Prepare Top IAPP CIPP-E Exam Study Guide Practice Questions Edition [Q171-Q195]

Prepare Top IAPP CIPP-E Exam Study Guide Practice Questions Edition

Go to CIPP-E Questions - Try CIPP-E dumps pdf

IAPP CIPP-E certification exam is a valuable credential for privacy professionals who work in Europe or with European data. CIPP-E exam is designed to test the candidate’s knowledge of GDPR and data protection principles, and is offered by the world’s largest association of privacy professionals. Certified Information Privacy Professional/Europe (CIPP/E) certification is valid for three years and can be renewed by earning continuing education credits.

The IAPP CIPP-E exam consists of 90 multiple-choice questions and lasts for two and a half hours. To pass the exam, candidates must score at least 300 out of 500 points. CIPP-E exam is available in multiple languages, including English, French, German, Italian, and Spanish.

NEW QUESTION # 171
Which of the following would NOT be relevant when determining if a processing activity would be considered profiling?

A. If the processing is used to predict the behavior of data subjects
B. If the processing is to be performed by a third-party vendor
C. If the processing of the data is done through automated means
D. If the processing involves data that is considered personal data

Answer: A

NEW QUESTION # 172
SCENARIO
Please use the following to answer the next question:
Javier is a member of the fitness club EVERFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Javier lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Javier was photographed while working out at a branch of EVERFIT in Frankfurt, Germany. At the time, Javier gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Javier no longer feels comfortable with his photograph being publicly associated with the fitness club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Javier sends a letter to EVETFIT requesting that his image be removed from the website and all promotional materials. Months pass and Javier, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact EVETFIT through alternate channels, he decides to take action against the company.
Javier contacts the U.K. Information Commissioner's Office ('ICO' - the U.K.'s supervisory authority) to lodge a complaint about this matter. The ICO, pursuant to Article 56 (3) of the GDPR, informs the CNIL (i.e. the supervisory authority of EVERFIT's main establishment) about this matter. Despite the fact that EVERFIT has an establishment in the U.K., the CNIL decides to handle the case in accordance with Article 60 of the GDPR. The CNIL liaises with the ICO, as relevant under the cooperation procedure. In light of issues amongst the supervisory authorities to reach a decision, the European Data Protection Board becomes involved and, pursuant to the consistency mechanism, issues a binding decision.
Additionally, Javier sues EVERFIT for the damages caused as a result of its failure to honor his request to have his photograph removed from the brochure and website.
Assuming that multiple EVETFIT branches across several EU countries are acting as separate data controllers, and that each of those branches were responsible for mishandling Javier's request, how may Javier proceed in order to seek compensation?

A. He will have to sue each EVETFIT branch so that each branch provides proportionate compensation commensurate with its contribution to the damage or distress suffered by Javier.
B. He will be able to sue any one of the relevant EVETFIT branches, as each one may be held liable for the entire damage.
C. He will be able to apply to the European Data Protection Board in order to determine which particular EVETFIT branch is liable for damages, based on the decision that was made by the board.
D. He will have to sue the EVETFIT's head office in France, where EVETFIT has its main establishment.

Answer: B

NEW QUESTION # 173
Under the GDPR, where personal data is not obtained directly from the data subject, a controller is exempt from directly providing information about processing to the data subject if?

A. The processing of the data subject's data is protected by appropriate technical measures
B. Third-party data would be disclosed by providing such information to the data subject
C. The provision of such information to the data subject would be too problematic
D. The data subject already has information regarding how his data will be used

Answer: D

Explanation:
Reference https://dataprivacymanager.net/gdpr-exemptions-from-the-obligation-to-provide-information-to-the- individual-data-subject/

NEW QUESTION # 174
Which marketing-related activity is least likely to be covered by the provisions of Privacy and Electronic Communications Regulations (Directive 2002/58/EC)?

A. Advertisements passively displayed on a website.
B. An email from a retail outlet promoting a sale to one of their previous customer.
C. A text message to individuals from a company offering concert tickets for sale.
D. The use of cookies to collect data about an individual.

