Special Summer Sale - 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dm70dm

CIPP-E Certified Information Privacy Professional/Europe (CIPP/E) Questions and Answers

Questions 4

SCENARIO

Please use the following to answer the next question:

Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located in

Greece (5), Italy (15) and Spain (1), have registered their most profitable results

ever. To celebrate this achievement, ARRA Hotels' Human Resources office, based

in ARRA's main Italian establishment, has organized a team event for its 420

employees and their families at its hotel in Spain.

Upon arrival at the hotel, each employee and family member is given an electronic

wristband at the reception desk. The wristband serves a number of functions:

. Allows access to the "party zone" of the hotel, and emits a buzz if the user

approaches any unauthorized areas

. Allows up to three free drinks for each person of legal age, and emits a

buzz once this limit has been reached

. Grants a unique ID number for participating in the games and contests that

have been planned.

Along with the wristband, each guest receives a QR code that leads to the online

privacy notice describing the use of the wristband. The page also contains an

unchecked consent checkbox. In the case of employee family members under the

age of 16, consent must be given by a parent.

Among the various activities planned for the event, ARRA Hotels' HR office has

autonomously set up a photocall area, separate from the main event venue, where

employees can come and have their pictures taken in traditional carnival costume.

The photos will be posted on ARRA Hotels' main website for general marketing

purposes.

On the night of the event, an employee from one of ARRA's Greek hotels is

displeased with the results of the photos in which he appears. He intends to file a

complaint with the relevant supervisory authority in regard to the following:

. The lack of any privacy notice in the separate photocall area

The unlawful cross-border processing of his personal data

. The unacceptable aesthetic outcome of his photos

Which of the following is NOT necessarily considered a factor in identifying whether

the processing could be considered a "cross-border processing"?

Options:

A.

The total number of the data subjects interested.

B.

The potential harm for the data subjects affected.

C.

The limitation of rights of the data subjects concerned.

D.

The exposure of the information of the data subjects involved.

Buy Now
Questions 5

Which of the following would most likely NOT be covered by the definition of “personal data” under the GDPR?

Options:

A.

The payment card number of a Dutch citizen

B.

The U.S. social security number of an American citizen living in France

C.

The unlinked aggregated data used for statistical purposes by an Italian company

D.

The identification number of a German candidate for a professional examination in Germany

Buy Now
Questions 6

SCENARIO

Please use the following to answer the next question:

Sandy recently joined Market4U, an advertising technology company founded in 2016, as their VP of Privacy and Data Governance. Through her first initiative in conducting a data inventory, Sandy learned that Market4U maintains a list of 19 million global contacts that were collected throughout the course of Market4U’s existence. Knowing the risk of having such a large amount of data, Sandy wanted to purge all contacts that were entered into Market4U’s systems prior to May 2018, unless such contacts had a more recent interaction with Market4U content. However, Dan, the VP of Sales, informed Sandy that all of the contacts provide useful information regarding successful marketing campaigns and trends in industry verticals for Market4U’s clients.

Dan also informed Sandy that he had wanted to focus on gaining more customers within the sports and entertainment industry. To assist with this behavior, Market4U’s marketing team decided to add several new fields to Market4U’s website forms, including forms for downloading white papers, creating accounts to participate in Market4U’s forum, and attending events. Such fields include birth date and salary.

What should Sandy give as feedback to Dan and the marketing team regarding the new fields Dan wants to add to Market4U’s forms?

Options:

A.

Make all the fields optional.

B.

Only request the information in brackets (i.e., age group and salary range).

C.

Eliminate the fields, as they are not proportional to the services being offered.

D.

Eliminate the fields as they are not necessary for the purposes of providing white papers or registration for events.

Buy Now
Questions 7

SCENARIO

Please use the following to answer the next question:

Gentle Hedgehog Inc. is a privately owned website design agency incorporated in

Italy. The company has numerous remote workers in different EU countries. Recently,

the management of Gentle Hedgehog noticed a decrease in productivity of their sales

team, especially among remote workers. As a result, the company plans to implement

a robust but privacy-friendly remote surveillance system to prevent absenteeism,

reward top performers, and ensure the best quality of customer service when sales

people are interacting with customers.

Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employee

surveillance software whose European headquarters is in Germany. Sauron Eye's

software provides powerful remote-monitoring capabilities, including 24/7 access to

computer cameras and microphones, screen captures, emails, website history, and

keystrokes. Any device can be remotely monitored from a central server that is

securely installed at Gentle Hedgehog headquarters. The monitoring is invisible by

default; however, a so-called Transparent Mode, which regularly and conspicuously

notifies all users about the monitoring and its precise scope, also exists. Additionally,

the monitored employees are required to use a built-in verification technology

involving facial recognition each time they log in.

All monitoring data, including the facial recognition data, is securely stored in

Microsoft Azure cloud servers operated by Sauron Eye, which are physically located

in France.

Based on the scenario, what are the primary privacy risks of the planned

surveillance system?

Options:

A.

A Chinese vendor and the monitoring of EU-based employees.

B.

Facial recognition data stored in the cloud and lack of encryption.

C.

Excessive scope of monitoring and lack of legitimate purpose for data collection.

D.

Missing E2EE encryption in the monitoring system and unclear data storage duration.

Buy Now
Questions 8

When does the European Data Protection Board (EDPB) recommend reevaluating whether a transfer tool is effectively providing a level of personal data protection that is in compliance with the European Union (EU) level?

Options:

A.

After a personal data breach.

B.

Every three (3) years.

C.

On an ongoing basis.

D.

Every year.

Buy Now
Questions 9

What term BEST describes the European model for data protection?

Options:

A.

Sectoral

B.

Self-regulatory

C.

Market-based

D.

Comprehensive

Buy Now
Questions 10

How is the GDPR’s position on consent MOST likely to affect future app design and implementation?

Options:

A.

App developers will expand the amount of data necessary to collect for an app’s functionality.

B.

Users will be given granular types of consent for particular types of processing.

C.

App developers’ responsibilities as data controllers will increase.

D.

Users will see fewer advertisements when using apps.

Buy Now
Questions 11

You are the new Data Protection Officer for your company and have to determine whether the company has implemented appropriate technical and organizational measures as required by Article 32 of the GDPR. Which of the following would be the most important to consider when trying to determine this?

Options:

A.

How security measures might evolve in the future

B.

Which security measures are endorsed by a majority of experts.

C.

How the public perceives what constitutes adequate security measures

D.

Which kinds of security measures your company has employed in the past

Buy Now
Questions 12

When would a data subject NOT be able to exercise the right to portability?

Options:

A.

When the processing is necessary to perform a task in the exercise of authority vested in the controller.

B.

When the processing is carried out pursuant to a contract with the data subject.

C.

When the data was supplied to the controller by the data subject.

D.

When the processing is based on consent.

Buy Now
Questions 13

SCENARIO

Please use the following to answer the next question:

TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company’s outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.’s foundering business.

During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations. TripBliss Inc. can choose any number of data categories – age, income, ethnicity – that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website’s traffic, in order to get a better understanding of how customers are using it. He explains his plan

to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website’s effectiveness. Oliver enthusiastically engages Techiva for these services.

Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.’s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva’s system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company’s system of access control must be reconsidered.

With regard to TripBliss Inc.’s use of website cookies, which of the following statements is correct?

Options:

A.

Because not all of the cookies are strictly necessary to enable the use of a service requested from TripBliss Inc., consent requirements apply to their use of cookies.

B.

Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers.

C.

Because Techiva will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary.

D.

Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.

