CIPP-E exam questions for practice in 2023 Updated 252 Questions
Updated Dec-2023 Premium CIPP-E Exam Engine pdf - Download Free Updated 252 Questions
You can read the benefits in Obtaining the IAPP CIPP/E Exam Certification
- Maintaining a CIPP / E classification increases your management profile with your employees. CIPP / E is a crucial standard among major employers for the employment and advertising of privacy specialists.
- Obtaining a CIPP / E degree demonstrates an understanding of a framework of principles and a database for information privacy in the European context, including vital issues such as the EU-US. Privacy Guard and GDPR (consisting of the required DPOs).
- You will be recognized as part of an elite group of privacy experts and experts and data protection experts.
- CIPP is the international sector requirement for professionals entering and operating in the field of privacy.
NEW QUESTION # 51
Many businesses print their employees' photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?
- A. Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption.
- B. Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer.
- C. Because photographs qualify as biometric data only when they undergo a "specific technical processing".
- D. Because photographic ID is a physical security measure which is "necessary for reasons of substantial public interest".
Answer: C
Explanation:
Reference https://ess.csa.canon.com/rs/206-CLL-191/images/IAPP-Top-10-Operational-Impacts-of- GDPR.pdf?TC=DM&CN=CSA_OMNIA_Partners&CS=CSA&CR=T1_Gov%20GenNonProfit (11)
NEW QUESTION # 52
SCENARIO
Please use the following to answer the next question:
Brady is a computer programmer based in New Zealand who has been running his own business for two years. Brady's business provides a low-cost suite of services to customers throughout the European Economic Area (EEA). The services are targeted towards new and aspiring small business owners. Brady's company, called Brady Box, provides web page design services, a Social Networking Service (SNS) and consulting services that help people manage their own online stores.
Unfortunately, Brady has been receiving some complaints. A customer named Anna recently uploaded her plans for a new product onto Brady Box's chat area, which is open to public viewing. Although she realized her mistake two weeks later and removed the document, Anna is holding Brady Box responsible for not noticing the error through regular monitoring of the website. Brady believes he should not be held liable.
Another customer, Felipe, was alarmed to discover that his personal information was transferred to a third- party contractor called Hermes Designs and worries that sensitive information regarding his business plans may be misused. Brady does not believe he violated European privacy rules. He provides a privacy notice to all of his customers explicitly stating that personal data may be transferred to specific third parties in fulfillment of a requested service. Felipe says he read the privacy notice but that it was long and complicated Brady continues to insist that Felipe has no need to be concerned, as he can personally vouch for the integrity of Hermes Designs. In fact, Hermes Designs has taken the initiative to create sample customized banner advertisements for customers like Felipe. Brady is happy to provide a link to the example banner ads, now posted on the Hermes Designs webpage. Hermes Designs plans on following up with direct marketing to these customers.
Brady was surprised when another customer, Serge, expressed his dismay that a quotation by him is being used within a graphic collage on Brady Box's home webpage. The quotation is attributed to Serge by first and last name. Brady, however, was not worried about any sort of litigation. He wrote back to Serge to let him know that he found the quotation within Brady Box's Social Networking Service (SNS), as Serge himself had posted the quotation. In his response, Brady did offer to remove the quotation as a courtesy.
Despite some customer complaints, Brady's business is flourishing. He even supplements his income through online behavioral advertising (OBA) via a third-party ad network with whom he has set clearly defined roles. Brady is pleased that, although some customers are not explicitly aware of the OBA, the advertisements contain useful products and services.
Based on the scenario, what is the main reason that Brady should be concerned with Hermes Designs' handling of customer personal data?
- A. The data is uncategorized.
- B. The data is being processed via a new means.
- C. The data is sensitive.
- D. The data is being used for a new purpose.
Answer: B
NEW QUESTION # 53
A Spanish electricity customer calls her local supplier with questions about the company's upcoming merger.
Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?
- A. Verify that the purpose of the request from the customer is in line with the GDPR.
- B. Verify that the personal data has not already been sent to the customer.
- C. Verify that the request is applicable to the data collected before the GDPR entered into force.
- D. Verify that the identity of the customer can be proven by other means.
Answer: C
Explanation:
Explanation/Reference: https://fpf.org/wp-content/uploads/2018/11/GDPR_CCPA_Comparison-Guide.pdf
NEW QUESTION # 54
Which aspect of the GDPR will likely have the most impact on the consistent implementation of data protection laws throughout the European Union?
- A. That it makes appointment of a data protection officer mandatory
- B. That it takes the form of a Regulation as opposed to a Directive
- C. That it essentially functions as a one-stop shop mechanism
- D. That it makes notification of large-scale data breaches mandatory
Answer: A
Explanation:
Reference https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en
NEW QUESTION # 55
SCENARIO
Please use the following to answer the next question:
WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of their service, WonderKids will pass all personal data provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person booking the childcare, address and contact details, as well as information about the children to be cared for including name, age, gender and health information. The privacy statement on Wonderkids' website states the following:
"WonderkKids provides the information you disclose to us through this website to your childcare provider for scheduling and health and safety reasons. We may also use your and your child's personal information for our own legitimate business purposes and we employ a third-party website hosting company located in Switzerland to store the dat a. Any data stored on equipment located in Switzerland meets the European Commission provisions for guaranteeing adequate safeguards for you and your child's personal information. We will only share you and your child's personal information with businesses that we see as adding real value to you. By providing us with any personal data, you consent to its transfer to affiliated businesses and to send you promotional offers."