Answer: B

Explanation:
Reference https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058- 20091219&from=RO

NEW QUESTION # 175
A multinational company is appointing a mandatory data protection officer. In addition to considering the rules set out in Article 37 (1) of the GDPR, which of the following actions must the company also undertake to ensure compliance in all EU jurisdictions in which it operates?

A. Assess whether the company has more than 250 employees in each of the EU member-states in which it is established.
B. Consult national derogations to evaluate if there are additional cases to be considered in relation to the matter.
C. Conduct a Data Protection Privacy Assessment on the processing operations of the company in all the countries it operates.
D. Revise the data processing activities of the company that affect more than one jurisdiction to evaluate whether they comply with the principles of privacy by design and by default.

Answer: B

Explanation:
A multinational company that is appointing a mandatory data protection officer (DPO) must also consult national derogations to evaluate if there are additional cases to be considered in relation to the matter. According to Article 37 (1) of the GDPR, a DPO must be designated by the controller or the processor in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or the core activities of the controller or the processor consist of processing on a large scale of special categories of data or personal data relating to criminal convictions and offences 1. However, Article 37 (4) of the GDPR also allows Member States to provide for additional cases where a DPO must be designated by law 1. Therefore, a multinational company must consult the national laws of the EU jurisdictions in which it operates to ensure that it complies with any additional requirements for appointing a DPO.
The other options are not correct because they are not directly related to the appointment of a DPO. Conducting a Data Protection Privacy Assessment, assessing the number of employees, and revising the data processing activities are all good practices for ensuring compliance with the GDPR, but they are not mandatory actions for designating a DPO. Moreover, the number of employees is not a relevant criterion for appointing a DPO, as the GDPR does not set any threshold based on the size of the organization 2. Reference: 1: Article 37 of the GDPR 2: Guidelines on Data Protection Officers ('DPOs')

NEW QUESTION # 176
To comply with the GDPR and the EU Court of Justice's decision in Schrems II, the European Commission issued what are commonly referred to as the new standard contractual clauses (SCCs). As a result, businesses must do all of the following EXCEPT?

A. Implement the new SCCs in the U.K. following Brexit, as the U.K. Information Commissioner's Office does not have the authority to publish its own set of SCCs.
B. Consider the new optional docking clause, which expressly permits adding new parties to the SCCs.
C. Migrate all contracts entered into before September 27, 2021, that use the old SCCs to the new SCCs by December 27, 2022.
D. Take steps to flow down the new SCCs to relevant parts of their supply chain using the new SCCs as of September 27, 2021, if the business is a data importer.