Buy Now
Questions 14

If a company is planning to use closed-circuit television (CCTV) on its premises and is concerned with GDPR compliance, it should first do all of the following EXCEPT?

Options:

A.

Notify the appropriate data protection authority.

B.

Perform a data protection impact assessment (DPIA).

C.

Create an information retention policy for those who operate the system.

D.

Ensure that safeguards are in place to prevent unauthorized access to the footage.

Buy Now
Questions 15

Under the GDPR, which essential pieces of information must be provided to data subjects before collecting their personal data?

Options:

A.

The authority by which the controller is collecting the data and the third parties to whom the data will be sent.

B.

The name/s of relevant government agencies involved and the steps needed for revising the data.

C.

The identity and contact details of the controller and the reasons the data is being collected.

D.

The contact information of the controller and a description of the retention policy.

Buy Now
Questions 16

Which failing of Privacy Shield, cited by the CJEU as a reason for its invalidation, is the Trans-Atlantic Data Privacy Framework intended to address?

Options:

A.

Data Subject Rights.

B.

Right of Action.

C.

Necessity.

D.

Consent.

Buy Now
Questions 17

SCENARIO

Please use the following to answer the next question:

Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA analysis. The company is headquartered in Montreal, and all of its employees are located there. The company offers its services to Canadians only: Its website is in English and French, it accepts only Canadian currency, and it blocks internet traffic from outside of Canada (although this solution doesn’t prevent all non-Canadian traffic). It also declines to process orders that request the DNA report to be sent outside of Canada, and returns orders that show a non-Canadian return address.

Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU, and the company is exploring a number of plans to expand its customer base.

The first plan, collegially called We-Track-U, will use an app to collect information about its current Canadian customer base. The expansion will allow its Canadian customers to use the app while traveling abroad. He suggests that the company use this app to gather location information. If the plan shows promise, Bob proposes to use push notifications and text messages to encourage existing customers to pre-register for an EU version of the service. Bob calls this work plan, We-Text-U. Once the company has gathered enough pre- registrations, it will develop EU-specific content and services.

Another plan is called Customer for Life. The idea is to offer additional services through the company’s app, like storage and sharing of DNA information with other applications and medical providers. The company’s contract says that it can keep customer DNA indefinitely, and use it to offer new services and market them to customers. It also says that customers agree not to withdraw direct marketing consent. Paul, the marketing director, suggests that the company should fully exploit these provisions, and that it can work around customers’ attempts to withdraw consent because the contract invalidates them.

The final plan is to develop a brand presence in the EU. The company has already begun this process. It is in the process of purchasing the naming rights for a building in Germany, which would come with a few offices that Who-R-U executives can use while traveling internationally. The office doesn’t include any technology or infrastructure; rather, it’s simply a room with a desk and some chairs.

On a recent trip concerning the naming-rights deal, Bob’s laptop is stolen. The laptop held unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of Canada. The reports include customer name, birthdate, ethnicity, racial background, names of relatives, gender, and occasionally health information.

Who-R-U is NOT required to notify the local German DPA about the laptop theft because?

Options:

A.

The company isn’t a controller established in the Union.

B.

The laptop belonged to a company located in Canada.

C.

The data isn’t considered personally identifiable financial information.

D.

There is no evidence that the thieves have accessed the data on the laptop.

Buy Now
Questions 18

What is the consequence if a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller?

Options:

A.

The controller will be liable to pay an administrative fine

B.

The processor will be liable to pay compensation to affected data subjects

C.

The processor will be considered to be a controller in respect of the processing concerned

D.

The controller will be required to demonstrate that the unauthorized processing negatively affected one or more of the parties involved

Buy Now
Questions 19

ISO 31700 has set forth requirements relating to consumer products and services. In particular, this international standard focuses on the implementation of which of the following?

Options:

A.

Privacy by design.

B.

Comprehensive ethical Al software.

C.

Privacy notices for companies providing services to consumers.

D.

Automated systems for identifying EU data subjects' personal data.

Buy Now
Questions 20

What type of data lies beyond the scope of the General Data Protection Regulation?

Options:

A.

Pseudonymized

B.

Anonymized

C.

Encrypted

D.

Masked

Buy Now
Questions 21

SCENARIO

Please use the following to answer the next question:

Gentle Hedgehog Inc. is a privately owned website design agency incorporated in

Italy. The company has numerous remote workers in different EU countries. Recently,

the management of Gentle Hedgehog noticed a decrease in productivity of their sales

team, especially among remote workers. As a result, the company plans to implement

a robust but privacy-friendly remote surveillance system to prevent absenteeism,

reward top performers, and ensure the best quality of customer service when sales

people are interacting with customers.

Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employee

surveillance software whose European headquarters is in Germany. Sauron Eye's

software provides powerful remote-monitoring capabilities, including 24/7 access to

computer cameras and microphones, screen captures, emails, website history, and

keystrokes. Any device can be remotely monitored from a central server that is

securely installed at Gentle Hedgehog headquarters. The monitoring is invisible by

default; however, a so-called Transparent Mode, which regularly and conspicuously

notifies all users about the monitoring and its precise scope, also exists. Additionally,

the monitored employees are required to use a built-in verification technology

involving facial recognition each time they log in.

All monitoring data, including the facial recognition data, is securely stored in Microsoft Azure cloud servers operated by Sauron Eye, which are physically located in France.

What is the main problem with the 24/7 camera monitoring?

Options:

A.

It must not be operated during non-business hours and employee holidays.

B.

It may accidentally film third parties whose consent is required for monitoring.

C.

It has no valid legal basis to be implemented in the context of Gentle Hedgehog's business.

D.

It must first be approved by the trade union and then granted a license from the national DPA.

Buy Now
Questions 22

SCENARIO

Please use the following to answer the next question:

Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy company operating in every continent. All of the company’s IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father’s company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.

Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company’s online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers’ philosophical beliefs, political opinions and marital status.

If a customer identifies as single, Ben then copies all of that customer’s personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.

Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.

Joe also hires his best friend’s daughter, Alice, who just graduated from law school in the U.S., to be the company’s new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company’s operations in the European Union to the U.S.

Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company’s IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone’s information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.

In preparing the company for its impending lawsuit, Alice’s instruction to the company’s IT Department violated Article 5 of the GDPR because the company failed to first do what?

Options:

A.

Send out consent forms to all of its employees.

B.

Minimize the amount of data collected for the lawsuit.

C.

Inform all of its employees about the lawsuit.

D.

Encrypt the data from all of its employees.

Buy Now
Questions 23

In addition to the European Commission, who can adopt standard contractual clauses, assuming that all required conditions are met?

Options:

A.

Approved data controllers.

B.

The Council of the European Union.

C.

National data protection authorities.

D.

The European Data Protection Supervisor.

Buy Now
Questions 24

All of the following will be established by the second Network and Information Security Directive ("NIS2") EXCEPT?

Options:

A.

Baseline cybersecurity measures that each covered entity must address.

B.

Powers to inspect, audit, or require information from covered organizations.

C.

A common controls framework that every organization must adopt.

D.

A new network for EU member states to cooperate on large-scale breaches.

Buy Now
Questions 25

According to the Personal Data Protection Commission's (PDPC) "Guide to basic data anonymization techniques," recently adopted by the Spanish

Data Protection Agency, which of the following is NOT a valid basic anonymization technique?

Options:

A.

Swapping.

B.

Generalization.

C.

Data Adjustment.

D.

Attribute Suppression.

Buy Now
Questions 26

Which of the following was the first to implement national law for data protection in 1973?

Options:

A.

France

B.

Sweden

C.

Germany

D.