"We may retain you and your child's personal information for no more than 28 days, at which point the data will be depersonalized, unless your personal information is being used for a legitimate business purpose beyond 28 days where it may be retained for up to 2 years."
"We are processing you and your child's personal information with your consent. If you choose not to provide certain information to us, you may not be able to use our services. You have the right to: request access to you and your child's personal information; rectify or erase you or your child's personal information; the right to correction or erasure of you and/or your child's personal information; object to any processing of you and your child's personal information. You also have the right to complain to the supervisory authority about our data processing activities." What additional information must Wonderkids provide in their Privacy Statement?
- A. Contact information of the hosting company.
- B. How often promotional emails will be sent.
- C. The categories of recipients with whom data will be shared.
- D. Technical and organizational measures to protect data.
Answer: C
NEW QUESTION # 56
According to the E-Commerce Directive 2000/31/EC, where is the place of "establishment" for a company providing services via an Internet website confirmed by the GDPR?
- A. Where the technology supporting the website is located
- B. Where the customer's Internet service provider is located
- C. Where the website is accessed
- D. Where the decisions about processing are made
Answer: B
Explanation:
Reference https://www.ohiobar.org/member-tools-benefits/publications/Ohio-Lawyer/the-european-general- data-protection-regulation-gdpr/
NEW QUESTION # 57
Which of the following was the first legally binding international instrument in the area of data protection?
- A. EU Directive on Privacy and Electronic Communications.
- B. Convention 108.
- C. General Data Protection Regulation.
- D. Universal Declaration of Human Rights.
Answer: B
Explanation:
Reference https://www.coe.int/en/web/data-protection/convention108/background
NEW QUESTION # 58
Which of the following would require designating a data protection officer?
- A. Processing is carried out for the purpose of providing for-profit goods or services to individuals in the EU.
- B. Processing is carried out by an organization employing 250 persons or more.
- C. The core activities of the controller or processor consist of processing operations of financial information or information relating to children.
- D. The core activities of the controller or processor consist of processing operations that require systematic monitoring of data subjects on a large scale.
Answer: D
Explanation:
Explanation/Reference: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection- regulation-gdpr/accountability-and-governance/data-protection-officers/
NEW QUESTION # 59
Which GDPR principle would a Spanish employer most likely depend upon to annually send the personal data of its employees to the national tax authority?
- A. The consent of the employees.
- B. The legal obligation of the employer.
- C. The legitimate interest of the public administration.
- D. The protection of the vital interest of the employees.
Answer: B
Explanation:
Reference https://www.huntonprivacyblog.com/2020/03/25/spanish-dpa-publishes-report-on-data-processing- activities-in-relation-to-covid-19/
NEW QUESTION # 60
When would a data subject NOT be able to exercise the right to portability?
- A. When the processing is carried out pursuant to a contract with the data subject.
- B. When the processing is based on consent.
- C. When the processing is necessary to perform a task in the exercise of authority vested in the controller.
- D. When the data was supplied to the controller by the data subject.
Answer: C
Explanation:
Reference https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection- regulation-gdpr/individual-rights/right-to-data-portability/
NEW QUESTION # 61
What are the obligations of a processor that engages a sub-processor?
- A. The processor must obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor.
- B. The processor must receive a written agreement that the sub-processor will be fully liable to the controller for the performance of its obligations in relation to the personal data concerned.
- C. The processor must obtain the controller's specific written authorization and provide annual reports on the sub-processor's performance.
- D. The processor must give the controller prior written notice and perform a preliminary audit of the sub- processor.
Answer: B
Explanation:
Reference https://inplp.com/latest-news/article/gdpr-rights-and-obligations-of-sub-processors/
NEW QUESTION # 62
Higher fines are assessed for GDPR violations due to which of the following?
- A. Failure to notify a supervisory authority and data subjects of a personal data breach
- B. Violations of a data controller's obligations to obtain a child's consent
- C. Violations of a data subject"s rights
- D. Failure to appoint a data protection officer.
Answer: B
NEW QUESTION # 63
Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?
- A. The data protection officer must be located in the country where the data controller has its main establishment.
- B. The data protection officer must be easily accessible from each establishment where the undertakings are located.
- C. The group of undertakings must be comprised of organizations of similar sizes and functions.
- D. The group of undertakings must obtain approval from a supervisory authority.
Answer: B
Explanation:
Explanation/Reference: https://www.privacy-regulation.eu/en/article-37-designation-of-the-data-protection-officer- GDPR.htm
NEW QUESTION # 64
SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
What are ABC Hotel Chain and XYZ Travel Agency's roles in this relationship?
