Pass CDPSE Exam Guide

In GDPR parlance, organizations that use third-party service providers are often, but not always, considered data controllers, which are entities that determine the purposes and means of the processing of personal data, which can include directing third parties to process personal data on their behalf. The third parties that process data for data controllers are known as data processors.

The best way to protect personal data in the custody of a third party is to include requirements to comply with the organization’s privacy policies in the contract. This means that the organization should specify the terms and conditions of data processing, such as the purpose, scope, duration, and security measures, and ensure that they are consistent with the organization’s privacy policies and applicable privacy regulations. The contract should also define the roles and responsibilities of both parties, such as data controller and data processor, and establish mechanisms for monitoring, reporting, auditing, and resolving any issues or incidents related to data privacy. References: : CDPSE Review Manual (Digital Version), page 41

Height, weight, and activities are the most legitimate information to collect for business reasons in this situation, as they are directly related to the purpose and functionality of a wellness smartwatch application that aims to monitor and improve the health and fitness of its users. Collecting height, weight, and activities would also comply with the data minimization principle that requires limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes. The other options are not legitimate information to collect for business reasons in this situation, as they are not related to the purpose and functionality of a wellness smartwatch application and may violate the privacy rights and preferences of its users. Collecting sleep schedule and calorie intake may be useful for some users who want to track their sleep quality and nutrition intake, but they are not essential for a wellness smartwatch application and may require additional consent or justification from the users. Collecting education and profession may be irrelevant for a wellness smartwatch application and may be used for other purposes, such as marketing or profiling, without the consent or knowledge of the users. Collecting race, age, and gender may be sensitive for some users who do not want to disclose their personal characteristics or identity, and may require additional safeguards or measures to protect their privacy1, p. 75-76 References: 1: CDPSE Review Manual (Digital Version)

The most important consideration for developing data retention requirements is the applicable regulations that govern the data. Different types of data may be subject to different legal and regulatory obligations, such as how long the data must be kept, how it must be protected, and how it can be accessed or disposed of. Failing to comply with these obligations can result in fines, penalties, lawsuits, or reputational damage for the organization. Therefore, it is essential to identify and follow the applicable regulations for each data category.

References:

• Data Retention Policy 101: Best Practices, Examples & More - Intradyn
• Data retention - Wikipedia

Biometric records are personal information that can be used to identify an individual based on their physical or behavioral characteristics, such as fingerprints, facial recognition, iris scans, voice patterns, etc. Biometric records are considered sensitive personal information that require special protection and consent from the data subject. Biometric records can be used for various purposes, such as authentication, identification, security, etc., but they also pose privacy risks, such as unauthorized access, use, disclosure, or transfer of biometric data. References: : CDPSE Review Manual (Digital Version), page 25