Certified Information Privacy Professional – Europe (CIPP/E) — Question 97

Article 5(1)(b) of the GDPR states that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.” Based on Article 5(1)(b), what is the impact of a member state’s interpretation of the word “incompatible”?

Answer options

• A. It dictates the level of security a processor must follow when using and storing personal data for two different purposes.
• B. It guides the courts on the severity of the consequences for those who are convicted of the intentional misuse of personal data.
• C. It sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data.
• D. It indicates the degree of flexibility a controller has in using personal data in ways that may vary from its original intended purpose.

Correct answer: D

Explanation

The correct answer is D because it pertains to how much leeway a controller has when processing personal data beyond its initial purpose, which is directly related to the interpretation of 'incompatible.' The other options do not accurately reflect the impact of the interpretation on data processing practices.