- A. ABC Hotel Chain and XYZ Travel Agency are joint controllers.
- B. XYZ Travel Agency is the controller and ABC Hotel Chain is the processor.
- C. ABC Hotel Chain is the controller and XYZ Travel Agency is the processor.
- D. ABC Hotel Chain and XYZ Travel Agency are independent controllers.
Answer: A
NEW QUESTION # 65
Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?
- A. Data controllers must be in control of the data they hold at all times.
- B. Personal data of data subjects must always be accurate and kept up to date.
- C. Processing of special categories of personal data on a large scale requires appointing a DPO.
- D. Data subjects must be sufficiently informed of the purposes for which their personal data is processed.
Answer: A
NEW QUESTION # 66
SCENARIO
Please use the following to answer the next question:
Brady is a computer programmer based in New Zealand who has been running his own business for two years. Brady's business provides a low-cost suite of services to customers throughout the European Economic Area (EEA). The services are targeted towards new and aspiring small business owners. Brady's company, called Brady Box, provides web page design services, a Social Networking Service (SNS) and consulting services that help people manage their own online stores.
Unfortunately, Brady has been receiving some complaints. A customer named Anna recently uploaded her plans for a new product onto Brady Box's chat area, which is open to public viewing. Although she realized her mistake two weeks later and removed the document, Anna is holding Brady Box responsible for not noticing the error through regular monitoring of the website. Brady believes he should not be held liable.
Another customer, Felipe, was alarmed to discover that his personal information was transferred to a third- party contractor called Hermes Designs and worries that sensitive information regarding his business plans may be misused. Brady does not believe he violated European privacy rules. He provides a privacy notice to all of his customers explicitly stating that personal data may be transferred to specific third parties in fulfillment of a requested service. Felipe says he read the privacy notice but that it was long and complicated Brady continues to insist that Felipe has no need to be concerned, as he can personally vouch for the integrity of Hermes Designs. In fact, Hermes Designs has taken the initiative to create sample customized banner advertisements for customers like Felipe. Brady is happy to provide a link to the example banner ads, now posted on the Hermes Designs webpage. Hermes Designs plans on following up with direct marketing to these customers.
Brady was surprised when another customer, Serge, expressed his dismay that a quotation by him is being used within a graphic collage on Brady Box's home webpage. The quotation is attributed to Serge by first and last name. Brady, however, was not worried about any sort of litigation. He wrote back to Serge to let him know that he found the quotation within Brady Box's Social Networking Service (SNS), as Serge himself had posted the quotation. In his response, Brady did offer to remove the quotation as a courtesy.
Despite some customer complaints, Brady's business is flourishing. He even supplements his income through online behavioral advertising (OBA) via a third-party ad network with whom he has set clearly defined roles. Brady is pleased that, although some customers are not explicitly aware of the OBA, the advertisements contain useful products and services.
Based on current trends in European privacy practices, which aspect of Brady Box' Online Behavioral Advertising (OBA) is most likely to be insufficient if the company becomes established in Europe?
- A. The contract with the third-party advertising network.
- B. The level of security within the website.
- C. The need to have the contents of the advertising approved.
Section: (none)
Explanation - D. The lack of the option to opt in.
Answer: D
NEW QUESTION # 67
It a company receives an anonymous email demanding ransom for the stolen personal data of its clients, what must the company do next, per GDPR requirements'3
- A. Start an investigation to understand the incident's possible scope, duration and nature
- B. Send a notification to the competent supervisory authority describing the incident.
- C. Send an email about the incident to all clients and ask them to change their passwords
- D. Notify the police and Tile a criminal complaint about the incident
Answer: B
NEW QUESTION # 68
Please use the following to answer the next question:
ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorage What transfer mechanism did ProStorage most likely rely on to transfer Ruth's medical information to the hospital?
- A. Ruth's implied consent.
- B. Performance of a contract with Ruth.
- C. Protecting against legal liability from Ruth.
- D. Protecting the vital interest of Ruth
Answer: C
NEW QUESTION # 69
SCENARIO
Please use the following to answer the next question:
TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business.
During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations. TripBliss Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services.
Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered.
With regard to TripBliss Inc.'s use of website cookies, which of the following statements is correct?
- A. Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers.
- B. Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.
- C. Because Techiva will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary.
- D. Because not all of the cookies are strictly necessary to enable the use of a service requested from TripBliss Inc., consent requirements apply to their use of cookies.
Answer: A
NEW QUESTION # 70
An entity's website stores text files on EU users' computer and mobile device browsers. Prior to doing so, the entity is required to provide users with notices containing information and consent under which of the following frameworks?
- A. General Data Protection Regulation 2016/679.
- B. E-Commerce Directive 2000/31/EC.
- C. E-Privacy Directive 2002/58/EC.
- D. Data Protection Directive 95/46/EC.
Answer: C
NEW QUESTION # 71
......
Authentic CIPP-E Dumps With 100% Passing Rate Practice Tests Dumps: https://actualtests.realvalidexam.com/CIPP-E-real-exam-dumps.html