Answer: A

Explanation:
The General Data Protection Regulation (GDPR) introduces a mechanism for personal data transfers to third countries or international organisations that do not ensure an adequate level of data protection, based on approved certifications. According to Article 46 of the GDPR, contractual clauses ensuring appropriate data protection safeguards can be used as a ground for data transfers from the EU to third countries. This includes model contract clauses - so-called standard contractual clauses (SCCs) - that have been "pre-approved" by the European Commission.
On 4 June 2021, the Commission issued modernised standard contractual clauses under the GDPR for data transfers from controllers or processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established outside the EU/EEA (and not subject to the GDPR). These modernised SCCs replace the three sets of SCCs that were adopted under the previous Data Protection Directive 95/46. The Commission developed Questions and Answers (Q&As) to provide practical guidance on the use of the SCCs and assist stakeholders in their compliance efforts under the GDPR.
The Q&As state that businesses must do all of the following:
Consider the new optional docking clause, which expressly permits adding new parties to the SCCs. According to the Q&As, the docking clause allows controllers and processors that are not part of the original contract to accede to the SCCs at a later stage, either as data exporters or importers. This clause is intended to facilitate the use of the SCCs in complex processing chains and to avoid the need to enter into multiple contracts.
Migrate all contracts entered into before September 27, 2021, that use the old SCCs to the new SCCs by December 27, 2022. According to the Q&As, the old SCCs will be repealed on September 27, 2021. However, contracts concluded before that date on the basis of the old SCCs will remain valid until December 27, 2022, provided that the processing operations that are the subject matter of the contract remain unchanged and that reliance on those clauses ensures that the transfer of personal data is subject to appropriate safeguards within the meaning of Article 46(1) of the GDPR. After December 27, 2022, the old SCCs will no longer provide a valid legal basis for data transfers to third countries, and the new SCCs will have to be used instead.
Take steps to flow down the new SCCs to relevant parts of their supply chain using the new SCCs as of September 27, 2021, if the business is a data importer. According to the Q&As, the new SCCs require data importers to enter into contracts with any subprocessors that process the personal data transferred under the SCCs, and to include in those contracts the same data protection obligations as those imposed on the data importer under the SCCs. This means that data importers must ensure that the new SCCs are flowed down to their subprocessors as of September 27, 2021, and that any changes in the subprocessors are notified to the data exporter, who has the right to object.
The Q&As do not state that businesses must do the following:
Implement the new SCCs in the U.K. following Brexit, as the U.K. Information Commissioner's Office does not have the authority to publish its own set of SCCs. This is not a valid statement, as the U.K. has its own data protection regime after leaving the EU, and the U.K. Information Commissioner's Office (ICO) has the power to issue its own SCCs for data transfers from the U.K. to third countries. According to the ICO website, the ICO is currently developing bespoke U.K. SCCs, which will be subject to a public consultation and an opinion from the European Data Protection Board (EDPB). Until the U.K. SCCs are finalised, the ICO advises businesses to continue to use the EU SCCs for new contracts, as these clauses have been recognised as a valid transfer mechanism under the U.K. data protection law. However, the ICO also warns businesses that they may need to amend the EU SCCs to reflect that the U.K. is no longer an EU member state, and that they will need to update their contracts to the U.K. SCCs once they are available.
Reference:
GDPR, Articles 3, 4, 28, 29, 32, 44, 45, 46, 47, 48 and 49.
New Standard Contractual Clauses - Questions and Answers overview, paragraphs 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 and 11.
Standard Contractual Clauses (SCC), paragraphs 1, 2, 3, 4, 5, 6, 7 and 8.
[Using international data transfers], paragraphs 1, 2, 3, 4, 5, 6, 7, 8, 9 and 10.

NEW QUESTION # 177
Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC). Why is the Directive no longer part of EU law?

A. The Directive was annulled by the European Court of Human Rights.
B. The Directive was annulled by the Court of Justice of the European Union.
C. The Directive was superseded by the EU Directive on Privacy and Electronic Communications.
D. The Directive was superseded by the General Data Protection Regulation.

Answer: B

Explanation:
The Data Retention Directive (2006/24/EC) was a legal framework that required Member States to ensure that providers of publicly available electronic communications services or of public communications networks retained certain data for a period of between six months and two years, for the purpose of the prevention, investigation, detection and prosecution of serious crime1. However, on 8 April 2014, the Court of Justice of the European Union (CJEU) declared the Directive invalid, as it entailed a wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, without limiting the access of the competent national authorities to the data retained to what was strictly necessary2. The CJEU also found that the Directive did not provide sufficient safeguards to ensure effective protection of the data against the risk of abuse and against any unlawful access and use of the data2. Therefore, the Directive is no longer part of EU law.
Reference:
Directive 2006/24/EC of the European Parliament and of the Council
Court of Justice of the European Union PRESS RELEASE No 54/14
I hope this helps you understand the GDPR and data retention better. If you have any other questions, please feel free to ask me.

NEW QUESTION # 178
The transparency principle is most directly related to which of the following rights?

A. Right to be informed.
B. Right to restriction of processing.
C. Right to be forgotten.
D. Right to object

Answer: A

NEW QUESTION # 179
Articles 13 and 14 of the GDPR provide details on the obligation of data controllers to inform data subjects when collecting personal dat a. However, both articles specify an exemption for situations in which the data subject already has the information.
Which other situation would also exempt the data controller from this obligation under Article 14?

