A private company has establishments in France, Poland, the United Kingdom, and most
prominently, Germany, where its headquarters is established. The company offers its services
worldwide. Most of the services are designed in Germany and supported in the other
establishments. However, one of the services, a Software as a Service (SaaS) application, was defined
and implemented by the Polish establishment. It is also supported by the other establishments.
What is the lead supervisory authority for the SaaS service?
Correct Answer: C
Explanation:
Under the GDPR, the lead supervisory authority is determined by where the main establishment
related to the processing activity is located.
In this case, even though the company's headquarters is in Germany, the SaaS application was
specifically defined and implemented by the Polish establishment. This indicates that the Polish
establishment hasthe primary role in determining the purposes and means of processing personal
data related to that SaaS service. Therefore, the supervisory authority of Poland would be the lead
supervisory authority for this specific processing activity.
Reference:
GDPR Article 56 - Competence of the lead supervisory authority
IAPP CIPP/E textbook, Chapter 3: EU General Data Protection Regulation (specifically, sections on
One-Stop Shop mechanism and lead supervisory authority)
Question 2
Which statement is correct when considering the right to privacy under Article 8 of the European
Convention on Human Rights (ECHR)?
Correct Answer: B
Explanation:
Article 8 of the ECHR protects the right to respect for private and family life, home and
correspondence. However, this right is not absolute and can be subject to limitations by a public
authority in accordance with the law and for a legitimate aim. The European Court of Human Rights
(ECtHR) has developed a two-stage test to determine whethersuch limitations are justified. First, the
court must examine whether there is a legitimate aim pursued by the public authority, such as
national security, public safety or the prevention of crime. Second, the court must assess whether
the means used by the public authority are appropriate and necessary to achieve that aim, taking
into account all relevant factors such as proportionality, necessity and less restrictive alternatives12.
Therefore, the right to privacy is not an absolute right but a qualified one that has to be balanced
against other rights under the ECHR. Reference:
Article 8 - Protection of personal data
Your right to respect for private and family life
Right to respect for private and family life
Guide on Article 8 of the European Convention on Human Rights
European Convention on Human Rights - Article 8
Demo Practice Mode
You are viewing only the questions marked as Demo.