Summary questions on legal matters¶

The summary questions concern Finnish legislation, which is the most important part of what you have learned in this module. The questions are randomised per student, and for these questions you will receive only correct/incorrect feedback. In each question of Problem 1, there is exactly one correct option.

In Problem 2, each student will receive at least one correct option, usually several. For a partially correct answer, Plussa gives feedback incorrect, but Problem 2 is accepted when the score is 12 or more and the points are shown against a yellow background. Points start to accumulate only when more than half of the selections in the task are correct. From the score alone, it is not possible to deduce whether an individual selection is correct or not.

Question 1

The Finnish Constitution provides for privacy. All other legislation concerning data protection is compiled

in the Data Protection Act.

in the Data Protection Act and the Act on Electronic Communications Services.

in the Information Society Code.

not in any single act.

Question 2

The GDPR and the Data Protection RegulationAct give the data subject certain rights regarding their own data. Assuming that the register itself is lawful, which of the following does not belong to these rights?

The right to access one’s data.

The right to prohibit processing for direct marketing.

The right to rectify one’s data.

The right to pseudonymise part of the data.

Question 3

There are seven types of special categories of personal data under the GDPR. How many of these types concern a person’s current characteristics that cannot change during a person’s lifetime?

none

1, 2 or 3

4 or 5

6 or 7

Question 4

What do the GDPR and the Act provide regarding special categories of personal data?

Their processing is without exception prohibited.

Their processing is permitted in some cases.

Each person may define a broader part of their own personal data as special category data than the law normally provides.

Each person may define a narrower part of their own personal data as special category data than the law normally provides.

Question 5

Which of the following is least related to intellectual property rights?

related right

invention

open source

CC (Creative Commons)

GDPR

DRM

Question 6

Reverse engineering may concern

patents

public key certificates

encryption standards

trade secrets

Question 7

What falls within the scope of the concept trust service mentioned in the name of an Act?

a notary who certifies and possibly stores documents

an email or other communication service implementing encryption

an issuer of a public key certificate

an identity provider in federated identity management

Question 8

What technical aspects are most essentially included in the Act on strong electronic identification and electronic trust services?

certificates and identities

online banking credentials and account information

blockchains and certificates

encryption and signing of data

Select the correct statements. You may select one or more options. (Reminder: in the 1995 reform, a new chapter on data and communications offences was added to the Criminal Code.)

Question 1

The Criminal Code does not consider it a data breach if someone logs into an information system without permission using someone else’s username.

The Criminal Code addresses harassment of a private individual by means of communication, even if it is not a denial-of-service attack.

Even before 1995, under the Criminal Code it was possible to convict a perpetrator of a denial-of-service attack.

Before 1995, the Criminal Code could not be applied to incidents that were in the reform named as Unlawful access to an information system.

Since 1995, the Criminal Code has not needed to be reformed with regard to information security offences, except through references to some other laws that have changed.

Under the Criminal Code, interference with communications can only occur if one has simultaneously committed unlawful access to that system.

If, under the Criminal Code, an eavesdropper is guilty of an offence, it may be something other than a Secrecy offence and violation.

The Criminal Code defines identity theft.

Cyberbullying has not yet been incorporated into the Criminal Code.