Latest [Jul 29, 2023] IAPP CIPP-E Real Exam Dumps PDF
CIPP-E Practice Test Questions Updated 252 Questions
NEW QUESTION # 15
When collecting personal data in a European Union (EU) member state, what must a company do if it collects personal data from a source other than the data subjects themselves?
- A. Inform the subjects about the collection
- B. Provide a public notice regarding the data
- C. Update the data within a reasonable timeframe
- D. Upgrade security to match that of the source
Answer: A
NEW QUESTION # 16
According to Article 14 of the GDPR, how long does a controller have to provide a data subject with necessary privacy information, if that subject's personal data has been obtained from other sources?
- A. As soon as possible after obtaining the personal data.
- B. Within a reasonable period after obtaining the personal data, but no later than eight weeks.
- C. Within a reasonable period after obtaining the personal data, but no later than one month.
- D. As soon as possible after the first communication with the data subject.
Answer: C
Explanation:
Reference https://dataprivacymanager.net/gdpr-exemptions-from-the-obligation-to-provide-information-to-the- individual-data-subject/
NEW QUESTION # 17
Under which of the following conditions does the General Data Protection Regulation NOT apply to the processing of personal data?
- A. When the personal data is processed by an individual only for their household activities
- B. When the personal data is processed only in non-electronic form
- C. When the personal data is collected and then pseudonymised by the controller
- D. When the personal data is held by the controller but not processed for further purposes
Answer: C
Explanation:
Reference https://gdpr-info.eu/art-6-gdpr/
NEW QUESTION # 18
Which type of personal data does the GDPR define as a "special category" of personal data?
- A. Trade-union membership.
- B. Educational history.
- C. Financial information.
- D. Closed Circuit Television (CCTV) footage.
Answer: A
NEW QUESTION # 19
Which sentence best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?
- A. Employees must sign an ad hoc contractual agreement each time personal data is exported.
- B. Employees who control personal data must complete a rigorous certification procedure, as they are exempt from legal enforcement.
- C. All employees must follow the privacy regulations of the jurisdictions where the current scope of their work is established.
- D. All employees are subject to the rules in their entirety, regardless of where the work is taking place.
Answer: C
NEW QUESTION # 20
Which sentence BEST summarizes the concepts of "fairness," "lawfulness" and "transparency", as expressly required by Article 5 of the GDPR?
- A. Fairness refers to limiting the amount of data collected from individuals; lawfulness refers to the approval of company guidelines by the state; transparency solely relates to communication of key information before collecting data.
- B. Fairness and transparency refer to the communication of key information before collecting data; lawfulness refers to compliance with government regulations.
- C. Fairness refers to the collection of data from diverse subjects; lawfulness refers to the need for legal rules to be uniform; transparency refers to giving individuals access to their data.
- D. Fairness refers to the security of personal data; lawfulness and transparency refers to the analysis of ordinances to ensure they are uniformly enforced.
Answer: B
NEW QUESTION # 21
SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location.
During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization.
The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
In addition to notifying employees about the purpose of the monitoring, the potential uses of their data and their privacy rights, what information should Building Block have provided them before implementing the security measures?
- A. Information about who employees should contact with any queries.
- B. Information about how providing consent could affect them as employees.
- C. Information about how the measures are in the best interests of the company.
- D. Information about what is specified in the employment contract.
Answer: D
NEW QUESTION # 22
When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?
- A. When the data serves legitimate interest of third parties.
- B. When the data has been pseudonymized.
- C. When the data subject has failed to use a provided opt-out mechanism.
- D. When the data is protected by technological safeguards.
Answer: A
Explanation:
Section: (none)
NEW QUESTION # 23
Higher fines are assessed for GDPR violations due to which of the following?
- A. Violations of a data controller's obligations to obtain a child's consent
- B. Failure to appoint a data protection officer.
- C. Failure to notify a supervisory authority and data subjects of a personal data breach
- D. Violations of a data subject"s rights
Answer: A
NEW QUESTION # 24
What is the key difference between the European Council and the Council of the European Union?
- A. The Council of the European Union is helmed by a president.
- B. The Council of the European Union has a degree of legislative power.
- C. The European Council is comprised of the heads of each EU member state.
Section: (none)
Explanation - D. The European Council focuses primarily on issues involving human rights.
Answer: C
NEW QUESTION # 25
SCENARIO
Please use the following to answer the next question:
Outliers Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Jonathan, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company ZenFiTech, hoping that they can design a new, cutting-edge website for Outliers Inc.'s foundering business.
During negotiations, a ZenFiTech representative describes a plan for gathering more customer information through detailed questionnaires, which could be used to tailor their preferences to specific travel destinations. Outliers Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Jonathan loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the questionnaires will require customers to provide explicit consent to having their data collected. The ZenFiTech representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the Outliers Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which ZenFiTech will analyze by means of a special program. Outliers Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Jonathan enthusiastically engages ZenFiTech for these services.
With regard to Outliers Inc.'s use of website cookies, which of the following statements is correct?
