A controller’s privacy notice lists an email and phone number, but both bounce and the DPO mailbox is a dead shared inbox. What transparency practice is missing?
Select an answer to reveal the explanation.
Short Explanation
A notice with dead phone and email lines is like a shop window with a locked door and no doorbell. Transparency is not just listing text—people must be able to reach the controller or DPO. Fix the channels so the contact details actually work.
Full Explanation
Transparency includes workable ways to contact the controller and, where designated, the data protection officer. Listing an email and phone number that bounce, or routing DPO mail into a dead shared inbox, means individuals cannot ask questions or exercise rights in practice. Articles 13 and 14 expect identity and contact details; Article 12 expects controllers to facilitate exercise of rights. Municipal switchboards and private privacy aliases alike must reach trained humans who can log and escalate requests—not voicemail loops that never open.
Publishing only a postal address is not a GDPR rule that makes email optional in the sense that non-functioning electronic contacts are acceptable. Replacing contacts with a marketing chatbot that never escalates similarly fails facilitation. Omitting contact channels when processing relies on legitimate interests is also wrong: contact and rights facilitation duties are not waived by choice of Article 6 basis.
Exam caveat: publicly available DPO contact details are required when a DPO is designated, without exposing the DPO’s private home address. Monitored functional mailboxes with SLAs beat vanity addresses that nobody reads.
Operational check: monthly test privacy and DPO channels end-to-end from an external account, publish working alternatives if one channel fails, assign ownership for inbox triage, and treat sustained bounces as a compliance defect in the accountability file—not merely as an IT ticket backlog.