A. When providing the information would involve a disproportionate effort
B. When the personal data was obtained through multiple source in the public domain
C. When the personal data was obtained 5 years before the entry into force of the GDPR
D. When providing the information would go against a police order.

Answer: A

Explanation:
According to Article 14 of the GDPR, the data controller must provide the data subject with certain information when collecting personal data from a source other than the data subject1. However, there are some exceptions to this obligation, such as when the data subject already has the information, or when the provision of such information proves impossible or would involve a disproportionate effort2. The latter exception may apply, for example, when the personal data are collected from a large number of sources, or when the personal data are processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes3. The data controller must take appropriate measures to protect the data subject's rights and interests, and make the information publicly available2. Reference: 1: Art. 14 GDPR - Information to be provided where personal data have not been obtained from the data subject2: Article 14(5)(b) of the GDPR3: Recital 62 of the GDPR.

NEW QUESTION # 180
What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?

A. CJEU can force national governments to implement and honor EU law, while the ECHR cannot.
B. CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.
C. ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.
D. ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.

Answer: A

Explanation:
The ECHR and the CJEU are part of two different legal systems: the Council of Europe and the European Union, respectively. The ECHR is a treaty that guarantees human rights and fundamental freedoms to individuals within the jurisdiction of its 47 member states. The CJEU is the judicial branch of the EU that ensures the uniform interpretation and application of EU law within its 27 member states. The ECHR can only hear complaints from individuals or states alleging violations of the rights enshrined in the convention, and it can only issue judgments that are binding on the respondent state. The CJEU, on the other hand, can hear cases from individuals, states, EU institutions, or national courts on any matter of EU law, and it can issue rulings that are binding on all EU member states and institutions. The CJEU can also impose sanctions or penalties on states that fail to comply with its judgments or EU law in general. Therefore, the CJEU has more power and authority to enforce EU law than the ECHR has to enforce human rights law. Reference: CIPP/E Certification, ECHR and the CJEU, The UK, the EU and a British Bill of Rights

NEW QUESTION # 181
SCENARIO
Please use the following to answer the next question:
Zandelay Fashion ('Zandelay') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures. Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay's business plan and associated processing activities.
What must Zandelay provide to the supervisory authority during the prior consultation?

A. Records showing that customers have explicitly consented to the intended profiling activities.
B. An explanation of the purposes and means of the intended processing.
C. Certificates that prove Martin's professional qualities and expert knowledge of data protection law.
D. An evaluation of the complexity of the intended processing.

Answer: B

NEW QUESTION # 182
Start-up company MagicAI is developing an AI system that will be part of a medical device that detects skin cancer. To take measures against potential bias in its AI system, the IT Team decides to collect data about users' ethnic origin, nationality, and gender.
Which would be the most appropriate legal basis for this processing under the GDPR, Article 9 (Processing of special categories of personal data)?

A. Processing necessary for the defense of legal claims in potential negligence cases.
B. Processing necessary for purposes of preventive or occupational medicine.
C. Processing necessary for reasons of substantial public interest.
D. Processing necessary for scientific or statistical purposes.

Answer: D

Explanation:
Article 9 of the GDPR outlines strict conditions for processing special categories of personal data, which includes data revealing racial or ethnic origin. While options B, C, and D might seem relevant, they don't fully align with the core purpose of MagicAI's data collection.
Here's why option A is the most appropriate:
Scientific Research: MagicAI aims to improve the accuracy and fairness of its AI system by understanding how it performs across different ethnicities, nationalities, and genders. This directly ties into scientific research aimed at improving healthcare and reducing bias in medical technology.
It's important to note that even with "scientific research" as the legal basis, MagicAI must still adhere to strict safeguards, such as:
Data Minimization: Collecting only the data absolutely necessary for the research.
Purpose Limitation: Using the data solely for the defined scientific purpose.
Appropriate Security Measures: Protecting the data against unauthorized access or disclosure.
Ethical Review: Ideally, obtaining ethical approval for the research project.
References:
GDPR Article 9 - Processing of special categories of personal data
GDPR Recital 159 - Conditions for processing special categories of data for scientific research purposes IAPP CIPP/E textbook, Chapter 2: Key Data Protection Principles (specifically, sections on special categories of data)

NEW QUESTION # 183
Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3?