United Kingdom

Buy Now
Questions 27

According to the E-Commerce Directive 2000/31/EC, where is the place of “establishment” for a company providing services via an Internet website confirmed by the GDPR?

Options:

A.

Where the technology supporting the website is located

B.

Where the website is accessed

C.

Where the decisions about processing are made

D.

Where the customer’s Internet service provider is located

Buy Now
Questions 28

Which area of privacy is a lead supervisory authority’s (LSA) MAIN concern?

Options:

A.

Data subject rights

B.

Data access disputes

C.

Cross-border processing

D.

Special categories of data

Buy Now
Questions 29

According to Art 23 GDPR, which of the following data subject rights can NOT be restricted?

Options:

A.

Right to restriction of processing.

B.

Right to erasure ("Right to be forgotten").

C.

Right to lodge a complaint with a supervisory authority.

D.

Right not to be subject to automated individual decision-making

Buy Now
Questions 30

SCENARIO

Please use the following to answer the next question:

Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B. Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.

Company B’s payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A’s factories. Company B won’t hold any biometric data itself, but the related data will be uploaded to Company B’s UK servers and used to provide the payroll service. Company B’s live systems will contain the following information for each of Company A’s employees:

    Name

    Address

    Date of Birth

    Payroll number

    National Insurance number

    Sick pay entitlement

    Maternity/paternity pay entitlement

    Holiday entitlement

    Pension and benefits contributions

    Trade union contributions

Jenny is the compliance officer at Company A. She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn’t sure whether or not this is required.

Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn’t have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.

Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B’s live systems in order to create a new database for Company B.

This database will be stored in a test environment hosted on Company C’s U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.

Unfortunately, Company C’s U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A’s employees is visible to anyone visiting Company C’s website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees.

The GDPR requires sufficient guarantees of a company’s ability to implement adequate technical and organizational measures. What would be the most realistic way that Company B could have fulfilled this requirement?

Options:

A.

Hiring companies whose measures are consistent with recommendations of accrediting bodies.

B.

Requesting advice and technical support from Company A’s IT team.

C.

Avoiding the use of another company’s data to improve their own services.

D.

Vetting companies’ measures with the appropriate supervisory authority.

Buy Now
Questions 31

According to the GDPR. Article 4(14). biometric data is defined as:

"Personal data resulting from specific technical processing relating to the______charactenstics of a natural person"

Which term could NOT be placed in the above definition?

Options:

A.

Psychological.

B.

Physical.

C.

Intellectual.

D.

Behavioral

Buy Now
Questions 32

SCENARIO

Please use the following to answer the next question:

Dynaroux Fashion (‘Dynaroux’) is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Ronan is their recently appointed data protection officer, who oversees the company’s compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.

The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.

In an aggressive bid to build revenue growth, Jonas, the CEO, tells Ronan that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company’s customers by analyzing their purchases. Ronan tells the CEO that: (a) the potential risks of such activities means that

Dynaroux needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Dynaroux may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.

Jonas tells Ronan that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Dynaroux’s business plan and associated processing activities.

Which of the following facts about Dynaroux would trigger a data protection impact assessment under the GDPR?

Options:

A.

The company will be undertaking processing activities involving sensitive data categories such as financial and children’s data.

B.

The company employs approximately 650 people and will therefore be carrying out extensive processing activities.

C.

The company plans to undertake profiling of its customers through analysis of their purchasing patterns.

D.

The company intends to shift their business model to rely more heavily on online shopping.

Buy Now
Questions 33

What must a data controller do in order to make personal data pseudonymous?

Options:

A.

Separately hold any information that would allow linking the data to the data subject.

B.

Encrypt the data in order to prevent any unauthorized access or modification.

C.

Remove all indirect data identifiers and dispose of them securely.

D.

Use the data only in aggregated form for research purposes.

Buy Now
Questions 34

Under the GDPR, who would be LEAST likely to be allowed to engage in the collection, use, and disclosure of a data subject’s sensitive medical information without the data subject’s knowledge or consent?

Options:

A.

A member of the judiciary involved in adjudicating a legal dispute involving the data subject and concerning the health of the data subject.

B.

A public authority responsible for public health, where the sharing of such information is considered necessary for the protection of the general populace.

C.

A health professional involved in the medical care for the data subject, where the data subject’s life hinges on the timely dissemination of such information.

D.

A journalist writing an article relating to the medical condition in QUESTION, who believes that the publication of such information is in the public interest.

Buy Now
Questions 35

A mobile device application that uses cookies will be subject to the consent requirement of which of the

following?

Options:

A.

The ePrivacy Directive

B.

The E-Commerce Directive

C.

The Data Retention Directive

D.

The EU Cybersecurity Directive

Buy Now
Questions 36

The EDPB's Guidelines 8/2020 on the targeting of social media users stipulates that in order to rely on legitimate interest as a legal basis to process personal data, three tests must be passed. Which of the following is NOT one of the three tests?

Options:

A.

Purpose test.

B.

Necessity test.

C.

Balancing test.

D.

Adequacy test.

Buy Now
Questions 37

What monitoring may lawfully be performed within the scope of Gentle Hedgehog's business?

Options:

A.

Everything offered by Sauron Eye's software in relation to activity by sales team contractors.

B.

Everything offered by Sauron Eye's software, assuming employees provide daily consent to the monitoring.

C.

Only emails, website browsing history, and camera for internal video calls conducted in a non-secure environment.

D.

Only emails, website browsing history, and camera for internal video calls that are expressly marked as monitored.

Buy Now
Questions 38

SCENARIO

Please use the following to answer the next question:

Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located in

Greece (5), Italy (15) and Spain (1), have registered their most profitable results

ever. To celebrate this achievement, ARRA Hotels' Human Resources office, based

in ARRA's main Italian establishment, has organized a team event for its 420

employees and their families at its hotel in Spain.

Upon arrival at the hotel, each employee and family member is given an electronic

wristband at the reception desk. The wristband serves a number of functions:

. Allows access to the "party zone" of the hotel, and emits a buzz if the user

approaches any unauthorized areas

. Allows up to three free drinks for each person of legal age, and emits a

buzz once this limit has been reached

. Grants a unique ID number for participating in the games and contests that

have been planned.

Along with the wristband, each guest receives a QR code that leads to the online

privacy notice describing the use of the wristband. The page also contains an

unchecked consent checkbox. In the case of employee family members under the

age of 16, consent must be given by a parent.

Among the various activities planned for the event, ARRA Hotels' HR office has

autonomously set up a photocall area, separate from the main event venue, where

employees can come and have their pictures taken in traditional carnival costume.

The photos will be posted on ARRA Hotels' main website for general marketing

purposes.

On the night of the event, an employee from one of ARRA's Greek hotels is

displeased with the results of the photos in which he appears. He intends to file a

complaint with the relevant supervisory authority in regard to the following:

. The lack of any privacy notice in the separate photocall area

The unlawful cross-border processing of his personal data

. The unacceptable aesthetic outcome of his photos

Why would consent NOT be considered an adequate legal basis for accessing the

party zone?

Options:

A.

The consent is not completely unambiguous.

B.

The consent is not sufficiently informed.

C.

The consent is not freely given.

D.

The consent is not in writing.

Buy Now
Questions 39

Company X has entrusted the processing of their payroll data to Provider Y. Provider Y stores this encrypted data on its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?

Options:

A.

The public

B.

Company X

C.

Law enforcement

D.

The supervisory authority

Buy Now
Questions 40

Which statement provides an accurate description of a directive?

Options:

A.

A directive speo5es certain results that must be achieved, but each member state is free to decide how to turn it into a national law

B.

A directive has binding legal force throughout every member state and enters into force on a set date in all the member states.

