Final test on basics of data protection

What is “data protection” actually?

What are personal data?

Which of the following personal data fall under the special (sensitive) personal data according to Art. 9 GDPR?

In which of the following situations would you process personal data?

Case study: An employee sends an e-mail to his manager requesting vacation time, asking for approval of the request. The manager then grants the vacation time.

Does the manager process the employee’s personal data in this case study?

Case study: Your head of department asks you to find out how many customers have revoked their consent to receive advertising material within the last calendar year.

To do this, you use the IT systems and search for the relevant customers. At the same time, you create a list of all customers who have submitted a revocation.

Do you process personal data in this case?

Case study: Hans has been dismissed.

Hans’s head of department wants to inform his department that he is not being dismissed because of a new hire and sends the following email to his employees:

“Hello everyone,

unfortunately there have been some problems in Hans’s cooperation and adherence to working hours. Unfortunately, these problems could not be resolved despite intensive discussions with management and myself, as well as participation in professional courses. We have therefore come to the conclusion that the changes made have not achieved the desired result and that we will not continue to employ Hans for this reason.

Hans will therefore leave us at the end of the month.”

Hans has agreed to this information being passed on to the employees.

Is the head of department allowed to pass this information on to the department?

Case study: Your 21 year-old colleague Jens has been having trouble getting to work on time.

Your superior has already told Jens that he should arrive at work on time, but to no avail. Jens has been reprimanded for this.

The next day, Jens’s girlfriend calls. She wants a copy of Jens’s employment contract because she needs it to apply for a bank loan. She also asks for the time sheets from the last 12 months because Jens is paid according to the hours he actually works.

Is your superior allowed to give this information to Jens’s girlfriend?

Does the requirement for organizational security apply to both physical and digital personal data?

What is the purpose of “data security”?

Which of the following case studies constitutes a data protection violation?

What should you do if you discover a data breach?

Case study: As part of an application process, you receive the usual application documents, such as the applicant’s CV and cover letter.

After you have hired the applicant, you use the portrait photo from the CV to present the employee on the website and on the intranet.

Is this use possible without further ado?

Case study: A data subject exercises their right of access. The request for information is sent to your e-mail address.

How do you respond?

In which of the following cases do you have to inform the data subject about the data processing in accordance with Art. 12 ff. of the GDPR?

What can you do to protect personal data in your day-to-day work?