A. The behavior of EU citizens outside the EU being monitored by non-EU law enforcement bodies.
B. Personal data of EU citizens being processed by a controller or processor based outside the EU.
C. The behavior of suspected terrorists being monitored by EU law enforcement bodies.
D. Personal data of EU residents being processed by a non-EU business that targets EU customers.

Answer: B

Explanation:
According to Article 3(1) of the GDPR1, personal data shall be processed in any member state only on the basis of a decision taken at a Union level that is binding for that member state, unless it is derogated from by national law. This means that the GDPR applies to any processing of personal data within the EU, regardless of where the controller or processor is located, as long as it is based on a decision made at a Union level that is binding for that member state.
Therefore, option B would most likely trigger the extraterritorial effect of the GDPR, as it involves personal data of EU citizens being processed by a controller or processor based outside the EU, which may be subject to a decision made at a Union level that is binding for that member state.
Option A would not trigger the extraterritorial effect of the GDPR, as it involves monitoring suspected terrorists, which is not considered processing under Article 4(1) and (2) of the GDPR1. Monitoring may fall under other legal frameworks, such as national security or counter-terrorism laws.
Option C would not trigger the extraterritorial effect of the GDPR, as it involves monitoring EU citizens outside the EU by non-EU law enforcement bodies, which may not be subject to any decision made at a Union level that is binding for that member state.
Option D would not trigger the extraterritorial effect of the GDPR, as it involves processing personal data of EU residents by a non-EU business that targets EU customers, which may not be subject to any decision made at a Union level that is binding for that member state.
References: 1: Free CIPP/E Study Guide - International Association of Privacy Professionals.
Reference: https://hsfnotes.com/data/2019/12/02/edpb-adopts-final-guidelines-on-gdpr-extra-territoriality/

NEW QUESTION # 184
Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3?

A. The behavior of EU citizens outside the EU being monitored by non-EU law enforcement bodies.
B. Personal data of EU citizens being processed by a controller or processor based outside the EU.
C. The behavior of suspected terrorists being monitored by EU law enforcement bodies.
D. Personal data of EU residents being processed by a non-EU business that targets EU customers.

Answer: B

NEW QUESTION # 185
SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
* Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
* Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
* Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees.
These records are available to former students after registering through Granchester's Alumni portal.
Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
* Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna's tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Which of the University's records does Anna NOT have to include in her record of processing activities?

A. Department for Education records
B. Student records
C. Staff and alumni records
D. Frank's performance database

Answer: D

Explanation:
According to the GDPR, a record of processing activities (RoPA) is a document that provides an overview of how personal data is processed within an organisation. It must include information on the types of personal data processed, the purposes for which the data is processed, and the measures taken to ensure the security of the data123. A RoPA must be kept up to date and made available to the supervisory authority upon request1.
In this scenario, Anna does not have to include Frank's performance database in her RoPA, because it does not contain any personal data. Personal data is any information relating to an identified or identifiable natural person4. Frank's performance database only contains aggregated or anonymised data that cannot identify any individual student. Therefore, it does not fall under the definition of personal data under the GDPR.
However, Anna still has to complete her RoPA for all other types of records that are processed by Granchester University, such as student records, staff and alumni records, and Department for Education records. These records may contain personal data that needs to be minimised and protected in accordance with the GDPR principles4. Anna also has to conduct a risk analysis before processing these records, as required by Article 35 (2) of the GDPR4. She also has to report any security incidents involving these records, as required by Article
33(3) of the GDPR4.
References:
* [Art. 30 GDPR - Records of processing activities]
* [How do we document our processing activities?]
* Records of Processing (Article 30) Guidance
* GDPR Records of Processing Activities | Resources
* Records of Processing Activities: A Key GDPR Compliance Requirement

NEW QUESTION # 186
Assuming that the "without undue delay" provision is followed, what is the time limit for complying with a data access request?

