The GDPR establishes a two-tier system of administrative fines for infringements of its provisions, depending on the nature, gravity, and duration of the infringement, as well as other factors such as the intentional or negligent character of the infringement, the actions taken to mitigate the damage, the degree of co-operation with the supervisory authority, and any previous infringements 1 .  The lower tier of fines can be up to 10 million euros or 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher 1 .  The lower tier of fines applies to infringements of the GDPR relating to the following aspects 1 :

The obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39, and 42 and 43;

The obligations of the certification body pursuant to Articles 42 and 43;

The obligations of the monitoring body pursuant to Article 41 (4). The higher tier of fines can be up to 20 million euros or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher 1 .  The higher tier of fines applies to infringements of the GDPR relating to the following aspects 1 :

The basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7, and 9;

The data subjects’ rights pursuant to Articles 12 to 22;

The transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49;

Any obligations pursuant to Member State law adopted under Chapter IX;

Non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58 (2) or failure to provide access in violation of Article 58 (1). Therefore, higher fines are assessed for GDPR violations due to violations of a data subject’s rights, as these are among the infringements that fall under the higher tier of fines.  Data subjects’ rights are the rights granted to individuals whose personal data are processed by controllers or processors, such as the right to access, rectify, erase, restrict, object, or port their data, as well as the right to be informed, to withdraw consent, and to lodge a complaint 1 . Violations of these rights can cause significant harm to the data subjects and undermine the objectives of the GDPR. Therefore, option D is the correct answer.  References:   Art. 83 GDPR – General conditions for imposing administrative fines ,  Article 83 GDPR - GDPRhub

The core data protection principles are codified in Article 5(1) GDPR and detailed in the CIPP/E Textbook (3rd ed.), Chapter 6 “Data Processing Principles” . These principles are the backbone of GDPR compliance and apply to all processing activities.

Purpose limitation (A) : Data must be collected for specified, explicit, and legitimate purposes , and not further processed in a way incompatible with those purposes (Art. 5(1)(b)).

Data minimization (C) : Data must be adequate, relevant, and limited to what is necessary in relation to the purposes (Art. 5(1)(c)).

Storage limitation (E) : Data must not be kept longer than necessary for the purposes; retention periods must be defined (Art. 5(1)(e)).

Integrity and confidentiality (G) : Data must be processed securely, protecting against unauthorized access, accidental loss, destruction, or damage (Art. 5(1)(f)).

By contrast:

Individual participation (B) is an OECD principle , not a GDPR principle.

Access and correction (D) are data subject rights (Arts. 15–16 GDPR), not principles.

Data localization (F) is not part of the GDPR; in fact, GDPR allows international data transfers under Chapter V.

Thus, the correct four core GDPR principles are:

???? A. Purpose limitation, C. Data minimization, E. Storage limitation, G. Integrity and confidentiality.

???? Reference:

GDPR Article 5(1) – Principles relating to processing of personal data

CIPP/E Textbook (3rd ed.), Chapter 6 “Data Processing Principles”

According to the GDPR, personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes 1 .  This means that data controllers must inform data subjects about the purposes of data processing and obtain their consent or another lawful basis for any new or different purposes 2 .

In the scenario, Brady transferred his customers’ personal data to Hermes Designs, a third-party contractor, to fulfill a requested service. However, Hermes Designs used the data for a new purpose that was not disclosed to the customers: creating sample customized banner advertisements and conducting direct marketing. This is a violation of the purpose limitation principle and could expose Brady to legal risks and customer complaints.

Therefore, Brady should be concerned with Hermes Designs’ handling of customer personal data and take appropriate measures to ensure compliance with the GDPR.

I hope this helps. If you have any other questions, please feel free to ask. ????