C.

A directive is a legal act relating to specific cases and directed towards member states, companies 0' private individuals.

D.

A directive is a legal act that applies automatically and uniformly to all EU countries as soon as it enters into force.

Buy Now
Questions 41

An online company’s privacy practices vary due to the fact that it offers a wide variety of services. How could it best address the concern that explaining them all would make the policies incomprehensible?

Options:

A.

Use a layered privacy notice on its website and in its email communications.

B.

Identify uses of data in a privacy notice mailed to the data subject.

C.

Provide only general information about its processing activities and offer a toll-free number for more information.

D.

Place a banner on its website stipulating that visitors agree to its privacy policy and terms of use by visiting the site.

Buy Now
Questions 42

SCENARIO

Please use the following to answer the next question:

Liem, an online retailer known for its environmentally friendly shoes, has recently expanded its presence in Europe. Anxious to achieve market dominance, Liem teamed up with another eco friendly company, EcoMick, which sells accessories like belts and bags. Together the companies drew up a series of marketing campaigns designed to highlight the environmental and economic benefits of their products. After months of planning, Liem and EcoMick entered into a data sharing agreement to use the same marketing database, MarketIQ, to send the campaigns to their respective contacts.

Liem and EcoMick also entered into a data processing agreement with MarketIQ, the terms of which included processing personal data only upon Liem and EcoMick’s instructions, and making available to them all information necessary to demonstrate compliance with GDPR obligations.

Liem and EcoMick then procured the services of a company called JaphSoft, a marketing optimization firm that uses machine learning to help companies run successful campaigns. Clients provide JaphSoft with the personal data of individuals they would like to be targeted in each campaign. To ensure protection of its

clients’ data, JaphSoft implements the technical and organizational measures it deems appropriate. JaphSoft works to continually improve its machine learning models by analyzing the data it receives from its clients to determine the most successful components of a successful campaign. JaphSoft then uses such models in providing services to its client-base. Since the models improve only over a period of time as more information is collected, JaphSoft does not have a deletion process for the data it receives from clients. However, to ensure compliance with data privacy rules, JaphSoft pseudonymizes the personal data by removing identifying

information from the contact information. JaphSoft’s engineers, however, maintain all contact information in the same database as the identifying information.

Under its agreement with Liem and EcoMick, JaphSoft received access to MarketIQ, which included contact information as well as prior purchase history for such contacts, to create campaigns that would result in the most views of the two companies’ websites. A prior Liem customer, Ms. Iman, received a marketing campaign from JaphSoft regarding Liem’s as well as EcoMick’s latest products. While Ms. Iman recalls checking a box to receive information in the future regarding Liem’s products, she has never shopped EcoMick, nor provided her personal data to that company.

Which of the following BEST describes the relationship between Liem, EcoMick and JaphSoft?

Options:

A.

Liem is a controller and EcoMick is a processor because Liem provides specific instructions regarding how the marketing campaigns should be rolled out.

B.

EcoMick and JaphSoft are is a controller and Liem is a processor because EcoMick is sharing its marketing data with Liem for contacts in Europe.

C.

JaphSoft is the sole processor because it processes personal data on behalf of its clients.

D.

Liem and EcoMick are joint controllers because they carry out joint marketing activities.

Buy Now
Questions 43

An organisation receives a request multiple times from a data subject seeking to exercise his rights with respect to his own personal data. Under what condition can the organisation charge the data subject for processing the request?

Options:

A.

Only where the organisation can show that it is reasonable to do so because more than one request was made.

B.

Only to the extent this is allowed under the restrictions on data subjects’ rights introduced under Art 23 of GDPR.

C.

Only where the administrative costs of taking the action requested exceeds a certain threshold.

D.

Only if the organisation can demonstrate that the request is clearly excessive or misguided.

Buy Now
Questions 44

What is the main task of the European Data Protection Board?

Options:

A.

To assess adequacy of data protection in third countries

B.

To ensure consistent application of the GDPR.

C.

To proactively prevent disputes between national supervisory authorities.

D.

To publish guidelines tor data subjects on how to property enforce their rights

Buy Now
Questions 45

MagicClean is a web-based service located in the United States that matches home cleaning services to customers. It otters its services exclusively in the United States It uses a processor located in France to optimize its data. Is MagicClean subject to the GDPR?

Options:

A.

Yes, because MagicClean is processing data in the EU

B.

Yes. because MagicClean's data processing agreement with the French processor is an establishment in the EU

C.

No, because MagicClean is located m the United States only.

D.

No. because MagicClean is not offering services to EU data subjects.

Buy Now
Questions 46

Through a combination of hardware failure and human error, the decryption key for a bank's customer account transaction database has been lost. An investigation has determined that this was not the result of hacking or malfeasance, simply an unfortunate combination of circumstances. Which of the following accurately indicates the nature of this incident?

Options:

A.

A data breach has not occurred because the loss was not the result of hacking.

B.

A data breach has not occurred because no data was exposed to any unauthorized individual.

C.

A data breach has occurred because the loss of the key has resulted in the data no longer being accessible.

D.

A data breach has occurred because the loss of the key has resulted in the loss of confidentiality or integrity of the data.

Buy Now
Questions 47

Article 5(1)(b) of the GDPR states that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.” Based on Article 5(1)(b),

what is the impact of a member state’s interpretation of the word “incompatible”?

Options:

A.

It dictates the level of security a processor must follow when using and storing personal data for two different purposes.

B.

It guides the courts on the severity of the consequences for those who are convicted of the intentional misuse of personal data.

C.

It sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data.

D.

It indicates the degree of flexibility a controller has in using personal data in ways that may vary from its original intended purpose.

Buy Now
Questions 48

Articles 13 and 14 of the GDPR provide details on the obligation of data controllers to inform data subjects when collecting personal data. However, both articles specify an exemption for situations in which the data subject already has the information.

Which other situation would also exempt the data controller from this obligation under Article 14?

Options:

A.

When providing the information would go against a police order.

B.

When providing the information would involve a disproportionate effort

C.

When the personal data was obtained through multiple source in the public domain

D.

When the personal data was obtained 5 years before the entry into force of the GDPR

Buy Now
Questions 49

The GDPR requires controllers to supply data subjects with detailed information about the processing of their data. Where a controller obtains data directly from data subjects, which of the following items of information does NOT legally have to be supplied?

Options:

A.

The recipients or categories of recipients.

B.

The categories of personal data concerned.

C.

The rights of access, erasure, restriction, and portability.

D.

The right to lodge a complaint with a supervisory authority.

Buy Now
Questions 50

Which of the following is an example of direct marketing that would be subject to European data protection laws?

Options:

A.

An updated privacy notice sent to an individual’s personal email address.

B.

A charity fundraising event notice sent to an individual at her business address.

C.

A service outage notification provided to an individual by recorded telephone message.

D.

A revision of contract terms conveyed to an individual by SMS from a marketing organization.

Buy Now
Questions 51

Under the Data Protection Law Enforcement Directive of the EU, a government can carry out covert investigations involving personal data, as long it is set forth by law and constitutes a measure that is both necessary and what?

Options:

A.

Prudent.

B.

Important.

C.

Proportionate.

D.

DPA-approved.

Buy Now
Questions 52

SCENARIO

Please use the following to answer the next question:

The fitness company Vigotron has recently developed a new app called M-Health, which it wants to market on its website as a free download. Vigotron’s marketing manager asks his assistant Emily to create a webpage that describes the app and specifies the terms of use. Emily, who is new at Vigotron, is excited about this task. At her previous job she took a data protection class, and though the details are a little hazy, she recognizes that Vigotron is going to need to obtain user consent for use of the app in some cases. Emily sketches out the following draft, trying to cover as much as possible before sending it to Vigotron’s legal department.

