IAPP CIPP-E Online Practice Questions and Exam Preparation

IAPP CIPP-E Online Questions & Answers

• Question 301:

  SCENARIO

  Please use the following to answer the next question:

  You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company's revenue is due to international sales. The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's Questions: on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well. The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.

  When a child asks the toy a QUESTION, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's QUESTION. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.

  In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.

  To ensure GDPR compliance, what should be the company's position on the issue of consent?

  A. The child, as the user of the action figure, can provide consent himself, as long as no information is shared for marketing purposes.
  B. Written authorization attesting to the responsible use of children's data would need to be obtained from the supervisory authority.
  C. Consent for data collection is implied through the parent's purchase of the action figure for the child.
  D. Parental consent for a child's use of the action figures would have to be obtained before any data could be collected.
  D. Parental consent for a child's use of the action figures would have to be obtained before any data could be collected.

• Question 302:

  Which of the following regulates the use of electronic communications services within the European Union?

  A. Regulator (EU) 2015/2120 of the European Parliament and of the Council of 25 November 2015.
  B. Regulation (EU) 2017/1953 of the European Parliament and of the Council of 25 October 2017.
  C. Directive 2002/58'EC of the European Parliament and of the Council of 12 July 2002.
  D. Directive (EU) 2019.789 of the European Parliament and of the Council of 17 April 2019.
  C. Directive 2002/58'EC of the European Parliament and of the Council of 12 July 2002.

  ---

  Explanation Explanation/Reference:

• Question 303:

  Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?

  A. Data subjects must be sufficiently informed of the purposes for which their personal data is processed.
  B. Processing of special categories of personal data on a large scale requires appointing a DPO.
  C. Personal data of data subjects must always be accurate and kept up to date.
  D. Data controllers must be in control of the data they hold at all times.
  D. Data controllers must be in control of the data they hold at all times.

  ---

  https://blog.rsisecurity.com/why-byod-is-bad-for-gdpr-compliance/

• Question 304:

  What is the most frequently used mechanism for legitimizing cross-border data transfer?

  A. Standard Contractual Clauses.
  B. Approved Code of Conduct.
  C. Binding Corporate Rules.
  D. Derogations.
  A. Standard Contractual Clauses.

  ---

  Explanation Explanation/Reference:https://www.dataguidance.com/opinion/international-eu-us-cross-border-data-transfers

• Question 305:

  The Murla HB Club should have carried out a DPIA before the installation of the new access system AND at what other time?

  A. After the complaint of the supporter
  B. Periodically, when new risks were foreseen
  C. At the end of every match of the season.
  D. After the AEPD notification of the investigation.
  B. Periodically, when new risks were foreseen

• Question 306:

  SCENARIO

  Please use the following to answer the next question:

  ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorage

  Why is the additional measure recommended by Jackie sufficient foe using UpFinance?

  A. UpFinance is an established 7-year-old business.
  B. UpFinance is in a highly regulated financial industry
  C. UpFinance is based in a country without surveillance laws.
  D. UpFinance implements sufficient data protection measures
  C. UpFinance is based in a country without surveillance laws.

• Question 307:

  According to the European Data Protection Board, if a controller that is not established in the EU but still subject to the GDPR becomes aware of a personal data breach, which supervisory authority or authorities must be notified?

  A. Only the supervisory authority of the EU member state in which the controller's EU representative (pursuant to Article 27) is established.
  B. Only one lead supervisory authority, as a controller benefits from the one-stop shop mechanism under the GDPR’s enforcement regime.
  C. Every supervisory authority of the EU member states where the controller is offering goods or services.
  D. Every supervisory authority for which affected data subjects reside in their EU member state.
  A. Only the supervisory authority of the EU member state in which the controller's EU representative (pursuant to Article 27) is established.