Exam CIPP-E topic 1 question 158 discussion

Sorry, according to the release of EDPS in 2020, B is correct answer.

https://www.edps.europa.eu/press-publications/press-news/press-releases/2020/body-temperature-checks-eu-institutions-careful_en After the posting, found out the press release of the EDPS in 2020. A is correct.

D is correct because GDPR recognizes that processing personal data for the purposes of safeguarding public health can be necessary and may fall under specific exemptions or considerations, particularly in emergency situations like a pandemic. A. is incorrect because body temperature is considered personal data when it can be linked to an individual. However, the key factor is how the data is processed and whether it’s subject to GDPR requirements. B. While GDPR applies to automated processing, it also covers manual processing of personal data. Thus, the lack of automation does not exempt the practice from GDPR. C. is not pseudonymous; pseudonymous data is where identifiers have been replaced to protect the identity of individuals. However, the key issue here is not pseudonymization but the purpose of processing.

Relevant Legislation: GDPR Article 4(2): Defines "processing" as any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. Because the body temperature checks are conducted manually and are not followed by any form of data processing, the practice falls outside the scope of the GDPR. Therefore, the correct answer is B

A person’s body temperature is personal data concerning their health and therefore constitutes “special category” personal data under Article 9 of the GDPR. Processing of that data can only be lawfully done in very limited circumstances.