Certified Information Privacy Professional – Europe (CIPP/E) — Question 16

Under the GDPR, where personal data is not obtained directly from the data subject, a controller is exempt from directly providing information about processing to the data subject if?

Answer options

• A. The data subject already has information regarding how his data will be used
• B. The provision of such information to the data subject would be too problematic
• C. Third-party data would be disclosed by providing such information to the data subject
• D. The processing of the data subject’s data is protected by appropriate technical measures

Correct answer: A

Explanation

The correct answer is A because if the data subject is already aware of how their data will be utilized, the controller is not obligated to provide additional information. Options B, C, and D do not align with the GDPR requirements, as they do not justify the exemption from informing the data subject about the processing of their data.