IAPP CIPP-E Exam Dumps

Which of the following was the first to implement national law for data protection in 1973? 

A. France  
B. Sweden  
C. Germany  
D. United Kingdom  

Answer: B

SCENARIOPlease use the following to answer the next question:Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of amultinational pharmaceutical company on a clinical trial related to COVID-19. As part of hisonboarding process Jack received privacy training He was explicitly informed that while hewould need to process confidential patient data in the course of his work, he may under nocircumstances use this data for anything other than the performance of work-related (asksThis was also specified in the privacy policy, which Jack signed upon conclusion of thetraining.After several months of employment, Jack got into an argument with a patient over thephone. Out of anger he later posted the patient's name and hearth information, along withdisparaging comments, on a social media website. When this was discovered by hisPharmacovigilance supervisors. Jack was immediately dismissedJack's lawyer sent a letter to the company stating that dismissal was a disproportionatesanction, and that if Jack was not reinstated within 14 days his firm would have noalternative but to commence legal proceedings against the company. This letter wasaccompanied by a data access request from Jack requesting a copy of "all personal data,including internal emails that were sent/received by Jack or where Jack is directly orindirectly identifiable from the contents * In relation to the emails Jack listed six members ofthe management team whose inboxes he required access.The company conducted an initial search of its IT systems, which returned a large amountof information They then contacted Jack, requesting that he be more specific regardingwhat information he required, so that they could carry out a targeted search Jackresponded by stating that he would not narrow the scope of the information requester.What would be the most appropriate response to Jacks data subject access request?

A. The company should not provide any information, as the company is headquarteredoutside of the EU. 
B. The company should decline to provide any information, as the amount of informationrequested is too excessive to provide in one month. 
C. The company should cite the need for an extension, and agree to provide theinformation requested in Jack's original DSAR within a period of 3 months. 
D. The company should provide all requested information except for the emails, as they areexcluded from data access request requirements under the GDPR. 

Answer: B

The GDPR's list of processor obligations regarding cloud computing includes all of thefollowing EXCEPT?

A. Controllers must be given notice of any subprocessors and have a right of objection.  
B. Individuals authorized to process the personal data are subject to an obligation of confidentiality. 
C. Any personal data related to data subjects must be securely maintained for a maximumof ten years. 
D. Processors must implement technical and organizational measures to ensure a level ofsecurity appropriate to the risk. 

Answer: C

According to the European Data Protection Board, which of the following concepts orpractices does NOT follow from the principles relating to the processing of personal dataunder EU data protection law?

A. Data ownership allocation.  
B. Access control management.  
C. Frequent pseudonymization key rotation.  
D. Error propagation avoidance along the processing chain.  

Answer: A

What monitoring may lawfully be performed within the scope of Gentle Hedgehog'sbusiness?

A. Everything offered by Sauron Eye's software in relation to activity by sales team contractors. 
B. Everything offered by Sauron Eye's software, assuming employees provide dailyconsent to the monitoring. 
C. Only emails, website browsing history, and camera for internal video calls conducted ina non-secure environment. 
D. Only emails, website browsing history, and camera for internal video calls that areexpressly marked as monitored. 

Answer: D

ISO 31700 has set forth requirements relating to consumer products and services. Inparticular, this international standard focuses on the implementation of which of thefollowing?

A. Privacy by design.  
B. Comprehensive ethical Al software.  
C. Privacy notices for companies providing services to consumers.  
D. Automated systems for identifying EU data subjects' personal data.  

