Data Protection & AI Professional practice test

Sample questions

Two questions from this practice test, in the same style as the certification exam. Answer before opening the explanation.

1. Question 1

   A university runs a page on a social network. The network places cookies on visitors' devices and gives the university statistics about the page's audience, such as age ranges and the times visitors are most active. Under the GDPR, as interpreted by the Court of Justice of the EU, what is the university's role in the collection of visitors' data for these statistics?

   1. None, because the university receives only aggregated statistics and never sees individual visitors' data
   2. Processor of the network, because it uses a service whose terms and tools are set entirely by the network
   3. Joint controller with the network, because by creating the page and choosing its settings it helps determine that processing
   4. Sole controller, because it chose to open the page and so answers for everything the network does with visitor data
   Show answer and explanation

   Correct answer: C. Joint controller with the network, because by creating the page and choosing its settings it helps determine that processing

   In Wirtschaftsakademie (C-210/16), the Court of Justice held that the administrator of a page on a social network is a joint controller with the platform for the collection of visitor data used to produce page statistics: by creating the page and setting parameters such as the target audience, the administrator takes part in determining purposes and means. Controllership does not require access to the raw data, so receiving only aggregates does not remove the role. The university is not a processor, because it does not act on the network's behalf or under its instructions. Nor is it sole controller: joint controllership covers the stages it helps decide, not everything the network does with the data for its own purposes.

2. Question 2

   A Brazilian gym chain holds health questionnaires in which members disclosed heart conditions, injuries and medication, collected so that each member's training could be adapted safely. Management now wants to analyse the questionnaires to decide which new classes to offer. Under the LGPD, which approach can support this new use?

   1. Obtaining specific and highlighted consent for this purpose, or anonymising the data before the analysis
   2. Legitimate interest, supported by a documented balancing test showing that members benefit from better classes
   3. Protection of health, since the data concerns members' health and the new classes are meant to improve it
   4. Legitimate interest, provided the questionnaires are pseudonymised before the analysts receive them
   Show answer and explanation

   Correct answer: A. Obtaining specific and highlighted consent for this purpose, or anonymising the data before the analysis

   Health data is sensitive personal data under the LGPD, and Article 11 lists the only bases for processing it. Legitimate interest is not among them, so neither a balancing test nor pseudonymisation makes it available; pseudonymised data also remains personal data. The protection-of-health basis is limited to procedures carried out by health professionals, health services or health authorities, which a gym's product planning is not. For a new purpose like this, the gym needs consent given specifically and in a highlighted way for that purpose, or it can anonymise the data so that the analysis falls outside the LGPD.