Registration Form

Vigotron’s new M-Health app makes it easy for you to monitor a variety of health-related activities, including diet, exercise, and sleep patterns. M-Health relies on your smartphone settings (along with other third-party apps you may already have) to collect data about all of these important lifestyle elements, and provide the information necessary for you to enrich your quality of life. (Please click here to read a full description of the services that M-Health provides.)

Vigotron values your privacy. The M-Heaith app allows you to decide which information is stored in it, and which apps can access your data. When your device is locked with a passcode, all of your health and fitness data is encrypted with your passcode. You can back up data stored in the Health app to Vigotron’s cloud provider, Stratculous. (Read more about Stratculous here.)

Vigotron will never trade, rent or sell personal information gathered from the M-Health app. Furthermore, we will not provide a customer’s name, email address or any other information gathered from the app to any third- party without a customer’s consent, unless ordered by a court, directed by a subpoena, or to enforce the manufacturer’s legal rights or protect its business or property.

We are happy to offer the M-Health app free of charge. If you want to download and use it, we ask that you

first complete this registration form. (Please note that use of the M-Health app is restricted to adults aged 16 or older, unless parental consent has been given to minors intending to use it.)

    First name:

    Surname:

    Year of birth:

    Email:

    Physical Address (optional*):

    Health status:

*If you are interested in receiving newsletters about our products and services that we think may be of interest to you, please include your physical address. If you decide later that you do not wish to receive these newsletters, you can unsubscribe by sending an email to unsubscribe@vigotron.com or send a letter with your request to the address listed at the bottom of this page.

Terms and Conditions

1.Jurisdiction. […]

2.Applicable law. […]

3.Limitation of liability. […]

Consent

By completing this registration form, you attest that you are at least 16 years of age, and that you consent to the processing of your personal data by Vigotron for the purpose of using the M-Health app. Although you are entitled to opt out of any advertising or marketing, you agree that Vigotron may contact you or provide you with any required notices, agreements, or other information concerning the services by email or other electronic means. You also agree that the Company may send automated emails with alerts regarding any problems with the M-Health app that may affect your well being.

If a user of the M-Health app were to decide to withdraw his consent, Vigotron would first be required to do what?

Options:

A.

Provide the user with logs of data collected through use of the app.

B.

Erase any data collected from the time the app was first used.

C.

Inform any third parties of the user’s withdrawal of consent.

D.

Cease processing any data collected through use of the app.

Buy Now
Questions 53

What is the most frequently used mechanism for legitimizing cross-border data transfer?

Options:

A.

Standard Contractual Clauses.

B.

Approved Code of Conduct.

C.

Binding Corporate Rules.

D.

Derogations.

Buy Now
Questions 54

Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?

Options:

A.

The group of undertakings must obtain approval from a supervisory authority.

B.

The group of undertakings must be comprised of organizations of similar sizes and functions.

C.

The data protection officer must be located in the country where the data controller has its main establishment.

D.

The data protection officer must be easily accessible from each establishment where the undertakings are located.

Buy Now
Questions 55

Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?

Options:

A.

Carry out an exercise that weighs the interests of the controller and the basis for the data subject’s objection.

B.

Consider the impact of the profiling on the data subject’s interest, rights and freedoms.

C.

Demonstrate that the profiling is for the purposes of direct marketing.

D.

Consider the importance of the profiling to their particular objective.

Buy Now
Questions 56

A company is located in a country NOT considered by the European Union (EU) to have an adequate level of data protection. Which of the following is an obligation of the company if it imports personal data from another organization in the European Economic Area (EEA) under standard contractual clauses?

Options:

A.

Submit the contract to its own government authority.

B.

Ensure that notice is given to and consent is obtained from data subjects.

C.

Supply any information requested by a data protection authority (DPA) within 30 days.

D.

Ensure that local laws do not impede the company from meeting its contractual obligations.

Buy Now
Questions 57

According to the European Data Protection Board, data subjects should be aware of any video surveillance in operation. How should a retail shop operator ensure that data subjects receive at information required for such a purpose under EU data protection law?

Options:

A.

The shop operator should post a copy of the manual of the video surveillance system in the shop and on its social media channels.

B.

The shop operator should provide full notice of the intended video surveillance outside the shop, for example with a sign or a stand-up display.

C.

The shop operator should instruct the data protection officer to hand out a comprehensive notice to data subjects every time they enter the shop.

D.

The shop operator should provide the most important information on a clearly readable warning sign to data subjects before they enter the monitored area, and additional mandatory details by other means.

Buy Now
Questions 58

Article 9 of the GDPR lists exceptions to the general prohibition against processing biometric data. Which of the following is NOT one of these exceptions?

Options:

A.

The processing is done by a non-profit organization and the results are disclosed outside the organization.

B.

The processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.

C.

The processing is necessary for the establishment, exercise or defense of legal claims when courts are acting in a judicial capacity.

D.

The processing is explicitly consented to by the data subject and he or she is allowed by Union or Member State law to lift the prohibition.

Buy Now
Questions 59

Which marketing-related activity is least likely to be covered by the provisions of Privacy and Electronic Communications Regulations (Directive 2002/58/EC)?

Options:

A.

Advertisements passively displayed on a website.

B.

The use of cookies to collect data about an individual.

C.

A text message to individuals from a company offering concert tickets for sale.

D.

An email from a retail outlet promoting a sale to one of their previous customer.

Buy Now
Questions 60

Start-up company MagicAl is developing an AI system that will be part of a medical device that detects skin cancer. To take measures against potential bias in its AI system, the IT team decides to collect data about users’ ethnic origin, nationality, and gender.

Which would be the most appropriate legal basis for this processing under GDPR, Article 9 (Processing of special categories of personal data)?

Options:

A.

Processing necessary for scientific or statistical purposes.

B.

Processing necessary for reasons of substantial public interest.

C.

Processing necessary for purposes of preventive or occupational medicine.

D.

Processing necessary for the defense of legal claims in potential negligence cases.

Buy Now
Questions 61

Why is advisable to avoid consent as a legal basis for an employer to process employee data?

Options:

A.

Employee data can only be processed if there is an approval from the data protection officer.

B.

Consent may not be valid if the employee feels compelled to provide it.

C.

An employer might have difficulty obtaining consent from every employee.

D.

Data protection laws do not apply to processing of employee data.

Buy Now
Questions 62

SCENARIO

Please use the following to answer the next question:

The fitness company Vigotron has recently developed a new app called M-Health, which it wants to market on its website as a free download. Vigotron’s marketing manager asks his assistant Emily to create a webpage that describes the app and specifies the terms of use. Emily, who is new at Vigotron, is excited about this task. At her previous job she took a data protection class, and though the details are a little hazy, she recognizes that Vigotron is going to need to obtain user consent for use of the app in some cases. Emily sketches out the following draft, trying to cover as much as possible before sending it to Vigotron’s legal department.

Registration Form

Vigotron’s new M-Health app makes it easy for you to monitor a variety of health-related activities, including diet, exercise, and sleep patterns. M-Health relies on your smartphone settings (along with other third-party apps you may already have) to collect data about all of these important lifestyle elements, and provide the information necessary for you to enrich your quality of life. (Please click here to read a full description of the services that M-Health provides.)

Vigotron values your privacy. The M-Heaith app allows you to decide which information is stored in it, and which apps can access your data. When your device is locked with a passcode, all of your health and fitness data is encrypted with your passcode. You can back up data stored in the Health app to Vigotron’s cloud provider, Stratculous. (Read more about Stratculous here.)