Answer: A

SCENARIOPlease use the following to answer the next question:Liem, an online retailer known for its environmentally friendly shoes, has recently expandedits presence in Europe. Anxious to achieve market dominance, Liem teamed up withanother eco friendly company, EcoMick, which sells accessories like belts and bags.Together the companies drew up a series of marketing campaigns designed to highlight theenvironmental and economic benefits of their products. After months of planning, Liem andEcoMick entered into a data sharing agreement to use the same marketing database,MarketIQ, to send the campaigns to their respective contacts.Liem and EcoMick also entered into a data processing agreement with MarketIQ, the termsof which included processing personal data only upon Liem and EcoMick’s instructions,and making available to them all information necessary to demonstrate compliance withGDPR obligations.Liem and EcoMick then procured the services of a company called JaphSoft, a marketingoptimization firm that uses machine learning to help companies run successful campaigns.Clients provide JaphSoft with the personal data of individuals they would like to be targetedin each campaign. To ensure protection of itsclients’ data, JaphSoft implements the technical and organizational measures it deemsappropriate. JaphSoft works to continually improve its machine learning models byanalyzing the data it receives from its clients to determine the most successful componentsof a successful campaign. JaphSoft then uses such models in providing services to itsclient-base. Since the models improve only over a period of time as more information iscollected, JaphSoft does not have a deletion process for the data it receives from clients.However, to ensure compliance with data privacy rules, JaphSoft pseudonymizes thepersonal data by removing identifyinginformation from the contact information. JaphSoft’s engineers, however, maintain allcontact information in the same database as the identifying information.Under its agreement with Liem and EcoMick, JaphSoft received access to MarketIQ, whichincluded contact information as well as prior purchase history for such contacts, to createcampaigns that would result in the most views of the two companies’ websites. A prior Liemcustomer, Ms. Iman, received a marketing campaign from JaphSoft regarding Liem’s aswell as EcoMick’s latest products. While Ms. Iman recalls checking a box to receiveinformation in the future regarding Liem’s products, she has never shopped EcoMick, norprovided her personal data to that company.Under the GDPR, Liem and EcoMick’s contract with MarketIQ must include all of thefollowing provisions EXCEPT?

A. Processing the personal data upon documented instructions regarding data transfersoutside of the EEA. 
B. Notification regarding third party requests for access to Liem and EcoMick’s personal data. 
C. Assistance to Liem and EcoMick in their compliance with data protection impact assessments.
D. Returning or deleting personal data after the end of the provision of the services.  

Answer: C

Which of the following is NOT recognized as a common characteristic of cloud computingservices?

A. The service's infrastructure is shared among the supplier's customers and can belocated in a number of countries. 
B. The supplier determines the location, security measures, and service standardsapplicable to the processing. 
C. The supplier allows customer data to be transferred around the infrastructure accordingto capacity.  
D. The supplier assumes the vendor's business risk associated with data processed by the supplier. 

Answer: D

SCENARIOPlease use the following to answer the next question:You have just been hired by a toy manufacturer based in Hong Kong. The company sells abroad range of dolls, action figures and plush toys that can be found internationally in awide variety of retail stores. Although the manufacturer has no offices outside Hong Kongand in fact does not employ any staff outside Hong Kong, it has entered into a number oflocal distribution contracts. The toys produced by the company can be found in all populartoy stores throughout Europe, the United States and Asia. A large portion of the company’srevenue is due to international sales.The company now wishes to launch a new range of connected toys, ones that can talk andinteract with children. The CEO of the company is touting these toys as the next big thing,due to the increased possibilities offered: The figures can answer children’s Questions: onvarious subjects, such as mathematical calculations or the weather. Each figure isequipped with a microphone and speaker and can connect to any smartphone or tablet viaBluetooth. Any mobile device within a 10-meter radius can connect to the toys viaBluetooth as well. The figures can also be associated with other figures (from the samemanufacturer) and interact with each other for an enhanced play experience.When a child asks the toy a QUESTION, the request is sent to the cloud for analysis, andthe answer is generated on cloud servers and sent back to the figure. The answer is giventhrough the figure’s integratedspeakers, making it appear as though that the toy is actually responding to the child’sQUESTION. The packaging of the toy does not provide technical details on how this works,nor does it mention that this feature requires an internet connection. The necessary dataprocessing for this has been outsourced to a data center located in South Africa. However,your company has not yet revised its consumer-facing privacy policy to indicate this.In parallel, the company is planning to introduce a new range of game systems throughwhich consumers can play the characters they acquire in the course of playing the game.The system will come bundled with a portal that includes a Near-Field Communications(NFC) reader. This device will read an RFID tag in the action figure, making the figurecome to life onscreen. Each character has its own stock features and abilities, but it is alsopossible to earn additional ones by accomplishing game goals. The only information storedin the tag relates to the figures’ abilities. It is easy to switch characters during the game,and it is possible to bring the figure to locations outside of the home and have thecharacter’s abilities remain intact.To ensure GDPR compliance, what should be the company’s position on the issue ofconsent?

