GDPR practice question 4 of 15

Bus Spot is one of the largest bus operators in Spain. The company operates in local transport and bus rental since 2009. The success of Bus Spot can…

Bus Spot is one of the largest bus operators in Spain. The company operates in local transport and bus rental since 2009. The success of Bus Spot can be attributed to the digitization of the bus ticketing system, through which clients can easily book tickets and stay up to date on any changes to their arrival or departure time. In recent years, due to the large number of passengers transported daily. Bus Spot has dealt with different incidents including vandalism, assaults on staff, and fraudulent injury claims. Considering the severity of these incidents, the need for having strong security measures had become crucial. Last month, the company decided to install a CCTV system across its network of buses. This security measure was taken to monitor the behavior of the company's employees and passengers, enabling crime prevention and ensuring safety and security. Following this decision, Bus Spot initiated a data protection impact assessment (DPIA). The outcome of each step of the DPIA was documented as follows: Step 1: In all 150 buses, two CCTV cameras will be installed. Only individuals authorized by Bus Spot will have access to the information generated by the CCTV system. CCTV cameras capture images only when the Bus Spot's buses are being used. The CCTV cameras will record images and sound. The information is transmitted to a video recorder and stored for 20 days. In case of incidents, CCTV recordings may be stored for more than 40 days and disclosed to a law enforcement body. Data collected through the CCTV system will be processed bv another organization. The purpose of processing this tvoe of information is to increase the security and safety of individuals and prevent criminal activity. Step 2: All employees of Bus Spot were informed for the installation of a CCTV system. As the data controller, Bus Spot will have the ultimate responsibility to conduct the DPI

Answer options

A: Appointing a DPO at that point was deemed unnecessary. However, the data processor’s suggestions regarding the CCTV installation were taken into account. Step 3: Risk Likelihood (Unlikely, Possible, Likely) Severity (Moderate, Severe, Critical) Overall risk (Low, Medium, High) There is a risk that the principle of lawfulness, fairness, and transparency will be compromised since individuals might not be aware of the CCTV location and its field of view. Likely Moderate Low There is a risk that the principle of integrity and confidentiality may be compromised in case the CCTV system is not monitored and controlled with adequate security measures. Possible Severe Medium There is a risk related to the right of individuals to be informed regarding the installation of CCTV cameras. Possible Moderate Low Step 4: Bus Spot will provide appropriate training to individuals that have access to the information generated by the CCTV system. In addition, it will ensure that the employees of the data processor are trained as well. In each entrance of the bus, a sign for the use of CCTV will be displayed. The sign will be visible and readable by all passengers. It will show other details such as the purpose of its use, the identity of Bus Spot, and its contact number in case there are any queries. Only two employees of Bus Spot will be authorized to access the CCTV system. They will continuously monitor it and report any unusual behavior of bus drivers or passengers to Bus Spot. The requests of individuals that are subject to a criminal activity for accessing the CCTV images will be evaluated only for a limited period of time. If the access is allowed, the CCTV images will be exported by the CCTV system to an appropriate file format. Bus Spot will use a file encryption software to encrypt data before transferring onto another file format. Step 5: Bus Spot's top management has evaluated the DPIA results for the processing of data through CCTV system. The actions suggested to address the identified risks have been approved and will be implemented based on best practices. This DPIA involves the analysis of the risks and impacts in only a group of buses located in the capital of Spain. Therefore, the DPIA will be reconducted for each of Bus Spot's buses in Spain before installing the CCTV system. Based on this scenario, answer the following Questio n: Questio n: Is a DPIA necessary for Bus Spot? Correct answer

B: Yes, because the installation of a CCTV system in Bus Spot’s buses involves systematic monitoring of a large number of individuals.

C: Yes, because the installation of a CCTV system in Bus Spot’s buses involves a systematic and extensive evaluation of personal aspects relating to natural persons based on automated processing.

D: No, because the installation of a CCTV system in Bus Spot’s buses does not involve processing of data that is likely to result in a high risk to the rights and freedoms of data subjects.

E: No, because CCTV cameras used for security reasons are automatically exempt from GDPR requirements.

