According to the UK GDPR, the controller and the processor must support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge 1 .  The controller and the processor must also ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks and that he or she reports directly to the highest management level of the controller or the processor 1 . 

 According to the GDPR, location data is a type of personal data that can reveal information about an individual’s habits, preferences, or movements 1 .  Location data can also be considered as a special category of personal data if it reveals information about an individual’s health, ethnic origin, or religious beliefs 2 .  Therefore, location data is subject to the GDPR’s rules on the lawful processing of personal data, which require a valid legal basis, such as consent, contract, legal obligation, vital interest, public interest, or legitimate interest 2 .

In this scenario, Who-R-U decides to track locations using its app, which means that it collects and processes location data from its app users. This data can be used to identify the app users, as well as to infer information about their interests, preferences, or behavior.  Therefore, Who-R-U needs to comply with the GDPR, even if it only offers its services to Canadians, because it monitors the behavior of individuals in the EU 2 .

One of the possible legal bases for processing location data is consent, which means that the app users must give their informed, specific, and freely given agreement to the collection and use of their location data 2 .  Consent must be obtained before the processing starts, and it must be easy to withdraw at any time 2 .  Consent must also be granular, meaning that the app users must be able to choose which purposes and types of location data they agree to share 1 .

Therefore, if Who-R-U decides to track locations using its app, it must get consent from the app users, and provide them with clear and transparent information about how, why, and for how long their location data will be processed, who will have access to it, and what rights they have under the GDPR 1 2 .  Who-R-U must also ensure that the consent is voluntary, and that the app users can opt out of location tracking without affecting the functionality or quality of the app 1 2 .  References:   1  Policy Brief: Location Data Under Existing Privacy Laws | FPF. Available at:  5  (Accessed: 11 December 2023) 2  What is the General Data Protection Regulation (GDPR)? | Cloudflare. Available at:  6  (Accessed: 11 December 2023).

Before Anna determines whether Frank’s performance database is permissible, she needs to know more information about the following aspects of the data processing:

The purpose and legal basis of the data processing, which should be clearly defined and documented in a data protection impact assessment (DPIA) or a similar document 1 2 .

The nature and extent of the personal data involved, which should be limited to what is necessary for the purpose and not retained longer than necessary 1 2 .

The measures taken to ensure the security and confidentiality of the personal data, such as encryption, pseudonymization, access control, etc 1 2 .

The rights and interests of the data subjects, such as their right to access, rectify, erase or restrict their personal data, as well as their right to object or withdraw consent 1 2 .

The potential risks and consequences of the data processing for the rights and freedoms of the data subjects, such as identity theft, discrimination, reputational damage, etc 1 2 .

In this case, Anna needs to know more information about what students have been told and how the research will be used. This is because:

The purpose of using student records for research purposes is not clear from Frank’s description. He does not specify whether he has obtained consent from the students or their parents/guardians, or whether he has informed them about his research objectives and methods.

The nature and extent of using student records for research purposes is not clear from Frank’s description. He does not specify which student records he is using (e.g., by name or by reference number), how many records he is using (e.g., by cohort or by class), or how long he will keep them (e.g., until graduation or indefinitely).

The measures taken to ensure the security and confidentiality of using student records for research purposes are not clear from Frank’s description. He does not specify whether he has encrypted his program or his laptop before transferring it to his home device, whether he has backed up his program or his laptop before losing it on the train, or whether he has reported his lost laptop to his IT department.

Therefore, Anna needs more information about these aspects before she can determine whether Frank’s performance database is permissible under the GDPR.

The General Data Protection Regulation (GDPR) introduces a mechanism for personal data transfers to third countries or international organisations that do not ensure an adequate level of data protection, based on approved certifications. According to Article 42 of the GDPR, the European Commission, the European Data Protection Board (EDPB) and the national data protection authorities (DPAs) shall encourage the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with the GDPR of processing operations by controllers and processors. The specific needs of micro, small and medium-sized enterprises shall be taken into account.

