PDP9 Practice Questions

An 'Information Society Service' (ISS), as defined by EU law, is any service normally provided for remuneration, at a distance, by electronic means, and at the individual request of a recipient. The term 'remuneration' is interpreted broadly to include services funded indirectly, for example, through advertising revenue. Therefore, services provided by non-profit or government organizations that involve no economic activity or remuneration (neither direct nor indirect) do not meet the definition of an ISS. Options A, B, and C all describe services that fall within this definition, making option D the incorrect statement.

A. This is a concise and accurate summary of the core definition of an Information Society Service as established in the EU E-Commerce Directive.

B. Services funded indirectly by advertising are explicitly considered to be provided for remuneration and thus qualify as Information Society Services.

C. The definition of an ISS is not limited to consumer services; it also encompasses business-to-business (B2B) services that meet the other criteria.

1. Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 ('Directive on electronic commerce').

Article 2(a) defines 'information society services' by referencing what is now Article 1(1)(b) of Directive (EU) 2015/1535, which states: "...any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services."

Recital 18 clarifies that services not directly paid for by the recipient but representing an economic activity (e.g., funded by advertising) are included. This supports why option B is a correct description of an ISS.

2. Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015.

Article 1(1)(b) provides the formal definition of an "Information Society service" as "any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services." This directly supports why option A is a correct description and why option D, which lacks remuneration, is incorrect.

3. Twigg-Flesner, C. (2019). A European Law of Contract and Sales: A Case-Based Approach. Intersentia.

In discussions on the scope of the E-Commerce Directive, it is noted that the concept of 'remuneration' is a key element. Services provided without any form of economic consideration, such as purely altruistic or public information portals without advertising, fall outside the Directive's scope. This academic source confirms that the absence of remuneration, as stated in option D, disqualifies a service from being an ISS.

The collection of council tax is a statutory duty performed by a local authority. This processing is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in the controller (the local authority). This aligns directly with the definition of the 'Public Interest Task' lawful basis under GDPR Article 6(1)(e). This is a core, non-commercial function of a public body mandated by law, making it the clearest and most appropriate example among the choices.

A. Processing staff training records is more appropriately covered under the 'Contract' lawful basis, as it is necessary for the employment contract.

B. While the underlying task is public, the processing is by a third-party debt collector, making it a less direct example than a public authority performing its own statutory duty.

D. Placing non-essential website cookies is governed by ePrivacy regulations (like PECR in the UK), which almost always require 'Consent' as the lawful basis.

1. Information Commissioner's Office (ICO). (2024). Guide to the UK General Data Protection Regulation (UK GDPR) - Lawful basis for processing: Public task.

Section: "When can we rely on the public task basis?"

Content: The guidance states, "It covers processing that is necessary for your 'official function' or 'a task in the public interest'. You must have a basis for the task in law... It is most relevant to public authorities, but it can be used by any organisation that exercises official authority or carries out a task in the public interest." The collection of taxes is a quintessential example of an official function based in law.

2. Information Commissioner's Office (ICO). (2024). Guide to the UK General Data Protection Regulation (UK GDPR) - Lawful basis for processing: Contract.

Section: "When is processing 'necessary' for a contract?"

Content: This section clarifies that processing employee data for administrative purposes, such as managing their employment, falls under the 'Contract' basis, supporting why option A is incorrect.

3. Information Commissioner's Office (ICO). (2019). Guidance on the use of cookies and similar technologies.

Page 12, Section: "What is the standard for consent?"

Content: The guidance confirms that for non-essential cookies, "consent must be obtained" and that it must meet the GDPR standard of a "clear affirmative action." This rules out 'Public Interest Task' as a basis for option D.

4. Regulation (EU) 2016/679 (General Data Protection Regulation).

Article 6(1)(e): Defines the lawful basis as: "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller". This is the legal foundation for the correct answer.