Correct Answer:

A. Appointing a DPO at that point was deemed unnecessary. However, the data processor’s suggestions regarding the CCTV installation were taken into account. Step 3: Risk Likelihood (Unlikely, Possible, Likely) Severity (Moderate, Severe, Critical) Overall risk (Low, Medium, High) There is a risk that the principle of lawfulness, fairness, and transparency will be compromised since individuals might not be aware of the CCTV location and its field of view. Likely Moderate Low There is a risk that the principle of integrity and confidentiality may be compromised in case the CCTV system is not monitored and controlled with adequate security measures. Possible Severe Medium There is a risk related to the right of individuals to be informed regarding the installation of CCTV cameras. Possible Moderate Low Step 4: Bus Spot will provide appropriate training to individuals that have access to the information generated by the CCTV system. In addition, it will ensure that the employees of the data processor are trained as well. In each entrance of the bus, a sign for the use of CCTV will be displayed. The sign will be visible and readable by all passengers. It will show other details such as the purpose of its use, the identity of Bus Spot, and its contact number in case there are any queries. Only two employees of Bus Spot will be authorized to access the CCTV system. They will continuously monitor it and report any unusual behavior of bus drivers or passengers to Bus Spot. The requests of individuals that are subject to a criminal activity for accessing the CCTV images will be evaluated only for a limited period of time. If the access is allowed, the CCTV images will be exported by the CCTV system to an appropriate file format. Bus Spot will use a file encryption software to encrypt data before transferring onto another file format. Step 5: Bus Spot's top management has evaluated the DPIA results for the processing of data through CCTV system. The actions suggested to address the identified risks have been approved and will be implemented based on best practices. This DPIA involves the analysis of the risks and impacts in only a group of buses located in the capital of Spain. Therefore, the DPIA will be reconducted for each of Bus Spot's buses in Spain before installing the CCTV system. Based on this scenario, answer the following Questio n: Questio n: Is a DPIA necessary for Bus Spot?

Explanation

A Data Protection Impact Assessment (DPIA) is mandatory under GDPR Article 35 when processing is "likely to result in a high risk to the rights and freedoms of natural persons." The installation of a CCTV system across a network of 150 buses to continuously monitor a large number of passengers and employees falls directly under the criteria specified in Article 35(3)(c): "a systematic monitoring of a publicly accessible area on a large scale." A bus network is considered a publicly accessible area in this context, and the scale of the operation (150 buses, large passenger numbers) necessitates a DPIA to assess and mitigate the inherent risks to privacy.

Why Incorrect

B. This is incorrect because the primary trigger for the DPIA is the large-scale systematic monitoring itself, not necessarily an automated evaluation of personal aspects for decision-making (like profiling), which is a different criterion under Article 35(3)(a).
C. This is incorrect. The systematic, large-scale surveillance of individuals, including the recording of images and sound, is explicitly considered a type of processing that is likely to result in a high risk to individuals' rights and freedoms.
D. This is incorrect. There is no automatic exemption from GDPR requirements for CCTV systems used for security. The purpose of processing is relevant for establishing a legal basis but does not remove the obligation to comply with the regulation, including conducting a DPIA when thresholds are met.

References

1. General Data Protection Regulation (EU) 2016/679, Article 35, "Data protection impact assessment."

Section 1: States that a DPIA is required for processing likely to result in a high risk.

Section 3(c): Explicitly mandates a DPIA for "a systematic monitoring of a publicly accessible area on a large scale." This directly applies to the Bus Spot scenario.

2. Article 29 Data Protection Working Party (endorsed by the European Data Protection Board), "Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk' for the purposes of Regulation 2016/679," WP 248 rev.01, 4 October 2017.

Page 10, Section IV.A, Criterion 7 "Systematic monitoring": This criterion is listed as a key factor in determining if a DPIA is needed. The document clarifies that "systematic monitoring of a publicly accessible area" is an example of processing that requires a DPIA. The Bus Spot case is a clear example of this.

3. Information Commissioner's Office (ICO), "Data protection impact assessments." (The ICO is the UK's supervisory authority, and its guidance is highly respected and aligned with EDPB principles).

Section "When do we need to do a DPIA?": The ICO provides a list of processing operations that require a DPIA. This list includes "using technology to systematically monitor people in a public place on a large scale, for example CCTV." This directly supports the reasoning for the correct answer.

Keep practicing

Take the free GDPR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test