Vigotron will never trade, rent or sell personal information gathered from the M-Health app. Furthermore, we will not provide a customer’s name, email address or any other information gathered from the app to any third- party without a customer’s consent, unless ordered by a court, directed by a subpoena, or to enforce the manufacturer’s legal rights or protect its business or property.

We are happy to offer the M-Health app free of charge. If you want to download and use it, we ask that you

first complete this registration form. (Please note that use of the M-Health app is restricted to adults aged 16 or older, unless parental consent has been given to minors intending to use it.)

    First name:

    Surname:

    Year of birth:

    Email:

    Physical Address (optional*):

    Health status:

*If you are interested in receiving newsletters about our products and services that we think may be of interest to you, please include your physical address. If you decide later that you do not wish to receive these newsletters, you can unsubscribe by sending an email to unsubscribe@vigotron.com or send a letter with your request to the address listed at the bottom of this page.

Terms and Conditions

1.Jurisdiction. […]

2.Applicable law. […]

3.Limitation of liability. […]

Consent

By completing this registration form, you attest that you are at least 16 years of age, and that you consent to the processing of your personal data by Vigotron for the purpose of using the M-Health app. Although you are entitled to opt out of any advertising or marketing, you agree that Vigotron may contact you or provide you with any required notices, agreements, or other information concerning the services by email or other electronic means. You also agree that the Company may send automated emails with alerts regarding any problems with the M-Health app that may affect your well being.

Emily sends the draft to Sam for review. Which of the following is Sam most likely to point out as the biggest problem with Emily’s consent provision?

Options:

A.

It is not legal to include fields requiring information regarding health status without consent.

B.

Processing health data requires explicit consent, but the form does not ask for explicit consent.

C.

Direct marketing requires explicit consent, whereas the registration form only provides for a right to object

D.

The provision of the fitness app should be made conditional on the consent to the data processing for direct marketing.

Buy Now
Questions 63

According to Article 84 of the GDPR, the rules on penalties applicable to infringements shall be laid down by?

Options:

A.

The local Data Protection Supervisory Authorities.

B.

The European Data Protection Board.

C.

The EU Commission.

D.

The Member States.

Buy Now
Questions 64

After leaving the EU under the terms of Brexit, the United Kingdom will seek an adequacy determination. What is the reason for this?

Options:

A.

The Insurance Commissioner determined that an adequacy determination is required by the Data Protection Act.

B.

Adequacy determinations automatically lapse when a Member State leaves the EU.

C.

The UK is now a third country because it’s no longer subject to the GDPR.

D.

The UK is less trustworthy now that its not part of the Union.

Buy Now
Questions 65

Under Article 30 of the GDPR, controllers are required to keep records of all of the following EXCEPT?

Options:

A.

Incidents of personal data breaches, whether disclosed or not.

B.

Data inventory or data mapping exercises that have been conducted.

C.

Categories of recipients to whom the personal data have been disclosed.

D.

Retention periods for erasure and deletion of categories of personal data.

Buy Now
Questions 66

SCENARIO

Please use the following to answer the next question:

Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a few months ago. Although no one was hurt, Louis has been plagued by texts and calls from a company called Accidentable offering to help him recover compensation for personal injury. Louis has heard about insurance companies selling customers’ data to third parties, and he’s convinced that Accidentable must have gotten his information from Bedrock Insurance.

Louis has also been receiving an increased amount of marketing information from Bedrock, trying to sell him their full range of their insurance policies.

Perturbed by this, Louis has started looking at price comparison sites on the internet and has been shocked to find that other insurers offer much cheaper rates than Bedrock, even though he has been a loyal customer for many years. When his Bedrock policy comes up for renewal, he decides to switch to Zantrum Insurance.

In order to activate his new insurance policy, Louis needs to supply Zantrum with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask Bedrock to transfer his information directly to Zantrum. He also takes this opportunity to ask Bedrock to stop using his personal data for marketing purposes.

Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Louis it cannot transfer his data directly to Zantrum as this is not technically feasible. Bedrock also explains that Louis’s contract included a provision whereby Louis agreed that his data could be used for marketing purposes; according to Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which was filled with legal jargon and very confusing.

In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He writes to Accidentable to ask for the name of the organization that supplied his details to them. He warns Accidentable that he plans to complain to the data protection authority, because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.

Accidentable’s response letter confirms Louis’s suspicions. Accidentable is Bedrock Insurance’s wholly owned subsidiary, and they received information about Louis’s accident from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis that there has been no breach of the GDPR, as Louis’s contract included, a provision in which he agreed to share his information with Bedrock’s affiliates for business purposes.

Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them insisting that all his information be erased from their computer system.

After Louis has exercised his right to restrict the use of his data, under what conditions would Accidentable have grounds for refusing to comply?

Options:

A.

If Accidentable is entitled to use of the data as an affiliate of Bedrock.

B.

If Accidentable also uses the data to conduct public health research.

C.

If the data becomes necessary to defend Accidentable’s legal rights.

D.

If the accuracy of the data is not an aspect that Louis is disputing.

Buy Now
Questions 67

Pursuant to the EDPB Guidelines 8/2022, all of the following criteria must be considered when identifying a lead supervisory authority of a controller EXCEPT?

Options:

A.

Determining where the controller has its place of central administration in the EEA.

B.

Determining the supervisory authority where the place of central administration of the controller is located.

C.

Determining the supervisory authority according to what has been identified by the controller as the authority to which data subjects can lodge complaints.

D.

Determining if decisions on the processing are taken in another establishment in the EEA, and if that establishment has the power to implement those decisions.

Buy Now
Questions 68

A company is hesitating between Binding Corporate Rules and Standard Contractual Clauses as a global data transfer solution. Which of the following statements would help the company make an effective decision?

Options:

A.

Binding Corporate Rules are especially recommended for small and medium companies.

B.

The data exporter does not need to be located in the EU for the standard Contractual Clauses.

C.

Binding Corporate Rules provide a global solution for all the entities of a company that are bound by the intra-group agreement.

D.

The company will need the prior authorization of all EU data protection authorities for concluding Standard Contractual Clauses.

Buy Now
Questions 69

SCENARIO

Please use the following to answer the next question:

Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy company operating in every continent. All of the company’s IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father’s company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.

Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company’s online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers’ philosophical beliefs, political opinions and marital status.

If a customer identifies as single, Ben then copies all of that customer’s personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.

Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.

Joe also hires his best friend’s daughter, Alice, who just graduated from law school in the U.S., to be the company’s new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company’s operations in the European Union to the U.S.

Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company’s IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone’s information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.

Ben’s collection of additional data from customers created several potential issues for the company, which would most likely require what?

Options:

A.

New corporate governance and code of conduct.

B.

A data protection impact assessment.

C.

A comprehensive data inventory.

D.

Hiring a data protection officer.

Buy Now
Questions 70

When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?

Options:

A.

When the data has been pseudonymized.

B.

When the data is protected by technological safeguards.

C.

When the data serves legitimate interest of third parties.

D.

When the data subject has failed to use a provided opt-out mechanism.

Buy Now
Questions 71

In 2016’s Guidance, the United Kingdom’s Information Commissioner’s Office (ICO) reaffirmed the importance of using a “layered notice” to provide data subjects with what?

Options:

A.

A privacy notice containing brief information whilst offering access to further detail.

B.

A privacy notice explaining the consequences for opting out of the use of cookies on a website.

C.

An explanation of the security measures used when personal data is transferred to a third party.

D.

An efficient means of providing written consent in member states where they are required to do so.

