Question 1

When would a data subject NOT be able to exercise the right to portability?

Accepted Answer

A)  When the processing is necessary to perform a task in the exercise of authority vested in the controller. 
B)  When the processing is carried out pursuant to a contract with the data subject. 
C)  When the data was supplied to the controller by the data subject. 
D)  When the processing is based on consent.

Question 2

What obligation does a data controller or processor have after appointing a data protection officer?

Accepted Answer

A)  To ensure that the data protection officer receives sufficient instructions regarding the exercise of his or her defined tasks. 
B)  To provide resources necessary to carry out the defined tasks of the data protection officer and to maintain his or her expert knowledge. 
C)  To ensure that the data protection officer acts as the sole point of contact for individuals' questions about their personal data. 
D)  To submit for approval to the data protection officer a code of conduct to govern organizational practices and demonstrate compliance with data protection principles.

Question 3

If a company is planning to use closed-circuit television (CCTV) on its premises and is concerned with GDPR compliance, it should first do all of the following EXCEPT?

Accepted Answer

A)  Notify the appropriate data protection authority. 
B)  Perform a data protection impact assessment (DPI
A) . 
C)  Create an information retention policy for those who operate the system. 
D)  Ensure that safeguards are in place to prevent unauthorized access to the footage.

Question 4

Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?

Accepted Answer

A)  Data subjects must be sufficiently informed of the purposes for which their personal data is processed. 
B)  Processing of special categories of personal data on a large scale requires appointing a DPO. 
C)  Personal data of data subjects must always be accurate and kept up to date. 
D)  Data controllers must be in control of the data they hold at all times.

Question 5

A worker in a European Union (EU) member state has ceased his employment with a company. What should the employer most likely do in regard to the worker's personal data?

Accepted Answer

A)  Destroy sensitive information and store the rest per applicable data protection rules. 
B)  Store all of the data in case the departing worker makes a subject access request. 
C)  Securely store the data that is required to be kept under local law. 
D)  Provide the employee the reasons for retaining the data.

Question 6

What is a reason the European Court of Justice declared the Data Retention Directive invalid in 2014?

Accepted Answer

A)  The requirements affected individuals without exception. 
B)  The requirements were financially burdensome to EU businesses. 
C)  The requirements specified that data must be held within the EU. 
D)  The requirements had limitations on how national authorities could use data.

Question 7

In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?

Accepted Answer

A)  Where the DPIA identifies that personal data needs to be transferred to other countries outside of the EEA. 
B)  Where the DPIA identifies high risks to individuals' rights and freedoms that the controller can take steps to reduce. 
C)  Where the DPIA identifies that the processing being proposed collects the sensitive data of EU citizens. 
D)  Where the DPIA identifies risks that will require insurance for protecting its business interests.

Question 8

SCENARIO Please use the following to answer the next question: Javier is a member of the fitness club EVERFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Javier lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Javier was photographed while working out at a branch of EVERFIT in Frankfurt, Germany. At the time, Javier gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Javier no longer feels comfortable with his photograph being publicly associated with the fitness club. After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Javier sends a letter to EVETFIT requesting that his image be removed from the website and all promotional materials. Months pass and Javier, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact EVETFIT through alternate channels, he decides to take action against the company. Javier contacts the U.K. Information Commissioner's Office ('ICO' - the U.K.'s supervisory authority) to lodge a complaint about this matter. The ICO, pursuant to Article 56 (3) of the GDPR, informs the CNIL (i.e. the supervisory authority of EVERFIT's main establishment) about this matter. Despite the fact that EVERFIT has an establishment in the U.K., the CNIL decides to handle the case in accordance with Article 60 of the GDPR. The CNIL liaises with the ICO, as relevant under the cooperation procedure. In light of issues amongst the supervisory authorities to reach a decision, the European Data Protection Board becomes involved and, pursuant to the consistency mechanism, issues a binding decision. Additionally, Javier sues EVERFIT for the damages caused as a result of its failure to honor his request to have his photograph removed from the brochure and website. Under the cooperation mechanism, what should the lead authority (the CNIL) do after it has formed its view on the matter?