The GDPR also provides that the certification mechanisms shall be voluntary and available via a transparent process. The certification shall be issued by the competent supervisory authority or by the certification bodies accredited by the supervisory authority or by the national accreditation body. The certification shall be valid for a maximum period of three years and may be renewed, under the same conditions, if the relevant requirements continue to be met. The certification shall be withdrawn, as the case may be, by the competent supervisory authority or by the certification bodies, where the requirements for the certification are not or are no longer met.

The GDPR further stipulates that the certification shall be issued to a controller or processor who has demonstrated, in accordance with the approved certification criteria, that the processing of personal data is in compliance with the GDPR. The certification shall specify the scope and purpose of the processing, the criteria applied and the duration of the validity of the certification. The certification shall not reduce the responsibility of the controller or the processor for compliance with the GDPR and shall not be interpreted as an endorsement of the quality or reliability of the products or services of the controller or the processor by the supervisory authority or the certification body.

The GDPR also states that the certification mechanisms shall contribute to the proper application of the GDPR, taking account of the specific features of the various processing sectors and the different risks for the rights and freedoms of data subjects. The certification mechanisms shall allow for the verification of compliance with the GDPR of processing operations by controllers and processors not established in the EU, regardless of the location of the processing. The certification mechanisms shall also provide for the possibility to demonstrate compliance with the GDPR for personal data transfers to third countries or international organisations under Article 46, which sets out the rules and requirements for the transfer of personal data to third countries or international organisations based on appropriate safeguards, such as binding corporate rules, standard contractual clauses, codes of conduct or certification mechanisms.

The Data Retention Directive (2006/24/EC) was a legal framework that required Member States to ensure that providers of publicly available electronic communications services or of public communications networks retained certain data for a period of between six months and two years, for the purpose of the prevention, investigation, detection and prosecution of serious crime 1 .  However, on 8 April 2014, the Court of Justice of the European Union (CJEU) declared the Directive invalid, as it entailed a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, without limiting the access of the competent national authorities to the data retained to what was strictly necessary 2 .  The CJEU also found that the Directive did not provide sufficient safeguards to ensure effective protection of the data against the risk of abuse and against any unlawful access and use of the data 2 . Therefore, the Directive is no longer part of EU law.

 According to Article 13 of the GDPR, when personal data are collected from the data subject, the data controller must provide the data subject with the following information, among others 1 :

The identity and the contact details of the controller and, where applicable, of the controller’s representative;

The contact details of the data protection officer, where applicable;

The purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

The recipients or categories of recipients of the personal data, if any;

Where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

In the scenario, Wonderkids provides some of this information in their Privacy Statement, but not all. They do not specify the categories of recipients with whom they will share the personal data of their customers and their children. They only state that they will share the data with businesses that they see as adding real value to the customers, which is vague and ambiguous. This does not comply with the GDPR requirement to inform the data subjects about the recipients or categories of recipients of their personal data, if any. Therefore, Wonderkids must provide this additional information in their Privacy Statement.

 According to Article 32 of the GDPR, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the pseudonymisation and encryption of personal data. Encryption is a key security measure to protect the confidentiality, integrity and availability of personal data, especially when it is transferred between different entities or locations. Encryption ensures that only authorised parties can access and modify the data, and prevents unauthorised or unlawful access, disclosure, alteration or destruction. Encryption also reduces the risk of data breaches and the potential harm to the data subjects. Therefore, encrypting the transferred data in transit and at rest would be the most important security measure to apply to the health data transmission.  References:

Article 32 of the GDPR

IAPP CIPP/E Study Guide, page 58

Article 8 of the ECHR protects the right to respect for private and family life, home and correspondence. However, this right is not absolute and can be subject to limitations by a public authority in accordance with the law and for a legitimate aim. The European Court of Human Rights (ECtHR) has developed a two-stage test to determine whether such limitations are justified. First, the court must examine whether there is a legitimate aim pursued by the public authority, such as national security, public safety or the prevention of crime.  Second, the court must assess whether the means used by the public authority are appropriate and necessary to achieve that aim, taking into account all rele vant factors such as proportionality, necessity and less restrictive alternatives 1 2 . Therefore, the right to privacy is not an absolute right but a qualified one that has to be balanced against other rights under the ECHR.  References:

