Certified Information Privacy Professional – Europe (CIPP/E) — Question 62

When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?

Answer options

• A. When the data has been pseudonymized.
• B. When the data is protected by technological safeguards.
• C. When the data serves legitimate interest of third parties.
• D. When the data subject has failed to use a provided opt-out mechanism.

Correct answer: A

Explanation

The correct answer is A because the GDPR permits the processing of pseudonymized data for purposes that extend beyond the original collection intent, as long as it meets certain criteria. Options B, C, and D do not align with GDPR provisions that expand processing latitude; they focus on data protection, legitimate interest, and opt-out mechanisms, respectively, which do not inherently provide more flexibility in processing.