IAPP CIPM Exam - Topic 4 Question 64 Discussion

Actual exam question for IAPP's CIPM exam

Question #: 64
Topic #: 4

Under the GDPR. when the applicable lawful basis for the processing of personal data is a legal obligation with which the controller must comply. which right can the data subject exercise?

ARight to withdraw consent.

BRight to data portability.

CRight to restriction.

DRight to erasure.

Show Suggested Answer

Suggested Answer: C

Under the GDPR, when the applicable lawful basis for the processing of personal data is a legal obligation with which the controller must comply, the data subject can exercise the right to restriction. This means that the data subject can request the controller to limit the processing of their personal data in certain circumstances, such as when they contest the accuracy or lawfulness of the processing. The other rights are not applicable in this case, as they are either dependent on consent (right to withdraw consent and right to data portability) or subject to exceptions (right to erasure).Reference:GDPR, Articles 6(1), 18, 21(1).

by Daniela at Jul 04, 2024, 10:25 AM

Limited Time Offer

25%

Off

Get Premium CIPM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Isabelle

10 months ago

Wait, can you really restrict data if it's a legal obligation?

upvoted 0 times

...

Hoa

10 months ago

Right to data portability doesn't apply here.

upvoted 0 times

...

Rosendo

10 months ago

Right to erasure sounds plausible, but I'm not sure.

upvoted 0 times

...

Honey

10 months ago

I think it's the right to restriction!

upvoted 0 times

...

Sina

11 months ago

It's definitely not the right to withdraw consent.

upvoted 0 times

...

Pansy

11 months ago

I’m leaning towards the right to restriction, but I can't recall if there are exceptions when it comes to legal obligations.

upvoted 0 times

...

Bev

11 months ago

I feel like the right to erasure is usually tied to consent, so it might not be the right answer here.

upvoted 0 times

...

Charlette

11 months ago

I remember practicing a question like this, and I think the right to restriction could be relevant when a legal obligation is involved.

upvoted 0 times

...

Chaya

11 months ago

I think the right to withdraw consent might not apply here since it's about a legal obligation, but I'm not entirely sure.

upvoted 0 times

...

Chandra

11 months ago

I think the key here is recognizing that with a legal obligation, the data subject doesn't have the right to withdraw consent or the right to data portability. The right to restriction seems like the best option based on the information provided. I'll go with that unless I can come up with a better understanding.

upvoted 0 times

...

Ronnie

11 months ago

Wait, I'm a little confused. If the lawful basis is a legal obligation, doesn't that mean the controller has to comply with that obligation regardless of the data subject's wishes? I'm not sure the right to restriction is the right answer here. Let me think this through again.

upvoted 0 times

...

Virgilio

11 months ago

Okay, I've got this. When the lawful basis is a legal obligation, the data subject's right to withdraw consent doesn't apply. The right to restriction is the correct answer here. I'm confident in this one.

upvoted 0 times

...

Darrel

11 months ago

Hmm, this one's a bit of a head-scratcher. The key seems to be understanding the relationship between the lawful basis of legal obligation and the data subject's rights. I'll need to review that part of the GDPR material again to make sure I get the right answer.

upvoted 0 times

...

Sarah

11 months ago

This question is tricky, as the GDPR has a lot of different rights and lawful bases to keep track of. I'll need to carefully read through the options and think about how the right to withdraw consent, data portability, restriction, and erasure apply in this scenario.

upvoted 0 times

...

Rhea

12 months ago

Okay, let's break this down step-by-step. We need to support analysis based on all three date foreign keys, so creating separate queries for each one makes sense. I'll need to double-check the details, but this solution seems like it could work.

upvoted 0 times

...

Laticia

12 months ago

Okay, I've got this. The best way to reduce call volume is to create an FAQ knowledge article and deploy a chatbot. That covers the most common questions and provides an easy self-service option for customers.

upvoted 0 times

...

Eva

12 months ago

I think option A makes sense since a new distribution center could improve delivery times, which is important for customer service.

upvoted 0 times

...

Javier

2 years ago

I see your point, Ivette, but I still think it's C) Right to restriction because the controller must comply with a legal obligation.

upvoted 0 times

...

Polly

2 years ago

A) Right to withdraw consent. Ha! Good one, but that's not relevant when the basis is a legal requirement, not consent.

upvoted 0 times

Joaquin

2 years ago

C) Right to restriction. That's right, the data subject can exercise the right to restriction in this situation.

upvoted 0 times

...

Daryl

2 years ago

A) Right to withdraw consent. That's correct, it wouldn't apply in this case.

upvoted 0 times

...

Lamonica

2 years ago

I'm not sure, but I think it might be B) Right to data portability.

upvoted 0 times

...

Pamela

2 years ago

D) Right to erasure. Hmm, not quite. That's for when the processing is based on consent or legitimate interests, not legal obligations.

upvoted 0 times

...

Dante

2 years ago

B) Right to data portability? Really? That wouldn't make sense here. The GDPR is all about protecting data, not making it portable.

upvoted 0 times

...

Lino

2 years ago

C) Right to restriction. That's the correct answer, as the GDPR grants the data subject the right to restrict processing when the legal basis is a legal obligation.

upvoted 0 times