PDP9 Exam Preparation Material | BCS Practitioner Certificate in Data Protection

Explanation:
Information society services (ISS) are defined in Article 4(25) of the UK GDPR as “any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services”. This means that ISS are online services that are paid for, either by the user or by another source of income, such as advertising or sponsorship, and that are provided without the parties being physically present, using electronic equipment for the transmission and reception of data, and upon the request of the user. Examples of ISS include apps, programs, websites, search engines, social media platforms, online marketplaces, content streaming services, online games, and any other online services that offer goods or services to users over the internet. Therefore, options A, B and C are correct examples of ISS, as they meet the criteria of the definition. However, option D is not a correct example of ISS, as it does not involve any remuneration for the service provider. Information services provided by non-profit or government organisations with no remuneration are not considered ISS under the UK GDPR, unless they compete with other ISS on the market.
Reference: UK GDPR, Article 4(25)4
Services covered by this code5

Explanation:
Lawfulness of processing is not a factor that should be considered when looking at security of processing under Article 32 of the GDPR. Lawfulness of processing is a separate requirement that applies to all processing of personal data, regardless of the level of security. Security of processing under Article 32 of the GDPR should be based on the following factors:
The state of the art and the costs of implementation of the security measures; The nature, scope, context and purposes of the processing;
The risk of varying likelihood and severity for the rights and freedoms of natural persons;
Adherence to an approved code of conduct or an approved certification mechanism (as an element to demonstrate compliance).
Reference: Article 32 of the GDPR1
Guidelines 07/2020 on the concepts of controller and processor in the GDPR2, p. 36

Explanation:
Article 29 of UK GDPR states that the processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by domestic law. This means that the processor must follow the controller’s directions on how to handle the personal data, and cannot use it for its own purposes or deviate from the agreed terms. The only exception is when the processor is obliged by law to process the data in a different way, for example, to comply with a court order or a legal obligation. The other options are not related to Article 29, but to other articles of UK GDPR, such as Article 25 (data protection by design and by default), Article 30 (records of processing activities), and Article 36 (prior consultation).
Reference: Article 29 of UK GDPR1
ICO guidance on controllers and processors2

Explanation:
The right to a private life is a fundamental human right that is protected by law in the UK. Article 8 of the European Convention on Human Rights (ECHR), which is incorporated into UK law by the Human Rights Act 1998, states that “Everyone has the right to respect for his private and family life, his home and his correspondence”. This right applies to all individuals, regardless of their status, profession, or public exposure. The right to a private life covers aspects such as personal identity, personal relationships, physical and mental well-being, personal data, and correspondence. However, this right is not absolute and can be limited or interfered with by the state or other parties in certain circumstances, such as for the protection of national security, public safety, health, morals, or the rights and freedoms of others.
Reference:
Article 8 of the ECHR1
Human Rights Act 19982
ICO Guide to Data Protection3

Explanation:
The definitions of “public authority” and “public body” for the purposes of the UK GDPR and the Data Protection Act 2018 are found in the Freedom of Information Act 2000 and the Data Protection Act 2018 respectively. Section 7 of the Data Protection Act 2018 provides that a public authority or a public body is one that is listed in Schedule 1 to the Freedom of Information Act 2000, or is designated by an order under section 5 of that Act. However, a court or tribunal acting in its judicial capacity is not considered a public authority or a public body under the Data Protection Act 2018.
Reference: Section 7 of the Data Protection Act 20181
Schedule 1 to the Freedom of Information Act 2000