Buy Now
Questions 72

SCENARIO

Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a few months ago. Although no one was hurt, Louis has been plagued by texts and calls from a company called Accidentable offering to help him recover compensation for personal injury. Louis has heard about insurance companies selling customers’ data to third parties, and he’s convinced that Accidentable must have gotten his information from Bedrock Insurance.

Louis has also been receiving an increased amount of marketing information from Bedrock, trying to sell him their full range of their insurance policies.

Perturbed by this, Louis has started looking at price comparison sites on the internet and has been shocked to find that other insurers offer much cheaper rates than Bedrock, even though he has been a loyal customer for many years. When his Bedrock policy comes up for renewal, he decides to switch to Zantrum Insurance.

In order to activate his new insurance policy, Louis needs to supply Zantrum with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask Bedrock to transfer his information directly to Zantrum. He also takes this opportunity to ask Bedrock to stop using his personal data for marketing purposes.

Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Louis it cannot transfer his data directly to Zantrum as this is not technically feasible. Bedrock also explains that Louis’s contract included a provision whereby Louis agreed that his data could be used for marketing purposes; according to Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which was filled with legal jargon and very confusing.

In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He writes to Accidentable to ask for the name of the organization that supplied his details to them. He warns Accidentable that he plans to complain to the data protection authority, because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.

Accidentable’s response letter confirms Louis’s suspicions. Accidentable is Bedrock Insurance’s wholly owned subsidiary, and they received information about Louis’s accident from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis that there has been no breach of the GDPR, as Louis’s contract included, a provision in which he agreed to share his information with Bedrock’s affiliates for business purposes.

Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them insisting that all his information be erased from their computer system.

Based on the GDPR’s position on the use of personal data for direct marketing purposes, which of the following is true about Louis’s rights as a data subject?

Options:

A.

Louis does not have the right to object to the use of his data because he previously consented to it.

B.

Louis has the right to object at any time to the use of his data and Bedrock must honor his request to cease use.

C.

Louis has the right to object to the use of his data, unless his data is required by Bedrock for the purpose

of exercising a legal claim.

D.

Louis does not have the right to object to the use of his data if Bedrock can demonstrate compelling legitimate grounds for the processing.

Buy Now
Questions 73

SCENARIO

Please use the following to answer the next question:

Liem, an online retailer known for its environmentally friendly shoes, has recently expanded its presence in Europe. Anxious to achieve market dominance, Liem teamed up with another eco friendly company, EcoMick, which sells accessories like belts and bags. Together the companies drew up a series of marketing campaigns designed to highlight the environmental and economic benefits of their products. After months of planning, Liem and EcoMick entered into a data sharing agreement to use the same marketing database, MarketIQ, to send the campaigns to their respective contacts.

Liem and EcoMick also entered into a data processing agreement with MarketIQ, the terms of which included processing personal data only upon Liem and EcoMick’s instructions, and making available to them all information necessary to demonstrate compliance with GDPR obligations.

Liem and EcoMick then procured the services of a company called JaphSoft, a marketing optimization firm that uses machine learning to help companies run successful campaigns. Clients provide JaphSoft with the personal data of individuals they would like to be targeted in each campaign. To ensure protection of its

clients’ data, JaphSoft implements the technical and organizational measures it deems appropriate. JaphSoft works to continually improve its machine learning models by analyzing the data it receives from its clients to determine the most successful components of a successful campaign. JaphSoft then uses such models in providing services to its client-base. Since the models improve only over a period of time as more information is collected, JaphSoft does not have a deletion process for the data it receives from clients. However, to ensure compliance with data privacy rules, JaphSoft pseudonymizes the personal data by removing identifying

information from the contact information. JaphSoft’s engineers, however, maintain all contact information in the same database as the identifying information.

Under its agreement with Liem and EcoMick, JaphSoft received access to MarketIQ, which included contact information as well as prior purchase history for such contacts, to create campaigns that would result in the most views of the two companies’ websites. A prior Liem customer, Ms. Iman, received a marketing campaign from JaphSoft regarding Liem’s as well as EcoMick’s latest products. While Ms. Iman recalls checking a box to receive information in the future regarding Liem’s products, she has never shopped EcoMick, nor provided her personal data to that company.

JaphSoft’s use of pseudonymization is NOT in compliance with the CDPR because?

Options:

A.

JaphSoft failed to first anonymize the personal data.

B.

JaphSoft pseudonymized all the data instead of deleting what it no longer needed.

C.

JaphSoft was in possession of information that could be used to identify data subjects.

D.

JaphSoft failed to keep personally identifiable information in a separate database.

Buy Now
Questions 74

A private company has establishments in France, Poland, the United Kingdom, and most prominently, Germany, where its headquarters is established. The company offers its services worldwide. Most of the services are designed in Germany and supported in the other establishments. However, one of the services, a Software as a Service (SaaS) application, was defined and implemented by the Polish establishment. It is also supported by the other establishments.

What is the lead supervisory authority for the SaaS service?

Options:

A.

The supervisory authority of Germany at the federal level.

B.

The supervisory authority of Germany at the regional level.

C.

The supervisory authority of the Republic of Poland.

D.

The supervisory authority of the European Union.

Buy Now
Questions 75

A company in France suffers a robbery over the weekend owing to a faulty alarm system. When it is determined that the break-in involves the loss of a substantial amount of data, the company decides on a CCTV system to monitor for future incidents. Company technicians install cameras in the entrance of the building, hallways and offices. Footage is recorded continuously, and is monitored by the home office in the United States. What is the most realistic step the company could take to address their security concerns and comply with the personal data processing principles set out in Article 5 of the GDPR?

Options:

A.

Seek informed consent from company employees.

B.

Have cameras recording during work hours only.

C.

Retain captured footage for no more than 30 days.

D.

Restrict camera placement to building entrances only.

Buy Now
Questions 76

Which kind of privacy notice, originally advocated by the Article 29 Working Party, is commonly recommended tor Al-based technologies because of the way it provides processing information at specific points of data collection?

Options:

A.

Privacy dashboard notice

B.

Visualization notice.

C.

Just-in-lime notice.

D.

Layered notice.

Buy Now
Questions 77

Which mechanism, introduced by the GDPR as a means of ensuring both compliance and transparency, allows for the possibility of personal data transfers to third countries under Article 42?

Options:

A.

Approved certifications.

B.

Binding corporate rules.

C.

Law enforcement requests.

D.

Standard contractual clauses.

Buy Now
Questions 78

SCENARIO

Please use the following to answer the next question:

Jane starts her new role as a Data Protection Officer (DPO) at a Malta-based

company that allows anyone to buy and sell cryptocurrencies via its online platform.

The company stores and processes the personal data of its customers in a

dedicated data center located in Malta (EU).

People wishing to trade cryptocurrencies are required to open an online account on

the platform. They then must successfully pass a Know Your Customer (KYC) due

diligence procedure aimed at preventing money laundering and ensuring

compliance with applicable financial regulations.

The non-European customers are also required to waive all their GDPR rights by

reading a disclaimer written in bold and ticking a checkbox on a separate page in

order to get their account approved on the platform.

All customers must likewise accept the terms of service of the platform. The terms

of service also include a privacy policy section, saying, among other things, that if a

customer fails the KYC process, its KYC data will be automatically shared with the

national anti-money laundering agency.

The KYC procedure requires customers to answer many questions, including

whether they have any criminal convictions, whether they use recreational drugs or

have problems with alcohol, and whether they have a terminal illness. While

providing this data, customers see a conspicuous message saying that this data is

meant only to prevent fraud and account takeover, and will be never shared with

private third parties.