A. Within one month of receipt, which may be extended by an additional two months
B. Within one month of receipt, which may be extended by up to an additional month
C. Within 40 days of receipt, which may be extended by up to 40 additional days
D. Within 40 days of receipt

Answer: B

NEW QUESTION # 187
An online company's privacy practices vary due to the fact that it offers a wide variety of services. How could it best address the concern that explaining them all would make the policies incomprehensible?

A. Use a layered privacy notice on its website and in its email communications.
B. Identify uses of data in a privacy notice mailed to the data subject.
C. Provide only general information about its processing activities and offer a toll-free number for more information.
D. Place a banner on its website stipulating that visitors agree to its privacy policy and terms of use by visiting the site.

Answer: B

Explanation:
Reference https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-bureau- consumer-protection-preliminary-ftc-staff-report-protecting-consumer/101201privacyreport.pdf

NEW QUESTION # 188
A dynamic Internet Protocol (IP) address is considered persona! data when it is combined with what?

A. Other data held by the processor.
B. Other data held by recipients of the data.
C. Other data held by Internet Service Providers (ISPs).
D. Other data held by the controller

Answer: D

Explanation:
A dynamic IP address is a unique numerical label for a device on the internet that changes every time the device connects to the internet. A dynamic IP address by itself is not personal data, as it does not directly identify the person who owns or uses the device. However, a dynamic IP address can become personal data when it is combined with other data held by the controller, such as the web pages accessed by the device, the time and duration of the visit, the location of the device, or the user's preferences and interests. In this case, the controller can use the additional data to identify the data subject, either directly or indirectly, by linking the dynamic IP address to a specific person or a profile. This was confirmed by the Court of Justice of the European Union (CJEU) in the case of Breyer v Bundesrepublik Deutschland, where the CJEU ruled that a dynamic IP address registered by a website provider constitutes personal data in relation to that provider, where the latter has the legal means to obtain the identity of the data subject from the internet service provider (ISP) that assigned the dynamic IP address. Therefore, option B is the correct answer. References: Directive 95
/46/EC, Directive 2002/58/EC, Breyer v Bundesrepublik Deutschland, Case C-582/14, Dynamic IP Addresses can be Personal Data

NEW QUESTION # 189
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asi a. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's Questions: on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well. The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a QUESTION, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's QUESTION. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
In light of the requirements of Article 32 of the GDPR (related to the Security of Processing), which practice should the company institute?

A. Insert contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union.
B. Include dual-factor authentication before each use by a child in order to ensure a minimum amount of security.
C. Encrypt the data in transit over the wireless Bluetooth connection.
D. Include three-factor authentication before each use by a child in order to ensure the best level of security possible.

