IAPP CIPP-E Online Practice Questions and Exam Preparation

IAPP CIPP-E Online Questions & Answers

• Question 41:

  What is the consequence if a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller?

  A. The controller will be liable to pay an administrative fine
  B. The processor will be liable to pay compensation to affected data subjects
  C. The processor will be considered to be a controller in respect of the processing concerned
  D. The controller will be required to demonstrate that the unauthorized processing negatively affected one or more of the parties involved
  C. The processor will be considered to be a controller in respect of the processing concerned

  ---

  Explanation Explanation/Reference:https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/controllers-and-processors/

• Question 42:

  Many businesses print their employees' photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?

  A. Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption.
  B. Because photographs qualify as biometric data only when they undergo a "specific technical processing".
  C. Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer.
  D. Because photographic ID is a physical security measure which is "necessary for reasons of substantial public interest".
  B. Because photographs qualify as biometric data only when they undergo a "specific technical processing".

  ---

  Explanation Explanation/Reference:Reference https://ess.csa.canon.com/rs/206-CLL-191/images/IAPP-Top-10-Operational-Impacts-of-GDPR.pdf?TC=DMandCN=CSA_OMNIA_PartnersandCS=CSAandCR=T1_Gov%20GenNonProfi t (11)

• Question 43:

  Company X has entrusted the processing of their payroll data to Provider Y. Provider Y stores this encrypted data on its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?

  A. The public
  B. Company X
  C. Law enforcement
  D. The supervisory authority
  B. Company X

  ---

  Explanation Explanation/Reference:

• Question 44:

  In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?

  A. A medical organization that wants to begin genetic testing to support earlier research for which they have performed a DPIA.
  B. A data controller who plans to use a new technology product that has already undergone a DPIA by the product's provider.
  C. A marketing team that wants to collect mailing addresses of customers for whom they already have email addresses.
  D. A railway operator who plans to evaluate the same video surveillance in all the train stations of his company.
  D. A railway operator who plans to evaluate the same video surveillance in all the train stations of his company.

• Question 45:

  SCENARIO

  Please use the following to answer the next question:

  CreditPlaya, SA is an established Spanish online insurance company whose exclusive activity is providing health insurance for legal residents of Spain, regardless of their nationality.

  CreditPlaya autonomously manages its own website, through which a potential customer, engaging in a free pre-contractual activity, enters his or her full name, e-mail address, tax identification number (to verify residence in Spain), age,

  profession, and the full names of any other adult members of his or her family.

  With this data, CreditPlaya immediately sends an email granting or denying eligibility for a health insurance policy. In the case of eligibility, the email also contains the eventual cost of the policy and two PDF documents – one with the contractual Terms and Conditions, and the other with the privacy notice as required by Article 13 of the GDPR. The CreditPlaya Information Tracking System (ITS) is very efficient, with a low rate of unpaid insurance policies. The ITS is automatically fed by the information provided by every applicant, whose data is then used to refine insurance policy

  rates.

  To ensure their back-up procedures, in January 2021 CreditPlaya started sending weekly copies of the whole database with all the applicants' personal data to an independent company in Uruguay. The information was sent through state-ofthe-art encrypting tools, but once in Uruguay was stored without any encryption method. In March 2022, the entire data base stored on the Uruguay's company servers was encrypted by malicious ransomware. There was no evidence that the data was accessed by unauthorized persons, much less altered or exfiltrated. Despite

  the incident, CreditPlaya found that they could rely on the locally based Spanish back-up information and carry on its activity without interrupting its operations. The incident caused the termination of the professional relationship between the two companies.

  If the data on the Uruguay company's servers had been encrypted, what kind of security measure would this be considered?

  A. A remediation security measure.
  B. A prevention security measure.
  C. A corrective security measure.
  D. A detection security measure.
  B. A prevention security measure.

  ---

  Explanation Explanation/Reference:

• Question 46:

  According to the European Data Protection Board, data subjects should be aware of any video surveillance in operation. How should a retail shop operator ensure that data subjects receive at information required for such a purpose under EU data protection law?

  A. The shop operator should post a copy of the manual of the video surveillance system in the shop and on its social media channels.
  B. The shop operator should provide full notice of the intended video surveillance outside the shop, for example with a sign or a stand-up display.
  C. The shop operator should instruct the data protection officer to hand out a comprehensive notice to data subjects every time they enter the shop.
  D. The shop operator should provide the most important information on a clearly readable warning sign to data subjects before they enter the monitored area, and additional mandatory details by other means.
  D. The shop operator should provide the most important information on a clearly readable warning sign to data subjects before they enter the monitored area, and additional mandatory details by other means.

  ---

  Explanation Explanation/Reference:

• Question 47:

  According to the AI Act, a provider of a high-risk AI system has all of the following obligations EXCEPT?

  A. Ensuring users understand how the system mitigates bias.
  B. Registering the system in the European AI Board's database.
  C. Providing detailed documentation about the system to the users.
  D. Conducting a conformity assessment before placing the system on the market.
  A. Ensuring users understand how the system mitigates bias.

• Question 48:

  What ruling did the Planet 49 CJEU judgment make regarding the issue of pre-ticked boxes?

  A. They are allowed if determined to be technically necessary.
  B. They do not amount to valid consent under any circumstances.
  C. They are allowed if recorded In the register of processing activities.
  D. They constitute valid consent if the processing is necessary for purposes of legitimate interest
  B. They do not amount to valid consent under any circumstances.

• Question 49:

  The origin of privacy as a fundamental human right can be found in which document?

  A. Universal Declaration of Human Rights 1948.
  B. European Convention of Human Rights 1953.
  C. OECD Guidelines on the Protection of Privacy 1980.
  D. Charier of Fundamental Rights of the European Union 2000.
  A. Universal Declaration of Human Rights 1948.

  ---

  Explanation Explanation/Reference:

• Question 50:

  In which of the following situations would an individual most likely to be able to withdraw her consent for processing?

  A. When she is leaving her bank and moving to another bank.
  B. When she has recently changed jobs and no longer works for the same company.
  C. When she disagrees with a diagnosis her doctor has recorded on her records.
  D. When she no longer wishes to be sent marketing materials from an organization.
  D. When she no longer wishes to be sent marketing materials from an organization.

  ---

  https://gdpr-info.eu/art-7-gdpr/