Certified Information Privacy Professional – Europe (CIPP/E) — Question 182

Article 9 of the GDPR lists exceptions to the general prohibition against processing biometric data. Which of the following is NOT one of these exceptions?

Answer options

• A. The processing is done by a non-profit organization and the results are disclosed outside the organization.
• B. The processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.
• C. The processing is necessary for the establishment, exercise or defense of legal claims when courts are acting in a judicial capacity.
• D. The processing is explicitly consented to by the data subject and he or she is allowed by Union or Member State law to lift the prohibition.

Correct answer: A

Explanation

Option A is the correct answer because processing by a non-profit organization that discloses results outside the organization does not qualify as an exception under GDPR. Options B, C, and D are valid exceptions as they relate to protecting vital interests, legal claims, and explicit consent, respectively.