A. The child, as the user of the action figure, can provide consent himself, as long as noinformation is shared for marketing purposes. 
B. Written authorization attesting to the responsible use of children’s data would need to beobtained from the supervisory authority. 
C. Consent for data collection is implied through the parent’s purchase of the action figurefor the child. 
D. Parental consent for a child’s use of the action figures would have to be obtained beforeany data could be collected. 

Answer: D

Bioface is a company based in the United States. It has no servers, personnel or assets inthe European Union. By collecting photographs from social media and other web-basedservices, such as newspapers and blogs, it uses machine learning to develop a facialrecognition algorithm. The algorithm identifies individuals in photographs who are not in itsdata set based the algorithm and its existing data. The service collects photographs of datasubjects in the European Union and will identify them if presented with their photographs.Bioface offers its service to government agencies and companies in the United States andCanada, but not to those in the European Union. Bioface does not offer the service toindividuals.Why is Bioface subject to the territorial scope of the General Data Protection Regulation?

A. It collects data from European Union websites, which constitutes an establishment in theEuropean Union. 
B. It offers services in the European Union by identifying data subjects in the European Union. 
C. It collects data from subjects and uses it for automated processing.  
D. It monitors the behavior of data subjects in the European Union.  

Answer: D

Which of the following is NOT a role of works councils? 

A. Determining the monetary fines to be levied against employers for data breach violationsof employee data. 
B. Determining whether to approve or reject certain decisions of the employer that affectemployees. 
C. Determining whether employees’ personal data can be processed or not.  
D. Determining what changes will affect employee working conditions.  

Answer: A

SCENARIOPlease use the following to answer the next question:You have just been hired by a toy manufacturer based in Hong Kong. The company sells abroad range of dolls, action figures and plush toys that can be found internationally in awide variety of retail stores. Although the manufacturer has no offices outside Hong Kongand in fact does not employ any staff outside Hong Kong, it has entered into a number oflocal distribution contracts. The toys produced by the company can be found in all populartoy stores throughout Europe, the United States and Asia. A large portion of the company’srevenue is due to international sales.The company now wishes to launch a new range of connected toys, ones that can talk andinteract with children. The CEO of the company is touting these toys as the next big thing,due to the increased possibilities offered: The figures can answer children’s Questions: onvarious subjects, such as mathematical calculations or the weather. Each figure isequipped with a microphone and speaker and can connect to any smartphone or tablet viaBluetooth. Any mobile device within a 10-meter radius can connect to the toys viaBluetooth as well. The figures can also be associated with other figures (from the samemanufacturer) and interact with each other for an enhanced play experience.When a child asks the toy a question, the request is sent to the cloud for analysis, and theanswer is generated on cloud servers and sent back to the figure. The answer is giventhrough the figure’s integratedspeakers, making it appear as though that the toy is actually responding to the child’squestion. The packaging of the toy does not provide technical details on how this works,nor does it mention that this feature requires an internet connection. The necessary dataprocessing for this has been outsourced to a data center located in South Africa. However,your company has not yet revised its consumer-facing privacy policy to indicate this.In parallel, the company is planning to introduce a new range of game systems throughwhich consumers can play the characters they acquire in the course of playing the game.The system will come bundled with a portal that includes a Near-Field Communications(NFC) reader. This device will read an RFID tag in the action figure, making the figurecome to life onscreen. Each character has its own stock features and abilities, but it is alsopossible to earn additional ones by accomplishing game goals. The only information storedin the tag relates to the figures’ abilities. It is easy to switch characters during the game,and it is possible to bring the figure to locations outside of the home and have thecharacter’s abilities remain intact.What presents the BIGGEST potential privacy issue with the company’s practices?