Accepted Answer

A)  Submit a draft decision to other supervisory authorities for their opinion. 
B)  Request that the other supervisory authorities provide the lead authority with a draft decision for its consideration. 
C)  Submit a draft decision directly to the Commission to ensure the effectiveness of the consistency mechanism. 
D)  Request that members of the seconding supervisory authority and the host supervisory authority co-draft a decision.

Question 9

SCENARIO Please use the following to answer the next question: Liem, an online retailer known for its environmentally friendly shoes, has recently expanded its presence in Europe. Anxious to achieve market dominance, Liem teamed up with another eco friendly company, EcoMick, which sells accessories like belts and bags. Together the companies drew up a series of marketing campaigns designed to highlight the environmental and economic benefits of their products. After months of planning, Liem and EcoMick entered into a data sharing agreement to use the same marketing database, MarketIQ, to send the campaigns to their respective contacts. Liem and EcoMick also entered into a data processing agreement with MarketIQ, the terms of which included processing personal data only upon Liem and EcoMick's instructions, and making available to them all information necessary to demonstrate compliance with GDPR obligations. Liem and EcoMick then procured the services of a company called JaphSoft, a marketing optimization firm that uses machine learning to help companies run successful campaigns. Clients provide JaphSoft with the personal data of individuals they would like to be targeted in each campaign. To ensure protection of its clients' data, JaphSoft implements the technical and organizational measures it deems appropriate. JaphSoft works to continually improve its machine learning models by analyzing the data it receives from its clients to determine the most successful components of a successful campaign. JaphSoft then uses such models in providing services to its client-base. Since the models improve only over a period of time as more information is collected, JaphSoft does not have a deletion process for the data it receives from clients. However, to ensure compliance with data privacy rules, JaphSoft pseudonymizes the personal data by removing identifying information from the contact information. JaphSoft's engineers, however, maintain all contact information in the same database as the identifying information. Under its agreement with Liem and EcoMick, JaphSoft received access to MarketIQ, which included contact information as well as prior purchase history for such contacts, to create campaigns that would result in the most views of the two companies' websites. A prior Liem customer, Ms. Iman, received a marketing campaign from JaphSoft regarding Liem's as well as EcoMick's latest products. While Ms. Iman recalls checking a box to receive information in the future regarding Liem's products, she has never shopped EcoMick, nor provided her personal data to that company. Under the GDPR, Liem and EcoMick's contract with MarketIQ must include all of the following provisions EXCEPT?

Accepted Answer

A)  Processing the personal data upon documented instructions regarding data transfers outside of the EEA. 
B)  Notification regarding third party requests for access to Liem and EcoMick's personal data. 
C)  Assistance to Liem and EcoMick in their compliance with data protection impact assessments. 
D)  Returning or deleting personal data after the end of the provision of the services.

Question 10

Under the Data Protection Law Enforcement Directive of the EU, a government can carry out covert investigations involving personal data, as long it is set forth by law and constitutes a measure that is both necessary and what?

Accepted Answer

A)  Prudent. 
B)  Important. 
C)  Proportionate. 
D)  DPA-approved.

Question 11

In addition to the European Commission, who can adopt standard contractual clauses, assuming that all required conditions are met?

Accepted Answer

A)  Approved data controllers. 
B)  The Council of the European Union. 
C)  National data protection authorities. 
D)  The European Data Protection Supervisor.

Question 12

The GDPR specifies fines that may be levied against data controllers for certain infringements. Which of the following infringements would be subject to the less severe administrative fine of up to 10 million euros (or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year)?

Accepted Answer

A)  Failure to demonstrate that consent was given by the data subject to the processing of their personal data where it is used as the basis for processing. 
B)  Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default. 
C)  Failure to process personal information in a manner compatible with its original purpose. 
D)  Failure to provide the means for a data subject to rectify inaccuracies in personal data.