Answer: C

Explanation:
According to Article 32 of the GDPR, the controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing personal data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The GDPR also provides some examples of such measures, including the pseudonymisation and encryption of personal data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, and a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
In this scenario, the company is processing personal data of children, such as their voice, questions, preferences, and location, through the connected toys that use a wireless Bluetooth connection to communicate with smartphones, tablets, cloud servers, and other toys. This poses a high risk to the security of the data, as Bluetooth is a short-range wireless technology that can be easily intercepted, hacked, or compromised by malicious actors. Therefore, the company should encrypt the data in transit over the Bluetooth connection, to prevent unauthorized access, disclosure, or alteration of the data. Encryption is a process of transforming data into an unreadable form, using a secret key or algorithm, that can only be reversed by authorized parties who have the corresponding key or algorithm. Encryption can protect the data from being accessed or modified by anyone who does not have the key or algorithm, thus ensuring the confidentiality and integrity of the data.
The other options are incorrect because:
B) Including dual-factor authentication before each use by a child in order to ensure a minimum amount of security is not a sufficient measure to protect the data in transit over the Bluetooth connection. Dual-factor authentication is a process of verifying the identity of a user by requiring two pieces of evidence, such as a password and a code sent to a phone or email. While this may enhance the security of the user's account or device, it does not protect the data that is transmitted over the wireless connection, which can still be intercepted, hacked, or compromised by malicious actors. Moreover, dual-factor authentication may not be suitable or convenient for children, who may not have access to a phone or email, or who may forget their passwords or codes.
C) Including three-factor authentication before each use by a child in order to ensure the best level of security possible is not a necessary or proportionate measure to protect the data in transit over the Bluetooth connection. Three-factor authentication is a process of verifying the identity of a user by requiring three pieces of evidence, such as a password, a code sent to a phone or email, and a biometric feature, such as a fingerprint or a face scan. While this may provide a high level of security for the user's account or device, it does not protect the data that is transmitted over the wireless connection, which can still be intercepted, hacked, or compromised by malicious actors. Furthermore, three-factor authentication may not be appropriate or feasible for children, who may not have access to a phone or email, or who may not have reliable biometric features, or who may find the process too complex or cumbersome.
D) Inserting contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union, is not a relevant measure to protect the data in transit over the Bluetooth connection. Contractual clauses are legal agreements that specify the obligations and responsibilities of the parties involved in a data transfer, such as the level of data protection, the rights of data subjects, and the remedies for breaches. While contractual clauses may be necessary to ensure the compliance of the data transfer to South Africa, which is a non-EU country that does not have an adequacy decision from the European Commission, they do not address the security of the data that is transmitted over the wireless connection, which can still be intercepted, hacked, or compromised by malicious actors. Moreover, contractual clauses are not a technical or organisational measure, but a legal measure, that falls under a different provision of the GDPR, namely Article 46.

NEW QUESTION # 190
Tanya is the Data Protection Officer for Curtains Inc., a GDPR data controller. She has recommended that the company encrypt all personal data at rest. Which GDPR principle is she following?

A. Storage Limitation
B. Integrity and confidentiality
C. Lawfulness, fairness and transparency
D. Accuracy

Answer: B

NEW QUESTION # 191
Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?

A. Consider the importance of the profiling to their particular objective.
B. Carry out an exercise that weighs the interests of the controller and the basis for the data subject's objection.
C. Demonstrate that the profiling is for the purposes of direct marketing.
D. Consider the impact of the profiling on the data subject's interest, rights and freedoms.

Answer: C

NEW QUESTION # 192
Based on GDPR Article 35, which of the following situations would trigger the need to complete a DPIA?

A. A company wants to combine location data with other data in order to offer more personalized service for the customer.
B. A company wants to build a dating app that creates candidate profiles based on location data and data from third-party sources.
C. A company wants to use location data to track delivery trucks in order to make the routes more efficient.
D. A company wants to use location data to infer information on a person's clothes purchasing habits.

Answer: B

Explanation:
According to Article 35 of the GDPR, a Data Protection Impact Assessment (DPIA) is required when the processing of data is likely to result in a high risk to the rights and freedoms of natural persons, especially when using new technologies. A DPIA is supposed to show the characteristics of the processing, the risks and the measures adopted to mitigate them. The GDPR also provides some examples of processing operations that require a DPIA, such as:
* a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, and on which decisions are based that produce legal or significant effects on the data subject;
* processing on a large scale of special categories of data or data relating to criminal convictions and offences; or
* a systematic monitoring of a publicly accessible area on a large scale.
Among the answer choices, only option C falls under the first example, as it involves a systematic and extensive evaluation of personal aspects based on location data and data from third-party sources, which could be used for profiling and matching purposes. This could have significant effects on the data subjects' privacy, personal relationships and reputation. Therefore, a DPIA would be required for this processing operation.
Option A does not necessarily involve a systematic and extensive evaluation of personal aspects, nor does it produce legal or significant effects on the data subject. It could be considered a legitimate interest of the company to offer more personalized service, as long as it respects the principles of data minimization, purpose limitation and transparency.
Option B does not involve a decision based on the processing, nor does it produce legal or significant effects on the data subject. It could be considered a form of direct marketing, which is subject to specific rules under the GDPR and the ePrivacy Directive.
Option D does not involve personal data relating to natural persons, but rather to delivery trucks. Therefore, it does not pose a high risk to the rights and freedoms of natural persons.
References:
GDPR Article 35
Guidelines on DPIA
Art. 35 GDPR - Data protection impact assessment - GDPR.eu
Reference:
http://webcache.googleusercontent.com/search?q=cache:aQkU17eX9sQJ:https:// www.shlegal.com/insights
/article-29-data-protection-working-party-gdpr-guidelines-on-data-protection-impact- assessments
&client=firefox-b-e&hl=en&gl=pk&strip=1&vwsrc=0