- A. Because ZenFiTech will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary.
- B. Because not all of the cookies are strictly necessary to enable the use of a service requested from Outliers Inc., consent requirements apply to their use of cookies.
- C. Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers.
- D. Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.
Answer: C
NEW QUESTION # 26
In which scenario is a Controller most likely required to undertake a Data Protection Impact Assessment?
- A. When the controller is required to have a Data Protection Officer.
- B. When personal data is being transferred outside of the EEA.
- C. When the controller is collecting email addresses from individuals via an online registration form for marketing purposes.
- D. When personal data is being collected and combined with other personal data to profile the creditworthiness of individuals.
Answer: D
Explanation:
Reference https://www.tandfonline.com/doi/full/10.1080/13600834.2020.1790092#:~:text=Article%2035%20of
%20the%20General,and%20freedoms%20of%20natural%20persons%27.
NEW QUESTION # 27
Please use the following to answer the next question:
WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of their service, WonderKids will pass all personal data provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person booking the childcare, address and contact details, as well as information about the children to be cared for including name, age, gender and health information. The privacy statement on Wonderkids' website states the following:
"WonderkKids provides the information you disclose to us through this website to your childcare provider for scheduling and health and safety reasons. We may also use your and your child's personal information for our own legitimate business purposes and we employ a third-party website hosting company located in Switzerland to store the dat a. Any data stored on equipment located in Switzerland meets the European Commission provisions for guaranteeing adequate safeguards for you and your child's personal information. We will only share you and your child's personal information with businesses that we see as adding real value to you. By providing us with any personal data, you consent to its transfer to affiliated businesses and to send you promotional offers."
"We may retain you and your child's personal information for no more than 28 days, at which point the data will be depersonalized, unless your personal information is being used for a legitimate business purpose beyond 28 days where it may be retained for up to 2 years."
"We are processing you and your child's personal information with your consent. If you choose not to provide certain information to us, you may not be able to use our services. You have the right to: request access to you and your child's personal information; rectify or erase you or your child's personal information; the right to correction or erasure of you and/or your child's personal information; object to any processing of you and your child's personal information. You also have the right to complain to the supervisory authority about our data processing activities." What direct marketing information can WonderKids send by email without prior consent of the person booking the childcare?
- A. No marketing information at all.
- B. Marketing information related to other business operations of WonderKids.
- C. Any marketing information at all.
- D. Marketing information for products or services similar to those purchased from WonderKids.
Answer: B
NEW QUESTION # 28
SCENARIO
Please use the following to answer the next question:
Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA.
Today, it is a multi-billion-dollar candy company operating in every continent. All of the company's IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father's company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.
Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company's online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers' philosophical beliefs, political opinions and marital status.
If a customer identifies as single, Ben then copies all of that customer's personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.
Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.
Joe also hires his best friend's daughter, Alice, who just graduated from law school in the U.S., to be the company's new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company's operations in the European Union to the U.S.
Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company's IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone's information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.
Ben's collection of additional data from customers created several potential issues for the company, which would most likely require what?
- A. New corporate governance and code of conduct.
- B. A comprehensive data inventory.
- C. A data protection impact assessment.
- D. Hiring a data protection officer.
Answer: A
NEW QUESTION # 29
What ruling did the Planet 49 CJEU judgment make regarding the issue of pre-ticked boxes?
- A. They constitute valid consent if the processing is necessary for purposes of legitimate interest
- B. They do not amount to valid consent under any circumstances.
- C. They are allowed if determined to be technically necessary.
- D. They are allowed if recorded In the register of processing activities.
Answer: B
NEW QUESTION # 30
In 2016's Guidance, the United Kingdom's Information Commissioner's Office (ICO) reaffirmed the importance of using a "layered notice" to provide data subjects with what?
- A. An efficient means of providing written consent in member states where they are required to do so.
- B. A privacy notice explaining the consequences for opting out of the use of cookies on a website.
- C. A privacy notice containing brief information whilst offering access to further detail.
- D. An explanation of the security measures used when personal data is transferred to a third party.
Answer: D
NEW QUESTION # 31
Which of the following is the weakest lawful basis for processing employee personal data?
- A. Processing based on legitimate interests.
- B. Processing based on legal obligation.
- C. Processing based on fulfilling an employment contract.
- D. Processing based on employee consent.
Answer: D
NEW QUESTION # 32
According to the European Data Protection Board, which of the following concepts or practices does NOT follow from the principles relating to the processing of personal data under EU data protection law?
- A. Access control management.
- B. Frequent pseudonymization key rotation.
- C. Error propagation avoidance along the processing chain.
- D. Data ownership allocation.
Answer: B
NEW QUESTION # 33
......
IAPP CIPP-E Dumps - Secret To Pass in First Attempt: https://www.braindumpspass.com/IAPP/CIPP-E-practice-exam-dumps.html
CIPP-E Dumps - Grab Out For [NEW-2023] IAPP Exam: https://drive.google.com/open?id=1uhpYmFjINRAA_vHJs3GgXGOBSzUJl42o