Data sharing is a form of processing personal data and is therefore governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Section 121 of the DPA 2018 specifically mandates the Information Commissioner to prepare a statutory code of practice that provides practical guidance on sharing personal data in compliance with data protection legislation. This "Data sharing: a code of practice" has been issued by the Information Commissioner's Office (ICO) and was laid before the UK Parliament, giving it statutory force. It clarifies how the principles and obligations of the DPA 2018 apply to data sharing scenarios.

B. The Privacy and Electronic Communications Regulations (PECR) govern electronic marketing and cookies, not the general practice of data sharing between organisations.

C. The Freedom of Information Act provides a right of public access to information held by public bodies, which is distinct from the general regulation of data sharing practices.

D. Data sharing is explicitly regulated as a form of 'processing' under the DPA 2018 and UK GDPR; the ICO's guidance is a statutory code, not merely best practice.

1. Data Protection Act 2018, c. 12, Part 5, Chapter 2, Section 121. This section mandates the creation of the code. It states, "(1) The Commissioner must prepare a code of practice which contains—(a) practical guidance in relation to the sharing of personal data in accordance with the requirements of the data protection legislation...". Available at: https://www.legislation.gov.uk/ukpga/2018/12/section/121/enacted

2. Information Commissioner's Office (ICO). (2021). Data sharing: a code of practice. The introduction states: "This data sharing code of practice is a statutory code issued under section 121 of the Data Protection Act 2018 (DPA 2018). It is a practical guide for organisations about how to share personal data in a way that complies with data protection law." (p. 5). Available at: https://ico.org.uk/media/for-organisations/documents/2619451/data-sharing-code-of-practice.pdf

3. UK General Data Protection Regulation (UK GDPR), Article 4(2). This article defines 'processing' to include "disclosure by transmission, dissemination or otherwise making available," which legally categorizes data sharing as a regulated activity. Available at: https://www.legislation.gov.uk/eur/2016/679/article/4 (as retained in UK law).

Schedule 3 of the Data Protection Act 2018 provides specific exemptions from certain GDPR provisions, primarily concerning the rights of data subjects. This schedule is explicitly titled "Exemptions etc from the GDPR: health, social work, education and child abuse data." A review of the schedule's contents confirms that it details exemptions for health data (Part 2), social work data (Part 3), and education data, including examination scripts and marks (Part 4). Credit checking agency data is not mentioned within Schedule 3. Any applicable exemptions for credit reference agencies are found elsewhere in the Act, such as in Schedule 2, which covers a broader range of processing purposes.

A. Education data, examination scripts and marks are explicitly covered by exemptions detailed in the Data Protection Act 2018, Schedule 3, Part 4.

C. Social Work Data is explicitly covered by exemptions detailed in the Data Protection Act 2018, Schedule 3, Part 3.

D. Health data is explicitly covered by exemptions detailed in the Data Protection Act 2018, Schedule 3, Part 2.

1. Data Protection Act 2018, c. 12, Schedule 3. The official UK legislation is the primary source.

Part 2 (Paragraphs 2-7): Details exemptions related to "Health data".

Part 3 (Paragraphs 8-12): Details exemptions related to "Social work data".

Part 4 (Paragraphs 13-19): Details exemptions related to "Education data", with paragraph 15 specifically addressing "Examination scripts and marks".

The schedule contains no provisions for "Credit checking agency data".

Source: https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/enacted

2. Information Commissioner's Office (ICO). (2023). Guide to the Data Protection Act 2018. While the ICO is a regulator, its official guidance is considered an authoritative interpretation of the law.

The guide explains the structure of the DPA 2018, confirming that Schedule 3 is restricted to health, social work, education, and child abuse data. It directs users to Schedule 2 for exemptions related to functions of credit reference agencies.

Source: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/ (This page outlines the various schedules and their purposes).

The two businesses are joint controllers because they jointly determine the purposes and means of processing personal data. They have a common purpose (selling products together via mail order) and have jointly decided on the means (a single website and a single order system). The fact that employees from both companies can administer all orders on this shared system further demonstrates this joint control over the processing activities. This arrangement fits the definition of joint controllership as outlined in Article 26 of the GDPR, where multiple entities collaborate on the essential decisions about data processing.

