Discuss BCS PDP9 Exam Topic 2 Question 27

What is the basis of the accountability and data governance obligation (Article 5 (2) of the GDPR)?

AThe controller shall appoint a DPO before carrying out large scale processing

BThe controller shall be responsible for. and be able to demonstrate compliance with the data protection principles.

CControllers and Processors each have a responsibility to conduct legitimate interests balancing tests before processing data for direct marketing

DProcessors have overarching responsibility to ensure their processing is compliant

Suggested Answer: C

The principle of transparency requires that any processing of personal data is fair, lawful and transparent to the data subjects. This means that data subjects should be informed about the existence, nature, purpose and consequences of the processing, as well as their rights and choices regarding their data. Transparency is essential for ensuring accountability, trust and compliance in data processing. However, the use of AI can pose challenges to the principle of transparency, as AI can lead to invisible processing, with data subjects not being aware of its presence, or the logic, significance and implications of the processing. For example, AI can be used to profile, infer, predict or influence the behaviour, preferences, interests, emotions or personality of data subjects, without their knowledge or consent. AI can also be used to make automated decisions that affect data subjects, such as credit scoring, recruitment, health diagnosis or social benefits, without providing meaningful explanations or opportunities for human intervention.Therefore, it is important to ensure that data subjects are informed and empowered when AI is involved in the processing of their data, and that they can exercise their rights, such as the right to access, rectify, object, restrict, erase or port their data, or the right to challenge or contest automated decisions56.Reference:

Guidance on AI and data protection5

Explaining decisions made with AI6

Get Premium PDP9 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

Bernadine 10 months ago

Sounds too vague to me, how can they really enforce that?

Kristin 11 months ago

Nope, it's definitely about demonstrating compliance with data principles.

Jerry 11 months ago

Wait, are you sure it's not about appointing a DPO?

Kati 11 months ago

Totally agree, it's all about accountability!

Barrett 11 months ago

Article 5(2) emphasizes the controller's responsibility for compliance.

Azzie 12 months ago

I thought it was about appointing a DPO, but that might be related to a different part of the GDPR.

Glory 12 months ago

I feel like Article 5(2) emphasizes accountability, so B seems right, but I could be mixing it up with another article.

Shenika 12 months ago

I recall a practice question that focused on the responsibilities of controllers and processors, but I can't remember the exact wording.

Bobbie 1 year ago

I think the answer might be B, but I'm not entirely sure. I remember something about controllers needing to demonstrate compliance.

Rochell 1 year ago

I'm pretty confident that the answer is B. The GDPR is clear that the controller is responsible for demonstrating compliance with the data protection principles. That's the core of the accountability and data governance obligation.

Ardella 1 year ago

I'm a little confused by this question. The wording seems a bit tricky. I'll have to review my notes on the GDPR to make sure I'm interpreting this correctly. Maybe I'll come back to it later if I have time.

Madelyn 1 year ago

Okay, I've got it! The basis of the accountability and data governance obligation is that the controller shall be responsible for and able to demonstrate compliance with the data protection principles. That's option B.

Enola 1 year ago

Hmm, I'm a bit unsure about this one. I'll need to re-read the GDPR text to make sure I understand the accountability and data governance obligations. Let me think this through carefully.

Therese 1 year ago

This one seems pretty straightforward. I think the answer is B - the controller is responsible for demonstrating compliance with the data protection principles.

Genevieve 1 year ago

Option B all the way! The controller is the one holding the bag, so they better be able to prove they're doing it right. Wouldn't want to end up like that guy who got fined for losing track of his data, yikes!

Aliza 1 year ago

I think option B is the way to go. The controller has to be able to show they're following the GDPR requirements. Anything less is just asking for trouble!

Mel 1 year ago

↳ replying to Aliza

Richelle: It's important for controllers to take their responsibilities seriously.

Richelle 1 year ago

↳ replying to Aliza

User 2: Absolutely, accountability and data governance are key aspects of GDPR.

Gladys 1 year ago

↳ replying to Aliza

User 1: I agree, option B is crucial for demonstrating compliance with GDPR.

Rosita 1 year ago

Hmm, I'm not sure about option B. Doesn't the GDPR also require controllers to conduct legitimate interests assessments for direct marketing? I'll need to double-check that.

Ellen 1 year ago

↳ replying to Rosita

User 3: Processors have a responsibility to ensure their processing is compliant, right?

Chu 1 year ago

↳ replying to Rosita

User 2: I'm not sure, I think controllers also need to conduct legitimate interests assessments for direct marketing.

Destiny 1 year ago

↳ replying to Rosita

User 1: I think option B is correct, controllers must demonstrate compliance with data protection principles.

Tresa 1 year ago

Option B sounds like the correct answer to me. The controller is responsible for demonstrating compliance with the GDPR principles.

Laura 2 years ago

I'm not sure, but I think D) Processors have overarching responsibility to ensure their processing is compliant could also be a valid answer.

Earleen 2 years ago

I agree with Markus, it makes sense that the controller should be responsible for ensuring compliance with data protection principles.

Markus 2 years ago

I think the basis of the accountability and data governance obligation is B) The controller shall be responsible for and be able to demonstrate compliance with the data protection principles.

BCS PDP9 Exam - Topic 2 Question 27 Discussion