Pass IAPP CIPP-E exam questions - convert Test Engine to PDF
Pass Your CIPP-E Exam Easily - Real CIPP-E Practice Dump Updated Jan 18, 2022
What are the Topics for IAPP CIPP/E Exam
Candidates must know the exam topics before they start of preparation. Because it will really help them in hitting the core. Our IAPP CIPP/E exam dumps will include the following topics:
- Compliance with European Data Protection Law and Regulation
- International Data Transfers
- Introduction to European Data Protection
- Legislative Framework
- European Regulatory Institutions
NEW QUESTION 43
SCENARIO
Please use the following to answer the next question:
WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of their service, WonderKids will pass all personal data provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person booking the childcare, address and contact details, as well as information about the children to be cared for including name, age, gender and health information. The privacy statement on Wonderkids' website states the following:
"WonderkKids provides the information you disclose to us through this website to your childcare provider for scheduling and health and safety reasons. We may also use your and your child's personal information for our own legitimate business purposes and we employ a third-party website hosting company located in Switzerland to store the dat a. Any data stored on equipment located in Switzerland meets the European Commission provisions for guaranteeing adequate safeguards for you and your child's personal information. We will only share you and your child's personal information with businesses that we see as adding real value to you. By providing us with any personal data, you consent to its transfer to affiliated businesses and to send you promotional offers."
"We may retain you and your child's personal information for no more than 28 days, at which point the data will be depersonalized, unless your personal information is being used for a legitimate business purpose beyond 28 days where it may be retained for up to 2 years."
"We are processing you and your child's personal information with your consent. If you choose not to provide certain information to us, you may not be able to use our services. You have the right to: request access to you and your child's personal information; rectify or erase you or your child's personal information; the right to correction or erasure of you and/or your child's personal information; object to any processing of you and your child's personal information. You also have the right to complain to the supervisory authority about our data processing activities." What additional information must Wonderkids provide in their Privacy Statement?
- A. Technical and organizational measures to protect data.
- B. Contact information of the hosting company.
- C. How often promotional emails will be sent.
- D. The categories of recipients with whom data will be shared.
Answer: B
NEW QUESTION 44
According to the E-Commerce Directive 2000/31/EC, where is the place of "establishment" for a company providing services via an Internet website confirmed by the GDPR?
- A. Where the website is accessed
- B. Where the decisions about processing are made
- C. Where the technology supporting the website is located
- D. Where the customer's Internet service provider is located
Answer: D
NEW QUESTION 45
Assuming that the "without undue delay" provision is followed, what is the time limit for complying with a data access request?
- A. Within one month of receipt, which may be extended by up to an additional month
- B. Within 40 days of receipt
- C. Within one month of receipt, which may be extended by an additional two months
- D. Within 40 days of receipt, which may be extended by up to 40 additional days
Answer: A
NEW QUESTION 46
SCENARIO
Please use the following to answer the next question:
Dynaroux Fashion ('Dynaroux') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Ronan is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jonas, the CEO, tells Ronan that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Ronan tells the CEO that: (a) the potential risks of such activities means that Dynaroux needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Dynaroux may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jonas tells Ronan that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Dynaroux's business plan and associated processing activities.
Which of the following facts about Dynaroux would trigger a data protection impact assessment under the GDPR?
- A. The company will be undertaking processing activities involving sensitive data categories such as financial and children's data.
- B. The company plans to undertake profiling of its customers through analysis of their purchasing patterns.
- C. The company employs approximately 650 people and will therefore be carrying out extensive processing activities.
- D. The company intends to shift their business model to rely more heavily on online shopping.
Answer: B
NEW QUESTION 47
Which area of privacy is a lead supervisory authority's (LSA) MAIN concern?
- A. Special categories of data
- B. Cross-border processing
- C. Data subject rights
- D. Data access disputes
Answer: B
NEW QUESTION 48
When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?
- A. When the data serves legitimate interest of third parties.
- B. When the data has been pseudonymized.
- C. When the data is protected by technological safeguards.
- D. When the data subject has failed to use a provided opt-out mechanism.
Answer: A
Explanation:
Section: (none)
Explanation
NEW QUESTION 49
How does the GDPR now define "processing"?
- A. Any use or disclosure of personal data compatible with the purpose for which the data was collected.
- B. Any act involving the collecting and recording of personal data.
- C. Any operation or set of operations performed by automated means on personal data or on sets of personal data.
- D. Any operation or set of operations performed on personal data or on sets of personal data.
Answer: B
NEW QUESTION 50
In addition to the European Commission, who can adopt standard contractual clauses, assuming that all required conditions are met?
- A. The European Data Protection Supervisor.
- B. The Council of the European Union.
- C. National data protection authorities.
- D. Approved data controllers.
Answer: D
NEW QUESTION 51
SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location. During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
What would be the MOST APPROPRIATE way for Building Block to handle the situation with the employee from Italy?