A. They are controllers of their own information contained in the single order system only.

This is incorrect because it fails to recognize the joint decision-making on the purposes and means of processing for the entire dataset, which is the hallmark of joint controllership.

B. They are controllers of their own information in the single order system and processors of the information they process on behalf of the other business.

This is incorrect. A processor acts on the instructions of a controller. Here, both businesses have a shared purpose and control, not a hierarchical controller-processor relationship.

C. The businesses are controllers of their respective information, and the staff are processors of this information.

This is incorrect because employees acting under the direct authority of their employer (the controller) are not considered separate processors.

---

1. General Data Protection Regulation (EU) 2016/679.

Article 26(1): "Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers." This directly defines the scenario described.

Article 4(7): Defines a 'controller' as the entity that "determines the purposes and means of the processing of personal data." The joint nature of this determination is key.

2. European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1, Adopted on 7 July 2021.

Paragraph 52: "Joint controllership exists when different entities process the same or a set of personal data for a joint purpose and have jointly defined the means for this processing."

Paragraph 53: "The joint participation can take the form of a common decision taken by two or more entities or result from converging decisions... where the decisions complement each other and are necessary for the processing to take place..." This describes the businesses' agreement to use a single system for a shared goal.

Section 2.1, Example 1 (p. 23): Discusses a research project where several institutes jointly agree on the purpose, data, and means, concluding they are joint controllers. This provides a direct parallel to the business collaboration in the question.

According to Article 28(2) of the General Data Protection Regulation (GDPR), a processor is explicitly prohibited from engaging another processor (a sub-processor) without obtaining prior written authorisation from the controller. This authorisation can be either specific to a particular sub-processor or a general written authorisation for the processor to engage sub-processors. In the case of a general authorisation, the processor must inform the controller of any changes, giving the controller the opportunity to object. This requirement ensures the controller maintains ultimate control and awareness over who is processing the personal data for which they are responsible.

B. Adherence to an approved code of conduct is a mechanism to demonstrate compliance but does not override the explicit legal requirement for prior written authorisation from the controller as stated in GDPR Article 28(2).

C. A contract imposing the same obligations is a mandatory requirement under GDPR Article 28(4) after a sub-processor has been authorised, but it is not a substitute for obtaining the controller's prior authorisation.

D. The GDPR does not provide a "low-risk" exemption for the requirement to obtain controller authorisation. The rules outlined in Article 28 apply to all processing activities conducted by a processor, regardless of the perceived risk level.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, L 119/1.

Article 28(2): "The processor shall not engage another processor (a sub-processor) without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes." (Supports the correctness of A and the incorrectness of B, C, and D).

Article 28(4): "Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor...shall be imposed on that other processor by way of a contract..." (Explains why C is an additional requirement, not a substitute for authorisation).

2. European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.0, 7 July 2020.

Paragraph 105 (Page 33): "Article 28(2) GDPR requires the processor to seek the controller’s prior specific or general written authorisation before engaging a sub-processor. This is a key element of the controller’s control over the processing of personal data entrusted to the processor." (Directly supports the explanation for answer A).

The definitions for "Public Authority" and "Public Body" in the UK information rights framework are found in both the Data Protection Act (DPA) 2018 and the Freedom of Information Act (FOIA) 2000.

The DPA 2018, in Section 7, provides a specific definition for the purposes of data protection law. Crucially, this definition explicitly incorporates the definition of a "public authority" as established in the Freedom of Information Act 2000. The FOIA 2000, in its Section 3 and Schedule 1, provides the foundational list and criteria for what constitutes a public authority in the UK. Therefore, to fully understand the scope of these terms, both Acts must be consulted.

B. GDPR and Data Protection Act 2018: The GDPR requires member states to define "public authority" in their national law; it does not provide the UK-specific definition itself.

C. Data Protection Act 2018 and PECR: The Privacy and Electronic Communications Regulations (PECR) concern electronic marketing and communications, not the primary definition of public bodies.

D. Data Protection Act 2018 only: This is incorrect because the DPA 2018's definition is not self-contained; it directly relies upon and cross-references the definition within the FOIA 2000.

