Discuss Exin PDPF Exam Topic 2 Question 88

A controller discovers that a data subject, who had given consent for the processing of his data, has passed away. What this implies for data processing according to the General Data Protection Regulation (GDPR)?

AWith the death of the data owner, the controller can continue processing the data, as they are no longer under the GDPR.

BThe data can only be processed by the controller respecting the consent provided by the holder.

CThe controller must delete the data of the holder, since with the death of the holder the consent is automatically revoked.

DThe controller can process the data of a deceased person as long as it anonymizes the data.

Suggested Answer: A

With the death of the data subject, the controller can process the data in any way he wishes, since personal data of deceased persons is not within the scope of the GDPR.

Recital 27 says: This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons.

Get Premium PDPF Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

18 comments · newest first

Brent 10 months ago

Anonymizing data is a good workaround, but still tricky!

Ena 10 months ago

Wait, can they really just keep processing it? Sounds sketchy.

Dorothy 10 months ago

Totally agree, C seems right!

Carmela 11 months ago

B is misleading; consent doesn't carry over after death.

Werner 11 months ago

I think the consent is revoked upon death.

Cristy 11 months ago

I believe that processing data after someone's death is a gray area. Option D sounds plausible if the data is anonymized, but I'm not certain.

Carissa 11 months ago

This reminds me of a practice question we did about data retention policies. I feel like option C could be correct, but I'm not entirely confident.

Malcom 12 months ago

I think I read somewhere that consent doesn't automatically end with death, but it might depend on the jurisdiction.

India 12 months ago

I remember discussing how consent works under GDPR, but I'm not sure what happens when the data subject dies.

Shaunna 1 year ago

This question is testing our understanding of the GDPR's rules around consent and data processing. I'll need to review the relevant sections to make sure I select the correct answer.

Janey 1 year ago

I'm pretty confident I know the right answer here. The GDPR is clear that consent is required for data processing, and that consent is revoked upon the data subject's death. I'll select the appropriate option.

Brunilda 1 year ago

Okay, I think I've got a strategy here. The key is to focus on the consent aspect and whether that consent is still valid after the data subject's death. I'll weigh the options carefully.

Shaquana 1 year ago

Hmm, I'm a bit confused on this one. Does the GDPR have any specific provisions for handling data after someone passes away? I'll need to think this through.

Bernadine 1 year ago

This is a tricky one. I'll need to carefully review the GDPR guidelines on consent and data processing after a data subject's death.

Tamar 1 year ago

I think the controller can still process the data if it's necessary for legal reasons, so maybe D is the correct answer.

Felicitas 1 year ago

But doesn't consent expire with the death of the data subject?

Chauncey 1 year ago

I disagree, I believe it's B.

Felicitas 1 year ago

I think the answer is C.

Exin PDPF Exam - Topic 2 Question 88 Discussion