- A. Since the employee was not informed that the security measures would be used for other purposes such as monitoring, the company could face difficulties in applying any disciplinary measures to this employee.
- B. Since this was a serious infringement, but the employee was not appropriately informed about the consequences the new security measures, the company would be entitled to apply some disciplinary measures, but not dismissal.
- C. Since the GDPR does not apply to this situation, the company would be entitled to apply any disciplinary measure authorized under Italian labor law.
- D. Since the employee was the cause of a serious risk for the server performance and their data, the company would be entitled to apply disciplinary measures to this employee, including fair dismissal.
Answer: B
NEW QUESTION 52
SCENARIO
Please use the following to answer the next question:
Zandelay Fashion ('Zandelay') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay's business plan and associated processing activities.
What would MOST effectively assist Zandelay in conducting their data protection impact assessment?
- A. Existing DPIA guides published by local supervisory authorities.
- B. Information about DPIAs found in Articles 38 through 40 of the GDPR.
- C. Records of processing activities that data controllers are required to maintain.
- D. Data breach documentation that data controllers are required to maintain.
Answer: B
NEW QUESTION 53
Under the GDPR, which essential pieces of information must be provided to data subjects before collecting their personal data?
- A. The name/s of relevant government agencies involved and the steps needed for revising the data.
- B. The contact information of the controller and a description of the retention policy.
- C. The identity and contact details of the controller and the reasons the data is being collected.
- D. The authority by which the controller is collecting the data and the third parties to whom the data will be sent.
Answer: C
Explanation:
Explanation/Reference: https://gdpr-info.eu/art-13-gdpr/
NEW QUESTION 54
SCENARIO
Please use the following to answer the next question:
Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B.
Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.
Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees:
* Name
* Address
* Date of Birth
* Payroll number
* National Insurance number
* Sick pay entitlement
* Maternity/paternity pay entitlement
* Holiday entitlement
* Pension and benefits contributions
* Trade union contributions
Jenny is the compliance officer at Company A.
She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required.
Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.
Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B.
This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.
Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees.
Under the GDPR, which of Company B's actions would NOT be likely to trigger a potential enforcement action?
- A. Their engagement of Company C to improve their payroll service.
- B. Their omission of data protection provisions in their contract with Company C.
- C. Their decision to operate without a data protection officer.
- D. Their failure to provide sufficient security safeguards to Company A's data.
Answer: A
NEW QUESTION 55
SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
* Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
* Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
* Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees.
These records are available to former students after registering through Granchester's Alumni portal.
* Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
* Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level.
Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna's tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Anna will find that a risk analysis is NOT necessary in this situation as long as?
- A. The algorithms that Frank uses for the processing are technologically sound
- B. The data subjects gave their unambiguous consent for the original processing
- C. The data subjects are no longer current students of Frank's
- D. The processing will not negatively affect the rights of the data subjects
Answer: B
NEW QUESTION 56
In which of the following cases would an organization MOST LIKELY be required to follow both ePrivacy and data protection rules?
- A. When paying a search engine company to give prominence to certain products and services within specific search results.
- B. When calling a potential customer to notify her of an upcoming product sale.
- C. When creating an untargeted pop-up ad on a website.
- D. When emailing a customer to announce that his recent order should arrive earlier than expected.
Answer: C
Explanation:
Explanation/Reference: https://www.privacytrust.com/guidance/gdpr-vs-eprivacy-regulation.html
NEW QUESTION 57
Which sentence best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?
- A. All employees must follow the privacy regulations of the jurisdictions where the current scope of their work is established.
- B. Employees who control personal data must complete a rigorous certification procedure, as they are exempt from legal enforcement.
- C. Employees must sign an ad hoc contractual agreement each time personal data is exported.
- D. All employees are subject to the rules in their entirety, regardless of where the work is taking place.
Answer: A
NEW QUESTION 58
SCENARIO
Please use the following to answer the next question:
WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of their service, WonderKids will pass all personal data provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person booking the childcare, address and contact details, as well as information about the children to be cared for including name, age, gender and health information. The privacy statement on Wonderkids' website states the following:
"WonderkKids provides the information you disclose to us through this website to your childcare provider for scheduling and health and safety reasons. We may also use your and your child's personal information for our own legitimate business purposes and we employ a third-party website hosting company located in Switzerland to store the dat a. Any data stored on equipment located in Switzerland meets the European Commission provisions for guaranteeing adequate safeguards for you and your child's personal information. We will only share you and your child's personal information with businesses that we see as adding real value to you. By providing us with any personal data, you consent to its transfer to affiliated businesses and to send you promotional offers."
"We may retain you and your child's personal information for no more than 28 days, at which point the data will be depersonalized, unless your personal information is being used for a legitimate business purpose beyond 28 days where it may be retained for up to 2 years."
