{"session":{"title":"GDPR Refresher 2025","date":"2025-09-18"},"participant":{"role":"Customer Service Agent","anonymous":true},"ratings":[{"dimension":"content_relevance","rating_1_5":5,"comment_optional":"The three case studies were directly relevant to my daily work."},{"dimension":"trainer_effectiveness","rating_1_5":5,"comment_optional":"Marie explained complex points clearly and answered every question."},{"dimension":"materials_quality","rating_1_5":4,"comment_optional":"The breach-response quick card is very useful; the handbook was a bit dense."},{"dimension":"pace","rating_1_5":4,"comment_optional":"Slightly fast on the international transfers section."},{"dimension":"venue_logistics","rating_1_5":5}],"overall_rating_1_5":4.5,"would_recommend":true,"knowledge_check":[{"question":"Which article of the GDPR lists the six lawful bases for processing?","participant_answer":"Article 6","correct_answer":"Article 6 GDPR","scored_correct":true},{"question":"Within how many hours must a personal-data breach be notified to the supervisory authority where feasible?","participant_answer":"72 hours","correct_answer":"72 hours (Art. 33(1) GDPR)","scored_correct":true},{"question":"A customer requests a copy of all personal data held about them. Which right is this?","participant_answer":"Right of access","correct_answer":"Right of access (Art. 15 GDPR)","scored_correct":true},{"question":"True or false: consent is always the strongest lawful basis to rely on.","participant_answer":"True","correct_answer":"False — the most appropriate basis depends on the purpose; legitimate interest or contract may be more suitable.","scored_correct":false},{"question":"Which EDPB document governs SCCs and international transfers assessments?","participant_answer":"Guidelines 05/2021","correct_answer":"EDPB Recommendations 01/2020 on supplementary measures and Guidelines 05/2021 on the interplay of Art. 3 and Ch. V","scored_correct":true},{"question":"Who is Acme's Data Protection Officer?","participant_answer":"Marie Laurent","correct_answer":"Marie Laurent","scored_correct":true},{"question":"Which article sets the 72-hour breach notification?","participant_answer":"Art. 34","correct_answer":"Art. 33 GDPR (Art. 34 covers notification to the data subject).","scored_correct":false},{"question":"Name one lawful basis other than consent.","participant_answer":"Legitimate interest","correct_answer":"Any of: contract, legal obligation, vital interests, public task, legitimate interests (Art. 6(1)(b)–(f)).","scored_correct":true},{"question":"What is the maximum administrative fine under Art. 83(5) GDPR?","participant_answer":"20 million EUR or 4% of worldwide annual turnover","correct_answer":"EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.","scored_correct":true},{"question":"Is an IP address personal data?","participant_answer":"Yes, when it can identify a natural person","correct_answer":"Yes — per CJEU C-582/14 (Breyer), dynamic IPs are personal data where the controller has legal means to identify the subject.","scored_correct":true}],"open_feedback":"Really useful refresher. I feel more confident handling access requests at the service desk. The breach response drill in the middle was the highlight — please do one at every refresher.","improvement_suggestions":["Split the international transfers section into a separate short session next year; it felt rushed.","Add a short role-play where a caller impersonates a data subject to test identity-verification reflexes.","Provide the handbook as a searchable PDF two days in advance for pre-reading."]}