According to the European Data Protection Board, which of the following concepts or practices does NOT follow from the principles relating to the…

According to the European Data Protection Board, the principles relating to the processing of

personal data under EU data protection law are: lawfulness, fairness and transparency; purpose

limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and

accountability1. These principles imply certain concepts or practices that data controllers and

processors should follow, such as access control management, frequent pseudonymization key

rotation, and error propagation avoidance along the processing chain2. However, data ownership

allocation is not a concept or practice that follows from these principles, as the GDPR does not

recognize the notion of data ownership by either the data subject or the data controller3. Therefore,

option A is the correct answer. Reference:

Data protection basics

Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of

the provision of online services to data subjects

CIPP/E Study Guide, page 11