A. The NFC portal can read any data stored in the action figures  
B. The information about the data processing involved has not been specified  
C. The cloud service provider is in a country that has not been deemed adequate  
D. The RFID tag in the action figures has the potential for misuse because of the toy’sevolving capabilities 

Answer: B

What must a data controller do in order to make personal data pseudonymous? 

A. Separately hold any information that would allow linking the data to the data subject.  
B. Encrypt the data in order to prevent any unauthorized access or modification.  
C. Remove all indirect data identifiers and dispose of them securely.  
D. Use the data only in aggregated form for research purposes.  

Answer: A

SCENARIOPlease use the following to answer the next question:Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of amultinational pharmaceutical company on a clinical trial related to COVID-19. As part of hisonboarding process Jack received privacy training He was explicitly informed that while hewould need to process confidential patient data in the course of his work, he may under nocircumstances use this data for anything other than the performance of work-related (asksThis was also specified in the privacy policy, which Jack signed upon conclusion of thetraining.After several months of employment, Jack got into an argument with a patient over thephone. Out of anger he later posted the patient's name and hearth information, along withdisparaging comments, on a social media website. When this was discovered by hisPharmacovigilance supervisors. Jack was immediately dismissedJack's lawyer sent a letter to the company stating that dismissal was a disproportionatesanction, and that if Jack was not reinstated within 14 days his firm would have noalternative but to commence legal proceedings against the company. This letter wasaccompanied by a data access request from Jack requesting a copy of "all personal data,including internal emails that were sent/received by Jack or where Jack is directly orindirectly identifiable from the contents In relation to the emails Jack listed six members ofthe management team whose inboxes he required access.The company conducted an initial search of its IT systems, which returned a large amountof information They then contacted Jack, requesting that he be more specific regardingwhat information he required, so that they could carry out a targeted search Jackresponded by stating that he would not narrow the scope of the information requester.Under Article 82 of the GDPR ("Right to compensation and liability-), which party is liablefor the damage caused by the data breach?

A. Both parties are exempt, as the company is involved in human health research  
B. Jack and the pharmaceutical company are jointly liable.  
C. The pharmaceutical company is liable.  
D. Jack is liable  

Answer: D

Which of the following Convention 108+ principles, as amended in 2018, is NOT consistentwith a principle found in the GDPR?

A. The obligation of companies to declare data breaches.  
B. The requirement to demonstrate compliance to a supervisory authority.  
C. The necessity of the bulk collection of personal data by the government.  

Answer: C

What ruling did the Planet 49 CJEU judgment make regarding the issue of pre-tickedboxes?

A. They are allowed if determined to be technically necessary.  
B. They do not amount to valid consent under any circumstances.  
C. They are allowed if recorded In the register of processing activities.  
D. They constitute valid consent if the processing is necessary for purposes of legitimate interest

Answer: D

The European Parliament jointly exercises legislative and budgetary functions with which ofthe following?

A. The European Commission.  
B. The Article 29 Working Party.  
C. The Council of the European Union.  
D. The European Data Protection Board.  

Answer: C

A multinational company is appointing a mandatory data protection officer. In addition toconsidering the rules set out in Article 37 (1) of the GDPR, which of the following actionsmust the company also undertake to ensure compliance in all EU jurisdictions in which itoperates?

A. Consult national derogations to evaluate if there are additional cases to be considered inrelation to the matter. 
B. Conduct a Data Protection Privacy Assessment on the processing operations of thecompany in all the countries it operates.
C. Assess whether the company has more than 250 employees in each of the EU memberstates in which it is established. 
D. Revise the data processing activities of the company that affect more than onejurisdiction to evaluate whether they comply with the principles of privacy by design and bydefault. 

