Certified Information Privacy Professional – Europe (CIPP/E) — Question 99

An organization conducts body temperature checks as a part of COVID-19 monitoring. Body temperature is measured manually and is not followed by registration, documentation or other processing of an individual’s personal data.
Which of the following best explain why this practice would NOT be subject to the GDPR?

Answer options

• A. Body temperature is not considered personal data.
• B. The practice does not involve completion by automated means.
• C. Body temperature is considered pseudonymous data.
• D. The practice is for the purpose of alleviating extreme risks to public health.

Correct answer: B

Explanation

The correct answer is B because the GDPR primarily applies to data processing that involves automated means. Since the body temperature checks are conducted manually and do not involve any automated processing, they fall outside the scope of the GDPR. Options A, C, and D do not accurately address the reason for the exemption from GDPR applicability.