Certified Information Privacy Professional – Europe (CIPP/E) — Question 50

A company in France suffers a robbery over the weekend owing to a faulty alarm system. When it is determined that the break-in involves the loss of a substantial amount of data, the company decides on a CCTV system to monitor for future incidents. Company technicians install cameras in the entrance of the building, hallways and offices. Footage is recorded continuously, and is monitored by the home office in the United States. What is the most realistic step the company could take to address their security concerns and comply with the personal data processing principles set out in Article 5 of the GDPR?

Answer options

• A. Seek informed consent from company employees.
• B. Have cameras recording during work hours only.
• C. Retain captured footage for no more than 30 days.
• D. Restrict camera placement to building entrances only.

Correct answer: D

Explanation

The correct answer is D because restricting camera placement to entrances minimizes the amount of personal data collected, aligning with GDPR's principle of data minimization. Options A and B do not adequately address the broader implications of data collection, while option C, while relevant, does not limit the scope of data collection as effectively as option D.