The company regularly conducts external security testing of its online systems by

independent cybersecurity companies from the EU. At the final stage of testing, the

company provides cybersecurity assessors with access to its central database to

review security permissions, roles and policies. Personal data in the database is

encrypted; however, cybersecurity assessors usually have access to the decryption

keys obtained while running initial security testing. The assessors must strictly

follow the guidelines imposed by the company during the entire testing and auditing

process.

All customer data, including trading activities and all internal communications with

technical support, are permanently stored in a secured AWS S3 Glacier cloud data

storage, located in Ireland, for backup and compliance purposes. The data is

securely transferred to the cloud and then is properly encrypted while at rest by

using AWS-native encryption mechanisms. These mechanisms give AWS the

necessary technical means to encrypt and decrypt the data when such is required

by the company. There is no data processing agreement between AWS and the

company.

Should Jane modify the required GDPR rights waiver for non-European residents?

Options:

A.

Yes, the waiver must not apply to any residents of countries with an adequacy decision from the EC.

B.

Yes, this clause must be entirely removed as all customers,

regardless of residence or nationality, shall enjoy the same individual rights granted under GDPR.

C.

No, the non-EU residents are not protected by GDPR unless they are physically located in the EU.

D.

No, but all non-EU residents must manually sign a separate waiver to ensure its lawfulness and enforceability under GDPR.

Buy Now
Questions 79

Higher fines are assessed for GDPR violations due to which of the following?

Options:

A.

Failure to notify a supervisory authority and data subjects of a personal data breach

B.

Violations of a data controller's obligations to obtain a child's consent

C.

Failure to appoint a data protection officer.

D.

Violations of a data subject"s rights

Buy Now
Questions 80

Which of the following does NOT have to be included in the records most processors must maintain in relation to their data processing activities?

Options:

A.

Name and contact details of each controller on behalf of which the processor is acting.

B.

Categories of processing carried out on behalf of each controller for which the processor is acting.

C.

Details of transfers of personal data to a third country carried out on behalf of each controller for which the processor is acting.

D.

Details of any data protection impact assessment conducted in relation to any processing activities carried out by the processor on behalf of each controller for which the processor is acting.

Buy Now
Questions 81

SCENARIO

Please use the following to answer the next question:

BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information – name, location, and prior purchase history – with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.

Prior to sharing its customer list, BHealthy conducted a review of Natural Insight’s security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy’s data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight’s machine learning algorithms.

What is the nature of BHealthy and Natural Insight’s relationship?

Options:

A.

Natural Insight is BHealthy’s processor because the companies entered into data processing terms.

B.

Natural Insight is BHealthy’s processor because BHealthy is sharing its customer information with Natural Insight.

C.

Natural Insight is the controller because it determines the security measures to implement to protect data it processes; BHealthy is a co-controller because it engaged Natural Insight to determine pricing for the new sunscreens.

D.

Natural Insight is a controller because it is separately determine the purpose of processing when it uses BHealthy’s customer information to improve its machine learning algorithms.

Buy Now
Questions 82

SCENARIO

Please use the following to answer the next question:

Gentle Hedgehog Inc. is a privately owned website design agency incorporated in

Italy. The company has numerous remote workers in different EU countries. Recently,

the management of Gentle Hedgehog noticed a decrease in productivity of their sales

team, especially among remote workers. As a result, the company plans to implement

a robust but privacy-friendly remote surveillance system to prevent absenteeism,

reward top performers, and ensure the best quality of customer service when sales

people are interacting with customers.

Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employee

surveillance software whose European headquarters is in Germany. Sauron Eye's

software provides powerful remote-monitoring capabilities, including 24/7 access to

computer cameras and microphones, screen captures, emails, website history, and

keystrokes. Any device can be remotely monitored from a central server that is

securely installed at Gentle Hedgehog headquarters. The monitoring is invisible by

default; however, a so-called Transparent Mode, which regularly and conspicuously

notifies all users about the monitoring and its precise scope, also exists. Additionally,

the monitored employees are required to use a built-in verification technology

involving facial recognition each time they log in.

All monitoring data, including the facial recognition data, is securely stored in Microsoft Azure cloud servers operated by Sauron Eye, which are physically located in France.

Under what condition could the surveillance system be used on the personal devices

of employees?

Options:

A.

Only if the monitoring system is manufactured by a European vendor storing the monitoring data within the EU.

B.

Only if the employees give valid consent and the monitoring is narrowly limited to their professional tasks.

C.

Only if the cloud that stores the monitoring data is certified by the EDPB as GDPR compliant.

D.

Only if the employer offers an adequate compensation for using the employee's devices.

Buy Now
Questions 83

When is data sharing agreement MOST likely to be needed?

Options:

A.

When anonymized data is being shared.

B.

When personal data is being shared between commercial organizations acting as joint data controllers.

C.

When personal data is being proactively shared by a controller to support a police investigation.

D.

When personal data is being shared with a public authority with powers to require the personal data to be disclosed.

Buy Now
Questions 84

How can the relationship between the GDPR and the Digital Services Act, the Data Governance Act and the Digital Markets Act most accurately be described?

Options:

A.

The aforementioned legal acts do not refer to (i.e., do not mention) the GDPR.

B.

The aforementioned legal acts apply without prejudice (i.e., in parallel) to the GDPR.

C.

The aforementioned legal acts change specific provisions (i.e., certain articles) of the GDPR.

D.

The aforementioned legal acts contain some sector-specific exemptions (i.e., only for certain businesses) from the GDPR.

Buy Now
Questions 85

What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?

Options:

A.

ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.

B.

CJEU can force national governments to implement and honor EU law, while the ECHR cannot.

C.

CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.

D.

ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.

Buy Now
Questions 86

According to the European Data Protection Board, controllers responding to a data subject access request can refuse to provide a copy of personal data under certain conditions. Which of the following is NOT one of these conditions?

Options:

A.

If the data subject access request was sent to an employee that is not involved in the processing of such requests.

B.

If there is such a large amount of data that the controller cannot identify the data subject of the request.

C.

If the controller is unable to use end-to-end encrypted emails for responding to such requests.

D.

If the personal data was processed in the past but is no longer at the controller's disposal at the time of the request.

Buy Now
Questions 87

After detecting an intrusion involving the theft of unencrypted personal data, who shall the breached company notify first under GDPR requirements?

Options:

A.

Any parents of children whose personal data was compromised.

B.

Any affected customers whose data was compromised.

C.

A competent supervisory authority.

D.

A local law enforcement agency

Buy Now
Questions 88

Which judicial body makes decisions on actions taken by individuals wishing to enforce their rights under EU law?

Options:

A.

Court of Auditors

B.

Court of Justice of European Union

C.

European Court of Human Rights

D.

European Data Protection Board

The Court of Justice of the European Union (CJEU) is the judicial body of the EU that makes decisions on issues of EU law and enforces European decisions either in respect to actions taken by the European Commission against a member state or actions taken by individuals to enforce their rights under EU law. The CJEU consists of two courts: the Court of Justice and the General Court. The CJEU ensures the

Buy Now
Exam Code: CIPP-E
Exam Name: Certified Information Privacy Professional/Europe (CIPP/E)
Last Update: Apr 2, 2025
Questions: 295

PDF + Testing Engine

$49.5  $164.99

Testing Engine

$37.5  $124.99
buy now CIPP-E testing engine

PDF (Q&A)

$31.5  $104.99
buy now CIPP-E pdf
dumpsmate guaranteed to pass
24/7 Customer Support

DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.

Site Secure

mcafee secure

TESTED 02 Apr 2025