Question 13

Under the GDPR, which of the following is true in regard to adequacy decisions involving cross-border transfers?

Accepted Answer

A)  The European Commission can adopt an adequacy decision for individual companies. 
B)  The European Commission can adopt, repeal or amend an existing adequacy decision. 
C)  EU member states are vested with the power to accept or reject a European Commission adequacy decision. 
D)  To be considered as adequate, third countries must implement the EU General Data Protection Regulation into their national legislation.

Question 14

A key component of the OECD Guidelines is the "Individual Participation Principle". What parts of the General Data Protection Regulation (GDPR) provide the closest equivalent to that principle?

Accepted Answer

A)  The lawful processing criteria stipulated by Articles 6 to 9 
B)  The information requirements set out in Articles 13 and 14 
C)  The breach notification requirements specified in Articles 33 and 34 
D)  The rights granted to data subjects under Articles 12 to 22

Question 15

SCENARIO Please use the following to answer the next question: TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business. During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed questionnaires, which could be used to tailor their preferences to specific travel destinations. TripBliss Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the questionnaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services. Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered. With regard to TripBliss Inc.'s use of website cookies, which of the following statements is correct?

Accepted Answer

A)  Because not all of the cookies are strictly necessary to enable the use of a service requested from TripBliss Inc., consent requirements apply to their use of cookies. 
B)  Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers. 
C)  Because Techiva will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary. 
D)  Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.

Question 16

As a result of the European Court of Justice's ruling in the case of Google v. Spain, search engines outside the EEA are also likely to be subject to the Regulation's right to be forgotten. This holds true if the activities of an EU subsidiary and its U.S. parent are what?

Accepted Answer

A)  Supervised by the same Data Protection Officer. 
B)  Consistent with Privacy Shield requirements 
C)  Bound by a standard contractual clause. 
D)  Inextricably linked in their businesses.

Question 17

SCENARIO Please use the following to answer the next question: Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B. Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry. Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees: Name Address Date of Birth Payroll number National Insurance number Sick pay entitlement Maternity/paternity pay entitlement Holiday entitlement Pension and benefits contributions Trade union contributions Jenny is the compliance officer at Company A. She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required. Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract. Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B. This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes. Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees. Under the GDPR, which of Company B's actions would NOT be likely to trigger a potential enforcement action?

Accepted Answer

A)  Their omission of data protection provisions in their contract with Company C . 
B)  Their failure to provide sufficient security safeguards to Company A's data. 
C)  Their engagement of Company C to improve their payroll service. 
D)  Their decision to operate without a data protection officer.

Question 18

Under the GDPR, who would be LEAST likely to be allowed to engage in the collection, use, and disclosure of a data subject's sensitive medical information without the data subject's knowledge or consent?

Accepted Answer

A)  A member of the judiciary involved in adjudicating a legal dispute involving the data subject and concerning the health of the data subject. 
B)  A public authority responsible for public health, where the sharing of such information is considered necessary for the protection of the general populace. 
C)  A health professional involved in the medical care for the data subject, where the data subject's life hinges on the timely dissemination of such information. 
D)  A journalist writing an article relating to the medical condition in question, who believes that the publication of such information is in the public interest.

Question 19

When is data sharing agreement MOST likely to be needed?

Accepted Answer

A)  When anonymized data is being shared. 
B)  When personal data is being shared between commercial organizations acting as joint data controllers. 
C)  When personal data is being proactively shared by a controller to support a police investigation. 
D)  When personal data is being shared with a public authority with powers to require the personal data to be disclosed.

Question 20

Under which of the following conditions does the General Data Protection Regulation NOT apply to the processing of personal data?

Accepted Answer

A)  When the personal data is processed only in non-electronic form 
B)  When the personal data is collected and then pseudonymised by the controller 
C)  When the personal data is held by the controller but not processed for further purposes 
D)  When the personal data is processed by an individual only for their household activities

Exam 3: Certified Information Privacy Professional/Europe (CIPP/E)