Sample questions

Privacy and data protection

A free preview of real exam-style questions for this topic — each with the correct answer, an explanation, and the official source it is based on.

1. 01Which authority supervises UAS data protection in Latvia?

   • ✓Datu valsts inspekcija (DVI). — Correct answer
   • ·Civil Aviation Agency (CAA Latvia).
   • ·State Border Guard.
   • ·Consumer Rights Protection Centre.

   Data protection supervision in Latvia is the role of Datu valsts inspekcija (DVI). CAA Latvia oversees aviation safety requirements, not data protection.

   GDPR Art. 51; Latvian Personal Data Processing Law

2. 02Is a vehicle licence plate personal data under GDPR?

   • ·No, because the plate is public.
   • ✓Yes, because it can be linked to a specific person. — Correct answer
   • ·Only for commercial registrations.
   • ·Only if the driver is also visible in the frame.

   Under GDPR personal data is any information that allows identifying a person — directly or indirectly. A plate is registered to a natural person and therefore is personal data.

   Reg (EU) 2016/679 (GDPR) Art. 4(1)

3. 03What is the maximum GDPR fine?

   • ·€1000.
   • ·€100 per incident.
   • ✓4 % of annual turnover or €20 million (whichever is higher). — Correct answer
   • ·2 % of turnover or €10 million.

   GDPR Art. 83 sets the cap at 4 % of global annual turnover or €20 million, whichever is higher.

   Reg (EU) 2016/679 (GDPR) Art. 83(5)

4. 04Which GDPR lawful basis most safely fits a technical-site inspection drone flight?

   • ·Consent (Art. 6(1)(a)) from every incidental passer-by.
   • ·Contract (Art. 6(1)(b)).
   • ·Vital interests (Art. 6(1)(d)).
   • ✓Legitimate interests (Art. 6(1)(f)). — Correct answer

   Technical inspection where people in frame are incidental typically relies on legitimate interests. The pilot must run a balancing test and document the outcome.

   Reg (EU) 2016/679 (GDPR) Art. 6(1)(f); EDPB Guidelines 06/2020

5. 05How is a site marked that is forbidden to photograph or film without authorisation?

   • ✓With a sign "BEZ SASKAŅOŠANAS FOTOGRAFĒT, FILMĒT AIZLIEGTS". — Correct answer
   • ·With a triangle.
   • ·With a yellow line.
   • ·With a red cross.

   In Latvia critical-infrastructure sites carry that exact wording. Filming without authorisation is an administrative offence.

   Latvia: critical-infrastructure protection rules; CAA Latvia guidance

6. 06A pilot films a city marathon for a commercial client. Runners' faces are identifiable. Which GDPR lawful basis applies and what must be done before publishing?

   • ·No lawful basis needed — public events are exempt.
   • ✓Legitimate interest may apply to a public event, but identifiable faces must be blurred before publishing or a Legitimate Interest Assessment must be completed. — Correct answer
   • ·Public events imply automatic consent — participants consented by entering.
   • ·GDPR does not apply to content filmed outdoors.

   Public events can support legitimate interest as a lawful basis if the privacy impact is proportionate. However, identifiable faces are personal data. Before publishing, either a Legitimate Interest Assessment (LIA) must conclude that privacy impact is minimal, or all identifiable faces and plates must be blurred.

   Reg (EU) 2016/679 (GDPR) Art. 6(1)(f); EDPB Guidelines 06/2020