1 : Article 5(1)(b) of the GDPR  2 : Article 6(4) of the GDPR

 A layered notice is a privacy notice designed to respond to problems with excessively long notices 1 .  A short notice — the top layer — provides a user with the key elements of the privacy notice, such as the identity of the organisation, the purposes of the processing, and the rights of the data subjects 2 .  The full notice — the bottom layer — covers all the intricacies in full, such as the lawful basis, the retention periods, and the recipients of the personal data 2 .  The ICO recommends using a layered approach to deliver privacy information in a concise, transparent, intelligible, and easily accessible way, as required by the UK GDPR 3 .  A layered notice allows data subjects to access the information they need at the appropriate level of detail and helps organisations to comply with the right to be informed 2 3 .  References:   2

According to Article 3(1) of the GDPR 1 , personal data shall be processed in any member state only on the basis of  a decision  taken at  a Union level  that is  binding  for that member state, unless it is derogated from by national law. This means that the GDPR applies to any processing of personal data within the EU, regardless of where the controller or processor is located, as long as it is based on a decision made at a Union level that is binding for that member state.

Therefore, option B would most likely trigger the extraterritorial effect of the GDPR, as it involves personal data of EU citizens being processed by a controller or processor based outside the EU, which may be subject to a decision made at a Union level that is binding for that member state.

Option A would not trigger the extraterritorial effect of the GDPR, as it involves monitoring suspected terrorists, which is not considered processing under Article 4(1) and (2) of the GDPR 1 . Monitoring may fall under other legal frameworks, such as national security or counter-terrorism laws.

Option C would not trigger the extraterritorial effect of the GDPR, as it involves monitoring EU citizens outside the EU by non-EU law enforcement bodies, which may not be subject to any decision made at a Union level that is binding for that member state.

Option D would not trigger the extraterritorial effect of the GDPR, as it involves processing personal data of EU residents by a non-EU business that targets EU customers, which may not be subject to any decision made at a Union level that is binding for that member state.

According to Article 13 of the GDPR, when a controller obtains personal data directly from the data subject, the controller must provide the data subject with certain information about the processing of their data, such as the identity and contact details of the controller, the purposes and legal basis of the processing, the recipients or categories of recipients, the period of storage, the rights of the data subject, the right to lodge a complaint, etc. However, the controller does not have to provide the data subject with the categories of personal data concerned, as this information is already known by the data subject, since they provided the data themselves. This is different from Article 14, which applies when the controller obtains personal data from a source other than the data subject, and requires the controller to inform the data subject of the categories of personal data concerned, as well as the source of the data.  References:

Art. 13 GDPR - Information to be provided where personal data are collected from the data subject

Art. 14 GDPR - Information to be provided where personal data have not been obtained from the data subject

Article 13: Information to be provided where personal data are collected from the data subject - GDPR

The right to data portability only applies when the processing is based on the data subject’s consent or on a contract with the data subject 1 2 .  Therefore, if the processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller, the right to data portability does not apply 1 2 .  This is because the data subject does not have a direct influence on the purpose or the means of the processing in such cases 3 .  References:   1 : Article 20 of the GDPR  2 : Right to data portability | ICO  3 : The right to data portability (Article 20 of the GDPR)

According to the ePrivacy Directive, which regulates direct electronic marketing in the EU, consent is generally required before sending marketing emails or texts.  However, there is an exception known as the ‘soft opt-in’, which allows marketing emails or texts to be sent on an opt-out basis if the recipient’s details were collected “in the context of the sale of a product or a service” and the marketing is for “similar products or services” provided by the same organisation 1 2 . Therefore, WonderKids can send direct marketing information by email without prior consent of the person booking the childcare, as long as the information is about similar products or services to those purchased from WonderKids, and the person is given a clear and easy way to opt out of receiving such emails. The other options are not allowed under the ePrivacy Directive, unless the person has given explicit consent to receive them.  References:

Free CIPP/E Study Guide , page 33, section 4.1.3

CIPP/E Certification , page 28, section 4.1.3

Cipp-e Study guides, Class notes & Summaries , page 39, section 4.1.3

Direct marketing rules and exceptions under the GDPR , paragraph 5

Marketing | ICO , section “What does the ‘soft opt-in’ mean?”