Helen Dixon and Lothar Determann On the New Privacy Mandate

What is the first step for organizations to ensure GDPR compliance when introducing a new product?

• Hiring a legal consultant

• Documenting personal data processing operations

• Launching a pilot program

• Conducting a market analysis

Why might companies hesitate to consult regulators with abstract legal questions?

• It is unnecessary for compliance

• It is prohibited by GDPR

• It is too expensive

• It can overwhelm data protection authorities

What is a key difference between the GDPR and the California Privacy Rights Act?

• GDPR applies only to small businesses

• California Privacy Rights Act is inspired by GDPR

• GDPR is more focused on harm-based regulation

• California Privacy Rights Act has no fines

How has the COVID-19 pandemic affected privacy practices?

• Elimination of data breach notifications

• Reduced need for data confidentiality

• Increased data protection measures

• New privacy issues and complaints

What is a common issue faced by companies during the pandemic related to employee data?

• No need for data protection

• Conflicting instructions from authorities

• Increased data security

• Lack of data collection

What is a benefit of the GDPR for individuals?

• No need for data protection

• Power to exercise rights and seek compensation

• Unlimited data access

• No data collection

What is the maximum fine under the GDPR for privacy violations?

• 2% of global revenue

• 4% of global revenue

• 10% of global revenue

• No fines are imposed

What is a significant challenge for companies regarding data breach notifications under GDPR?

• Notifying within 72 hours

• Avoiding all notifications

• Finding a legal consultant

• Ignoring minor breaches

What is a potential downside of the GDPR's fine system?

• It only applies to small companies

• It is not enforced

• It may not change company behavior

• It is too lenient

What is a recommended practice for companies to handle data breaches effectively?

• Ignore minor breaches

• Wait for legal advice before acting

• Prepare short, easy protocols for employees

• Notify regulators immediately without assessment