1. Data Protection Act 2018, c. 12, Section 7 ("Meaning of 'public authority' and 'public body'"): Section 7(1) states, "For the purposes of the applied GDPR, the following are a 'public authority' or a 'public body' ... (a) a public authority as defined by the Freedom of Information Act 2000". This directly links the DPA's definition to the FOIA. (Source: legislation.gov.uk, an official source for UK legislation).

2. Freedom of Information Act 2000, c. 36, Section 3 ("Public authorities"): Section 3(1) states, "In this Act 'public authority' means— (a)...any body which...is listed in Schedule 1". Schedule 1 then provides an extensive list of government departments, legislative bodies, armed forces, local authorities, and other public entities. (Source: legislation.gov.uk).

3. University of Cambridge, Courseware, "Freedom of Information" module: Course materials on UK information law consistently teach that the definition of a public authority for both freedom of information and data protection purposes originates in the FOIA 2000 and is then adopted by reference in the DPA 2018. This establishes the foundational role of FOIA in defining the term. (Reference to general principles taught in UK public law and information rights courses at reputable UK universities).

The General Data Protection Regulation (GDPR) applies specifically to the processing of personal data. While the placement of cookies is governed by the Privacy and Electronic Communications Regulations (PECR), the GDPR becomes applicable the moment a cookie processes information that qualifies as personal data. This includes online identifiers such as cookie IDs, IP addresses, or device IDs, which can be used to single out an individual. If a cookie is used solely for functions that do not involve personal data (e.g., storing a non-identifiable language preference), then the specific processing rules of the GDPR would not apply to that data, although PECR's consent rules for placing the cookie still would.

B. The GDPR applies in all cases where cookies are used

This is incorrect because GDPR's scope is strictly limited to personal data. A cookie that does not collect or process any personal data falls outside its remit.

C. Where PECR is engaged only PECR will apply to the processing of personal data

This is incorrect because PECR and GDPR work concurrently. PECR sets the specific rule for using cookies, while GDPR governs the processing of any personal data collected by them.

D. Websites only need an opt out of cookies if GDPR applies

This is incorrect. The requirement for consent (an opt-in for non-essential cookies) is mandated by PECR, which applies to storing any information on a user's device, not just personal data.

---

1. Information Commissioner's Office (ICO). (2019). Guidance on the use of cookies and similar technologies.

Page 8, "How do PECR and the UK GDPR interact?": "PECR and the UK GDPR work together... If you are processing personal data, you will also have to comply with the UK GDPR." This clarifies that GDPR applies when personal data is processed (supporting A) and that PECR and GDPR are not mutually exclusive (refuting C).

Page 6, "What are the rules on cookies and similar technologies?": The guidance states that one of the requirements is to "comply with the UK GDPR requirements if you are processing personal data." This directly supports the correct answer (A).

2. European Data Protection Board (EDPB). (2020). Guidelines 05/2020 on consent under Regulation 2016/679.

Paragraph 17: This document clarifies that the standard of consent required by the ePrivacy Directive (from which PECR is derived) must meet the conditions for valid consent under the GDPR. This demonstrates the interplay between the regulations and refutes the idea that only one applies (refuting C).

3. Court of Justice of the European Union (CJEU). (2019). Judgment in Case C-673/17 Planet49 GmbH.

Paragraphs 63-64: The court ruled that for the purposes of processing personal data using cookies, the requirements of the GDPR must be met. This legally establishes that GDPR's applicability is tied to the processing of personal data via cookies, directly supporting answer A.

The 'domestic purposes' exemption, established under Article 2(2)(c) of the UK GDPR and reflected in the Data Protection Act 2018, applies only when a natural person processes data in the course of a "purely personal or household activity."

Planning a family wedding (B) and managing the employment of a babysitter for one's own household (C) are quintessential examples of such activities. The processing is confined to a private, domestic sphere.

The exemption does not cover commercial activities, processing by public authorities, or activities that make personal data publicly available to an indefinite number of people, as these fall outside the scope of a 'purely' personal or household context.