"We are processing you and your child's personal information with your consent. If you choose not to provide certain information to us, you may not be able to use our services. You have the right to: request access to you and your child's personal information; rectify or erase you or your child's personal information; the right to correction or erasure of you and/or your child's personal information; object to any processing of you and your child's personal information. You also have the right to complain to the supervisory authority about our data processing activities." What direct marketing information can WonderKids send by email without prior consent of the person booking the childcare?
- A. Marketing information related to other business operations of WonderKids.
- B. No marketing information at all.
- C. Marketing information for products or services similar to those purchased from WonderKids.
- D. Any marketing information at all.
Answer: A
NEW QUESTION 59
SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location.
During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
To comply with the GDPR, what should Building Block have done as a first step before implementing the SecurityScan measure?
- A. Assessed potential privacy risks by conducting a data protection impact assessment.
- B. Consulted with the relevant data protection authority about potential privacy violations.
- C. Distributed a more comprehensive notice to employees and received their express consent.
- D. Consulted with the Information Security team to weigh security measures against possible server impacts.
Answer: C
NEW QUESTION 60
If a company is planning to use closed-circuit television (CCTV) on its premises and is concerned with GDPR compliance, it should first do all of the following EXCEPT?
- A. Notify the appropriate data protection authority.
- B. Perform a data protection impact assessment (DPIA).
- C. Create an information retention policy for those who operate the system.
- D. Ensure that safeguards are in place to prevent unauthorized access to the footage.
Answer: C
NEW QUESTION 61
Under Article 30 of the GDPR, controllers are required to keep records of all of the following EXCEPT?
- A. Categories of recipients to whom the personal data have been disclosed.
- B. Retention periods for erasure and deletion of categories of personal data.
Section: (none)
Explanation - C. Incidents of personal data breaches, whether disclosed or not.
- D. Data inventory or data mapping exercises that have been conducted.
Answer: B
NEW QUESTION 62
Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?
- A. The data protection officer must be easily accessible from each establishment where the undertakings are located.
- B. The group of undertakings must be comprised of organizations of similar sizes and functions.
- C. The group of undertakings must obtain approval from a supervisory authority.
- D. The data protection officer must be located in the country where the data controller has its main establishment.
Answer: A
Explanation:
Explanation/Reference: https://www.privacy-regulation.eu/en/article-37-designation-of-the-data-protection-officer- GDPR.htm
NEW QUESTION 63
Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?
- A. Carry out an exercise that weighs the interests of the controller and the basis for the data subject's objection.
- B. Demonstrate that the profiling is for the purposes of direct marketing.
- C. Consider the impact of the profiling on the data subject's interest, rights and freedoms.
- D. Consider the importance of the profiling to their particular objective.
Answer: B
Explanation:
Explanation/Reference: https://gdpr-info.eu/art-21-gdpr/
NEW QUESTION 64
According to the GDPR, how is pseudonymous personal data defined?
- A. Data that has been encrypted or is subject to other technical safeguards.
- B. Data that has been rendered anonymous in such a manner that the data subject is no longer identifiable.
- C. Data that can no longer be attributed to a specific data subject without the use of additional information kept separately.
- D. Data that can no longer be attributed to a specific data subject, with no possibility of re-identifying the data.
Answer: C
Explanation:
Explanation/Reference: https://www.chino.io/blog/what-is-pseudonymous-data-according-to-the-gdpr/
NEW QUESTION 65
SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location. During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
To comply with the GDPR, what should Building Block have done as a first step before implementing the SecurityScan measure?
- A. Assessed potential privacy risks by conducting a data protection impact assessment.
- B. Consulted with the relevant data protection authority about potential privacy violations.
- C. Distributed a more comprehensive notice to employees and received their express consent.
- D. Consulted with the Information Security team to weigh security measures against possible server impacts.
Answer: C
NEW QUESTION 66
Which sentence BEST summarizes the concepts of "fairness," "lawfulness" and "transparency", as expressly required by Article 5 of the GDPR?
- A. Fairness and transparency refer to the communication of key information before collecting data; lawfulness refers to compliance with government regulations.
- B. Fairness refers to limiting the amount of data collected from individuals; lawfulness refers to the approval of company guidelines by the state; transparency solely relates to communication of key information before collecting data.
- C. Fairness refers to the security of personal data; lawfulness and transparency refers to the analysis of ordinances to ensure they are uniformly enforced.
- D. Fairness refers to the collection of data from diverse subjects; lawfulness refers to the need for legal rules to be uniform; transparency refers to giving individuals access to their data.
Answer: A
NEW QUESTION 67
When assessing the level of risk created by a data breach, which of the following would NOT have to be taken into consideration?
- A. The special characteristics of the data controller.
- B. The ease of identification of individuals.
- C. The nature, sensitivity and volume of personal data.
- D. The size of any data processor involved.
Answer: D
NEW QUESTION 68
......
CIPP-E Real Exam Questions and Answers FREE: https://gocertify.actual4labs.com/IAPP/CIPP-E-actual-exam-dumps.html