Answer: A

SCENARIOPlease use the following to answer the next question:Gentle Hedgehog Inc. is a privately owned website design agency incorporated inItaly. The company has numerous remote workers in different EU countries. Recently,the management of Gentle Hedgehog noticed a decrease in productivity of their salesteam, especially among remote workers. As a result, the company plans to implementa robust but privacy-friendly remote surveillance system to prevent absenteeism,reward top performers, and ensure the best quality of customer service when salespeople are interacting with customers.Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employeesurveillance software whose European headquarters is in Germany. Sauron Eye'ssoftware provides powerful remote-monitoring capabilities, including 24/7 access tocomputer cameras and microphones, screen captures, emails, website history, andkeystrokes. Any device can be remotely monitored from a central server that issecurely installed at Gentle Hedgehog headquarters. The monitoring is invisible bydefault; however, a so-called Transparent Mode, which regularly and conspicuouslynotifies all users about the monitoring and its precise scope, also exists. Additionally,the monitored employees are required to use a built-in verification technologyinvolving facial recognition each time they log in.All monitoring data, including the facial recognition data, is securely stored in MicrosoftAzure cloud servers operated by Sauron Eye, which are physically located in France.What is the main problem with the 24/7 camera monitoring?

A. It must not be operated during non-business hours and employee holidays.  
B. It may accidentally film third parties whose consent is required for monitoring.  
C. It has no valid legal basis to be implemented in the context of Gentle Hedgehog's business.  
D. It must first be approved by the trade union and then granted a license from the nationalDPA. 

Answer: C

Under Article 21 of the GDPR, a controller must stop profiling when requested by a datasubject, unless it can demonstrate compelling legitimate grounds that override the interestsof the individual. In the Guidelines on Automated individual decision-making and Profiling,the WP 29 says the controller needs to do all of the following to demonstrate that it hassuch legitimate grounds EXCEPT?

A. Carry out an exercise that weighs the interests of the controller and the basis for thedata subject’s objection. 
B. Consider the impact of the profiling on the data subject’s interest, rights and freedoms.  
C. Demonstrate that the profiling is for the purposes of direct marketing.  
D. Consider the importance of the profiling to their particular objective.  

Answer: C

SCENARIOPlease use the following to answer the next question:T-Craze, a German-headquartered specialty t-shirt company, was successfully selling tolarge German metropolitan cities. However, after a recent merger with another Germanbased company that was selling to a broader European market, T-Craze revamped itsmarketing efforts to sell to a wider audience. These efforts included a complete redesign ofits logo to reflect the recent merger, and improvements to its website meant to capturemore information about visitors through the use of cookies.T-Craze also opened various office locations throughout Europe to help expand itsbusiness. While GermanyTarget, a renowned marketing firm based in the Philippines, to run its latest marketingcampaign. After thorough research, Right Target determined that T-Craze is mostsuccessful with customers between the ages of 18 and 22. Thus, its first campaign targeteduniversity students in several European capitals, which yielded nearly 40% new customersfor T-Craze in one quarter. Right Target also ran subsequent campaigns for T- Craze,though with much less success.The last two campaigns included a wider demographic group and resulted in countlessunsubscribe requests, including a large number in Spain. In fact, the Spanish dataprotection authority received a complaint from Sofia, a mid-career investment banker. Sofiawas upset after receiving a marketing communication even after unsubscribing from suchcommunications from the Right Target on behalf of T-Craze.What is the best option for the lead regulator when responding to the Spanish supervisoryauthority’s notice that it plans to take action regarding Sofia’s complaint?

A. Accept, because it did not receive any complaints.  
B. Accept, because GDPR permits non-lead authorities to take action for such complaints.  
C. Reject, because Right Target’s processing was conducted throughout Europe.  
D. Reject, because GDPR does not allow other supervisory authorities to take action ifthere is a lead authority. 

Answer: B