Article 5(1)(b) 'Purpose Limitation' principle, which factor is the bank required to assess?

Accepted Answer

The bank must assess whether the new purpose (targeted third-party marketing) is compatible with the original purposes (executing payments and fraud prevention) for which the data was collected.

Answer

The bank must assess whether the external AI marketing tool uses AES-256 encryption, as purpose limitation only applies to unencrypted datasets.

Answer

The bank only needs to assess if the data has been stored for less than five years, as purpose limitation automatically expires after half a decade.

Answer

The bank is not required to assess anything, because financial institutions are granted an automatic exemption from the purpose limitation principle under the DPA 2018.

Question 6

A registered trade union in the UK has developed a mobile application for its members. The app actively collects data revealing the members' political opinions and trade union membership status to organize local rallies.

Under Article 9 of the UK GDPR and Schedule 1 of the DPA 2018, which TWO of the following represent valid conditions that the trade union could potentially rely upon to lawfully process this special category data? (Select TWO)

Accepted Answer

The data subject has given explicit consent to the processing of those personal data for one or more specified purposes.

Accepted Answer

The processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or not-for-profit body with a political, philosophical, religious or trade union aim.

Answer

The processing is necessary for the performance of a standard commercial contract to which the data subject is a party.

Answer

The processing is necessary for the purposes of the legitimate interests pursued by the trade union, overriding the fundamental rights of the data subject.

Answer

The processing is necessary to protect the economic interests of the controller in a highly competitive market.

Top vendors

Top exams

Free PC-DP sample questions

Following the UK's departure from the European Union, the legislative framework for data protection in the UK underwent significant structural changes. Which of the following best describes the core mechanism that established the 'UK GDPR'?

6 more free samples are waiting