Certified Information Privacy Professional – Europe (CIPP/E) — Question 15

A Spanish electricity customer calls her local supplier with questions about the company’s upcoming merger. Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?

Answer options

• A. Verify that the request is applicable to the data collected before the GDPR entered into force.
• B. Verify that the purpose of the request from the customer is in line with the GDPR.
• C. Verify that the personal data has not already been sent to the customer.
• D. Verify that the identity of the customer can be proven by other means.

Correct answer: D

Explanation

The correct answer is D because GDPR mandates that the identity of individuals must be verified before sharing personal data to protect privacy. Options A, B, and C are incorrect as they do not address the essential requirement of confirming the customer's identity prior to disclosing personal information.