Assuming that the “without undue delay” provision is followed, what is the time limit for complying with a data access request?

An organization conducts body temperature checks as a part of COVID-19 monitoring. Body temperature is measured manually and is not followed by registration, documentation
or other processing of an individual’s personal data.
Which of the following best explain why this practice would NOT be subject to the GDPR?

Please use the following to answer the next question:
TripBliss Inc. is a travel service company which has lost substantial revenue over the last
few years. Their new manager, Oliver, suspects that this is partly due to the company’s
outdated website. After doing some research, he meets with a sales representative from
the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge
website for TripBliss Inc.’s foundering business.
During negotiations, a Techiva representative describes a plan for gathering more
customer information through detailed Questionaires, which could be used to tailor their
preferences to specific travel destinations. TripBliss Inc. can choose any number of data
categories – age, income, ethnicity – that would help them best accomplish their goals.
Oliver loves this idea, but would also like to have some way of gauging how successful this
approach is, especially since the Questionaires will require customers to provide explicit
consent to having their data collected. The Techiva representative suggests that they also
run a program to analyze the new website’s traffic, in order to get a better understanding of
how customers are using it. He explains his plan
to place a number of cookies on customer devices. The cookies will allow the company to
collect IP addresses and other information, such as the sites from which the customers
came, how much time they spend on the TripBliss Inc. website, and which pages on the
site they visit. All of this information will be compiled in log files, which Techiva will analyze
by means of a special program. TripBliss Inc. would receive aggregate statistics to help
them evaluate the website’s effectiveness. Oliver enthusiastically engages Techiva for
these services.
Techiva assigns the analytics portion of the project to longtime account manager Leon
Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.’s
website, and can authorize access to the log files gathered from it. Unfortunately forTripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction
with Techiva is at a high point. In order to take revenge for what he feels has been unfair
treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for
help. Together they come up with the following plan: Fred will hack into Techiva’s system
and copy their log files onto a USB stick. Despite his initial intention to send the USB to the
press and to the data protection authority in order to denounce Techiva, Leon experiences
a crisis of conscience and ends up reconsidering his plan. He decides instead to securely
wipe all the data from the USB stick and inform his manager that the company’s system of
access control must be reconsidered.
With regard to TripBliss Inc.’s use of website cookies, which of the following statements is
correct?

Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?

Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA
analysis. The company is headquartered in Montreal, and all of its employees are located
there. The company offers its services to Canadians only: Its website is in English and
French, it accepts only Canadian currency, and it blocks internet traffic from outside of
Canada (although this solution doesn’t prevent all non-Canadian traffic). It also declines to
process orders that request the DNA report to be sent outside of Canada, and returns
orders that show a non-Canadian return address.
Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU,
and the company is exploring a number of plans to expand its customer base.
The first plan, collegially called We-Track-U, will use an app to collect information about its
current Canadian customer base. The expansion will allow its Canadian customers to use
the app while traveling abroad. He
suggests that the company use this app to gather location information. If the plan shows
promise, Bob proposes to use push notifications and text messages to encourage existing
customers to pre-register for an EU version of the service. Bob calls this work plan, We-
Text-U. Once the company has gathered enough pre- registrations, it will develop EUspecific
content and services.
Another plan is called Customer for Life. The idea is to offer additional services through the
company’s app, like storage and sharing of DNA information with other applications and
medical providers. The company’s contract says that it can keep customer DNA
indefinitely, and use it to offer new services and market them to customers. It also says that
customers agree not to withdraw direct marketing consent. Paul, the marketing director,
suggests that the company should fully exploit these provisions, and that it can work
around customers’ attempts to withdraw consent because the contract invalidates them.
The final plan is to develop a brand presence in the EU. The company has already begun
this process. It is in the process of purchasing the naming rights for a building in Germany,
which would come with a few offices that Who-R-U executives can use while traveling
internationally. The office doesn’t include any technology or infrastructure; rather, it’s simply
a room with a desk and some chairs.
On a recent trip concerning the naming-rights deal, Bob’s laptop is stolen. The laptop held
unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of
Canada. The reports include customer name, birthdate, ethnicity, racial background,
names of relatives, gender, and occasionally health information.
If Who-R-U adopts the We-Track-U pilot plan, why is it likely to be subject to the territorial
scope of the GDPR?

Under the GDPR, who would be LEAST likely to be allowed to engage in the collection, use, and disclosure of a data subject’s sensitive medical information without the data
subject’s knowledge or consent?

Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with
each other, in order to integrate their marketing efforts. Additionally, they agree on the data
to be stored, how reservations will be booked and confirmed, and who has access to the
stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency
to stay at ABC Hotel Chain’s locations. XYZ Travel Agency offers a rewards program that
allows customers to sign up to accumulate points that can later be redeemed for free travel.
Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He
sends an email requesting access to his data, in order to exercise what he believes are his
data subject rights.
What is the time period in which Mike should receive a response to his request?

Which change was introduced by the 2009 amendments to the e-Privacy Directive
2002/58/EC?