Article 8 - Protection of personal data

Your right to respect for private and family life

Right to respect for private and family life

Guide on Article 8 of the European Convention on Human Rights

European Convention on Human Rights - Article 8

According to Article 32 of the GDPR, the controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing personal data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The GDPR also provides some examples of such measures, including the pseudonymisation and encryption of personal data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, and a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

In this scenario, the company is processing personal data of children, such as their voice, questions, preferences, and location, through the connected toys that use a wireless Bluetooth connection to communicate with smartphones, tablets, cloud servers, and other toys. This poses a high risk to the security of the data, as Bluetooth is a short-range wireless technology that can be easily intercepted, hacked, or compromised by malicious actors. Therefore, the company should encrypt the data in transit over the Bluetooth connection, to prevent unauthorized access, disclosure, or alteration of the data. Encryption is a process of transforming data into an unreadable form, using a secret key or algorithm, that can only be reversed by authorized parties who have the corresponding key or algorithm. Encryption can protect the data from being accessed or modified by anyone who does not have the key or algorithm, thus ensuring the confidentiality and integrity of the data.

The other options are incorrect because:

B. Including dual-factor authentication before each use by a child in order to ensure a minimum amount of security is not a sufficient measure to protect the data in transit over the Bluetooth connection. Dual-factor authentication is a process of verifying the identity of a user by requiring two pieces of evidence, such as a password and a code sent to a phone or email. While this may enhance the security of the user’s account or device, it does not protect the data that is transmitted over the wireless connection, which can still be intercepted, hacked, or compromised by malicious actors. Moreover, dual-factor authentication may not be suitable or convenient for children, who may not have access to a phone or email, or who may forget their passwords or codes.

C. Including three-factor authentication before each use by a child in order to ensure the best level of security possible is not a necessary or proportionate measure to protect the data in transit over the Bluetooth connection. Three-factor authentication is a process of verifying the identity of a user by requiring three pieces of evidence, such as a password, a code sent to a phone or email, and a biometric feature, such as a fingerprint or a face scan. While this may provide a high level of security for the user’s account or device, it does not protect the data that is transmitted over the wireless connection, which can still be intercepted, hacked, or compromised by malicious actors. Furthermore, three-factor authentication may not be appropriate or feasible for children, who may not have access to a phone or email, or who may not have reliable biometric features, or who may find the process too complex or cumbersome.

D. Inserting contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union, is not a relevant measure to protect the data in transit over the Bluetooth connection. Contractual clauses are legal agreements that specify the obligations and responsibilities of the parties involved in a data transfer, such as the level of data protection, the rights of data subjects, and the remedies for breaches. While contractual clauses may be necessary to ensure the compliance of the data transfer to South Africa, which is a non-EU country that does not have an adequacy decision from the European Commission, they do not address the security of the data that is transmitted over the wireless connection, which can still be intercepted, hacked, or compromised by malicious actors. Moreover, contractual clauses are not a technical or organisational measure, but a legal measure, that falls under a different provision of the GDPR, namely Article 46.

A multinational company that is appointing a mandatory data protection officer (DPO) must also consult national derogations to evaluate if there are additional cases to be considered in relation to the matter.  According to Article 37 (1) of the GDPR, a DPO must be designated by the controller or the processor in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or © the core activities of the controller or the processor consist of processing on a large scale of special categories of data or personal data relating to criminal convictions and offences  1 .  However, Article 37 (4) of the GDPR also allows Member States to provide for additional cases where a DPO must be designated by law  1 . Therefore, a multinational company must consult the national laws of the EU jurisdictions in which it operates to ensure that it complies with any additional requirements for appointing a DPO.

The other options are not correct because they are not directly related to the appointment of a DPO. Conducting a Data Protection Privacy Assessment, assessing the number of employees, and revising the data processing activities are all good practices for ensuring compliance with the GDPR, but they are not mandatory actions for designating a DPO.  Moreover, the number of employees is not a relevant criterion for appointing a DPO, as the GDPR does not set any threshold based on the size of the organization  2 .  References:   1 : Article 37 of the GDPR  2 :  Guidelines on Data Protection Officers (‘DPOs’)