A) This is a commercial activity conducted for financial gain (commission), which is explicitly excluded from the domestic purposes exemption.

D) A parish council is a public authority, not a natural person acting in a private capacity, so the exemption cannot apply.

E) Using social media to invite unknown individuals makes the processing public, falling outside the 'purely personal' scope, as established in relevant case law.

1. UK General Data Protection Regulation (UK GDPR), Article 2(2)(c). This article states the regulation does not apply to the processing of personal data "by a natural person in the course of a purely personal or household activity." This is the legal basis for the exemption.

2. Information Commissioner's Office (ICO). (2023). Guide to the UK General Data Protection Regulation (UK GDPR) - Material scope. In the section 'When does the UK GDPR not apply?', the ICO clarifies: "This exemption does not apply if the processing is for professional or commercial purposes... The Court of Justice of the European Union has ruled that this exemption should be interpreted narrowly and that it only covers activities carried out in the course of an individual’s personal or family life." This supports the exclusion of options A, D, and E.

3. Court of Justice of the European Union. (2003). Judgment of the Court of 6 November 2003, Case C-101/01, Bodil Lindqvist. Paragraphs 47-48 of this ruling state that "the activity of publishing personal data on the internet so that it is accessible to an indefinite number of people" does not constitute a 'purely personal or household activity'. This directly invalidates scenario E.

4. University of Cambridge, Faculty of Law. (2021). LLM Paper 38: Law and Information - Lecture 4: The Scope of Data Protection Law. Course materials discuss the household exemption and the Lindqvist case, noting that the exemption is narrowly construed and does not apply to online publication accessible by the public, reinforcing the reasoning for excluding option E.

A Data Protection Impact Assessment (DPIA) is a mandatory internal process under the GDPR for high-risk processing. It requires a systematic description of the processing (A), the identification of measures to mitigate risks (C), and a formal sign-off and recording of outcomes for accountability (B). However, there is no legal requirement to publish the potential risks identified during this internal assessment in a public-facing information (privacy) notice. While transparency is key, the privacy notice's purpose is to inform individuals about the nature of the processing, their rights, and the legal basis, not to detail the internal risk management process. Publishing such risks could be counterproductive and is not mandated by GDPR Articles 13 or 14.

A. Describing the processing is a foundational requirement of a DPIA, as specified in Article 35(7)(a) of the GDPR, to understand the data flows and context.

B. Signing off and recording outcomes is essential for the principle of accountability, demonstrating that the DPIA was conducted, reviewed, and its conclusions formally accepted.

C. Identifying measures to mitigate risks is a core purpose of the DPIA, mandated by GDPR Article 35(7)(d), to reduce the potential harm to individuals.

1. General Data Protection Regulation (EU) 2016/679, Article 35(7): This article explicitly lists the minimum required components of a DPIA. It states the assessment shall contain at least: "(a) a systematic description of the envisaged processing operations...; (c) an assessment of the risks to the rights and freedoms of data subjects...; (d) the measures envisaged to address the risks...". This directly supports that A and C are requirements.

2. Information Commissioner's Office (UK), "Data protection impact assessments," Guide to the GDPR: In the section "How do we carry out a DPIA?", the ICO outlines the process, which includes the steps: "Step 6: Identify measures to reduce the risk" and "Step 7: Sign off and record outcomes." This guidance confirms that B and C are integral parts of the standard DPIA process.

3. Article 29 Data Protection Working Party, "Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk' for the purposes of Regulation 2016/679" (WP 248 rev.01), page 11: The guidelines state, "A DPIA is a process... It should be recorded in writing and should result in a concrete plan to manage the identified risks." This supports the requirement to record outcomes (B). The document does not mention any requirement to publish risks in a privacy notice.

4. Harvard University, Office of the Vice Provost for Research, "GDPR: Data Protection Impact Assessments (DPIA)": This university guidance outlines the DPIA process, stating, "The DPIA must... Describe the measures envisioned to address the risks... The DPIA report should be signed by the relevant DPO." This reinforces that C and B are required steps. It makes no mention of publishing risks in an information notice.