Free Preparation Discussions
MENU
IAPP CIPP-E Exam - Topic 5 Question 121 Discussion
Topic #: 5
A company has collected personal data tor direct marketing purpose on the basis of consent. It is now considering using this data to develop new products through analytics. What is the company first required to do?
According to the GDPR, consent is one of the lawful bases for processing personal data1.Consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her2.Therefore, consent must be specific to each purpose of processing and cannot be bundled with other purposes3.If a company wants to use personal data for a new purpose that is not compatible with the original purpose for which consent was given, it must obtain a new consent from the data subjects for the new processing4. Simply informing the data subjects of the new purpose or updating the privacy notice is not sufficient, as it does not imply the data subject's agreement to the new processing.Proceeding with the new processing without obtaining a new consent would be unlawful and could result in fines and sanctions5.Reference:
Free CIPP/E Study Guide, page 23, section 4.1.1
GDPR, Article 4 (11)
GDPR, Recital 32
GDPR, Article 6 (4)
GDPR, Article 83 (5) (a)
Fernanda
Rozella
5 days agoBuck
10 days agoEdelmira
15 days agoLouann
20 days agoAlex
26 days agoMajor
1 month agoTegan
1 month agoBernadine
1 month agoGilbert
2 months agoBernardine
2 months agoCora
2 months agoDelbert
2 months agoMarge
2 months agoLilli
2 months agoSherman
3 months agoViva
3 months agoLouisa
4 months agoCarey
4 months agoValda
5 months ago