NEW QUESTION # 193
Since blockchain transactions are classified as pseudonymous, are they considered to be within the material scope of the GDPR or outside of it?

A. Outside the material scope of the GDPR, because transactions do not include personal data about data subjects m the European Union.
B. Within the material scope of the GDPR but outside of the territorial scope, because blockchains are decentralized.
C. Outside the material scope of the GDPR, because transactions are for personal or household purposes
D. Within the material scope of the GDPR to the extent that transactions include data subjects in the European Union.

Answer: D

NEW QUESTION # 194
In the Planet 49 case, what was the man judgement of the Coon of Justice of the European Union (CJEU) regarding the issue of cookies?

A. If a data subject continues to scroll through a website after reading a cookie banner, this activity constitutes valid consent for the tracking described in the cookie banner.
B. If the ePrivacy Directive requires consent for cookies, then the GDPR's consent requirements apply.
C. If a website's cookie notice makes clear the information gathered and the lifespan of the cookie, then pre-checked boxes are acceptable.
D. If the cookies do not track personal data, then pre-checked boxes are acceptable.

Answer: B

Explanation:
According to the CJEU, the ePrivacy Directive does not define the concept of consent, but refers to the GDPR for its interpretation1. Therefore, the GDPR standard of consent applies to the use of cookies and similar technologies that require consent under the ePrivacy Directive. The GDPR defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her2. The CJEU also clarified that the consent requirements apply regardless of whether the cookies constitute personal data or not, as the ePrivacy Directive covers any information stored or accessed on the user's device1. The other options are incorrect, as the CJEU ruled that pre-checked boxes, implicit consent by scrolling, and insufficient information on the cookies do not meet the GDPR standard of consent1. Reference:
Free CIPP/E Study Guide, page 14, section 2.3
GDPR, Article 4 (11)
ePrivacy Directive, Article 5 (3)
Planet49: CJEU Rules on Cookie Consent
CURIA - List of results

NEW QUESTION # 195
......

IAPP CIPP-E certification is designed for professionals who are interested in specializing in privacy and data protection in the European Union. Certified Information Privacy Professional/Europe (CIPP/E) certification is recognized globally and is highly sought after by organizations that handle personal data. Certified Information Privacy Professional/Europe (CIPP/E) certification is issued by the International Association of Privacy Professionals (IAPP), which is a non-profit organization that is dedicated to providing education, resources, and networking opportunities to privacy professionals around the world.

Free Certified Information Privacy Professional CIPP-E Exam Question: https://actualtests.real4prep.com/CIPP-E-exam.html

Prepare Top IAPP CIPP-E Exam Study Guide Practice Questions Edition [Q171-Q195]

Related Articles

Useful Links

Latest Real Exam

Contact Us

Related Articles

Prepare Top IAPP CIPP-E Exam Study Guide Practice Questions Edition [Q171-Q195]

2024 CIPP-E exam torrent CIPP-E Study Guide [Q127-Q151]

[Jan 13, 2022] Prepare For The CIPP-E Question Papers In Advance [Q82-Q101]