IAPP CIPP-E Online Practice Questions and Exam Preparation

IAPP CIPP-E Online Questions & Answers

• Question 121:

  SCENARIO

  Please use the following to answer the next question:

  ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts.

  Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.

  Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can

  later beredeemed for free travel. Mike has signed the agreement to be a rewards program member.

  Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.

  In which of the following situations would ABC Hotel Chain and XYZ Travel Agency NOT have to honor Mike's data access request?

  A. The request is to obtain access and correct inaccurate personal data in his profile.
  B. The request is to obtain access and information about the purpose of processing his personal data.
  C. The request is to obtain access and erasure of his personal data while keeping his rewards membership.
  D. The request is to obtain access and the categories of recipients who have received his personal data to process his rewards membership.
  C. The request is to obtain access and erasure of his personal data while keeping his rewards membership.

• Question 122:

  An unforeseen power outage results in company Z's lack of access to customer data for six hours. According to article 32 of the GDPR, this is considered a breach. Based on the WP 29's February, 2018 guidance, company Z should do which of the following?

  A. Notify affected individuals that their data was unavailable for a period of time.
  B. Document the loss of availability to demonstrate accountability
  C. Notify the supervisory authority about the loss of availability
  D. Conduct a thorough audit of all security systems
  B. Document the loss of availability to demonstrate accountability

  ---

  Explanation Explanation/Reference:

• Question 123:

  Which sentence BEST summarizes the concepts of "fairness," "lawfulness" and "transparency", as expressly required by Article 5 of the GDPR?

  A. Fairness and transparency refer to the communication of key information before collecting data; lawfulness refers to compliance with government regulations.
  B. Fairness refers to limiting the amount of data collected from individuals; lawfulness refers to the approval of company guidelines by the state; transparency solely relates to communication of key information before collecting data.
  C. Fairness refers to the security of personal data; lawfulness and transparency refers to the analysis of ordinances to ensure they are uniformly enforced.
  D. Fairness refers to the collection of data from diverse subjects; lawfulness refers to the need for legal rules to be uniform; transparency refers to giving individuals access to their data.
  A. Fairness and transparency refer to the communication of key information before collecting data; lawfulness refers to compliance with government regulations.

• Question 124:

  What is the MAIN reason GDPR Article 4(22) establishes the concept of the "concerned supervisory authority"?

  A. To encourage the consistency of local data processing activity.
  B. To give corporations a choice about who their supervisory authority will be.
  C. To ensure the GDPR covers controllers that do not have an establishment in the EU but have a representative in a member state.
  D. To ensure that the interests of individuals residing outside the lead authority's jurisdiction are represented.
  D. To ensure that the interests of individuals residing outside the lead authority's jurisdiction are represented.

• Question 125:

  In which of the following cases would an organization MOST LIKELY be required to follow both ePrivacy and data protection rules?

  A. When creating an untargeted pop-up ad on a website.
  B. When calling a potential customer to notify her of an upcoming product sale.
  C. When emailing a customer to announce that his recent order should arrive earlier than expected.
  D. When paying a search engine company to give prominence to certain products and services within specific search results.
  B. When calling a potential customer to notify her of an upcoming product sale.

  ---

  Explanation Explanation/Reference:https://www.privacytrust.com/guidance/gdpr-vs-eprivacy-regulation.html

• Question 126:

  You are the new Data Protection Officer for your company and have to determine whether the company has implemented appropriate technical and organizational measures as required by Article 32 of the GDPR. Which of the following would be the most important to consider when trying to determine this?

  A. How security measures might evolve in the future
  B. Which security measures are endorsed by a majority of experts.
  C. How the public perceives what constitutes adequate security measures
  D. Which kinds of security measures your company has employed in the past
  B. Which security measures are endorsed by a majority of experts.

  ---

  Explanation Explanation/Reference:

• Question 127:

  SCENARIO Please use the following to answer the next question:

  Jane starts her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a

  dedicated data center located in Malta (EU).

  People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a Know Your Customer (KYC) due diligence procedure aimed at preventing money laundering and ensuring

  compliance with applicable financial regulations.

  The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and ticking a checkbox on a separate page in order to get their account approved on the platform.

  All customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if a customer fails the KYC process, its KYC data will be automatically shared

  with the national anti-money laundering agency.

  The KYC procedure requires customers to answer many questions, including whether they have any criminal convictions, whether they use recreational drugs or have problems with alcohol, and whether they have a terminal illness. While

  providing this data, customers see a conspicuous message saying that this data is meant only to prevent fraud and account takeover, and will be never shared with private third parties.

  The company regularly conducts external security testing of its online systems by independent cybersecurity companies from the EU. At the final stage of testing, the company provides cybersecurity assessors with access to its central

  database to review security permissions, roles and policies. Personal data in the database is encrypted; however, cybersecurity assessors usually have access to the decryption keys obtained while running initial security testing. The

  assessors must strictly follow the guidelines imposed by the company during the entire testing and auditing process.

  All customer data, including trading activities and all internal communications with technical support, are permanently stored in a secured AWS S3 Glacier cloud data storage, located in Ireland, for backup and compliance purposes. The data

  is securely transferred to the cloud and then is properly encrypted while at rest by using AWS-native encryption mechanisms. These mechanisms give AWS the necessary technical means to encrypt and decrypt the data when such is

  required by the company. There is no data processing agreement between AWS and the company.

  Are the cybersecurity assessors required to sign a data processing agreement with the company in order to comply with the GDPR?

  A. No, the assessors do not quality as data processors as they only have access to encrypted data.
  B. No. the assessors do not quality as data processors as they do not copy the data to their facilities.
  C. Yes. the assessors a-e considered to be joint data controllers and must sign a mutual data processing agreement.
  D. Yes, the assessors are data processors and their processing of personal data must be governed by a separate contract or other legal act.
  D. Yes, the assessors are data processors and their processing of personal data must be governed by a separate contract or other legal act.

  ---

  Explanation Explanation/Reference:

• Question 128:

  A company wishes to transfer personal data to a country outside of the European Union/EEA In order to do so, they are planning an assessment of the country's laws and practices, knowing that these may impinge upon the transfer safeguards they intend to use

  All of the following factors would be relevant for the company to consider EXCEPT'?

  A. Any onward transfers, such as transfers of personal data to a sub-processor in the same or another third country.
  B. The process of modernization in the third country concerned and their access to emerging technologies that rely on international transfers of personal data
  C. The technical, financial, and staff resources available to an authority m the third country concerned that may access the personal data to be transferred
  D. The contractual clauses between the data controller or processor established in the European Union/EEA and the recipient of the transfer established in the third country concerned
  B. The process of modernization in the third country concerned and their access to emerging technologies that rely on international transfers of personal data

• Question 129:

  Which of the following would most likely NOT be covered by the definition of "personal data" under the GDPR?

  A. The payment card number of a Dutch citizen
  B. The U.S. social security number of an American citizen living in France
  C. The unlinked aggregated data used for statistical purposes by an Italian company
  D. The identification number of a German candidate for a professional examination in Germany
  C. The unlinked aggregated data used for statistical purposes by an Italian company

• Question 130:

  Article 58 of the GDPR describes the power of supervisory authorities. Which of the following is NOT among those granted?

  A. Legislative powers.
  B. Corrective powers.
  C. Investigatory powers.
  D. Authorization and advisory powers.
  A. Legislative powers.

  ---

  https://www.privacy-regulation.eu/en/article-58-powers-GDPR.htm