IAPP CIPP-E Exam Dumps

Question # 1

SCENARIOPlease use the following to answer the next question:T-Craze, a German-headquartered specialty t-shirt company, was successfully selling tolarge German metropolitan cities. However, after a recent merger with another Germanbased company that was selling to a broader European market, T-Craze revamped itsmarketing efforts to sell to a wider audience. These efforts included a complete redesign ofits logo to reflect the recent merger, and improvements to its website meant to capturemore information about visitors through the use of cookies.T-Craze also opened various office locations throughout Europe to help expand itsbusiness. While GermanyTarget, a renowned marketing firm based in the Philippines, to run its latest marketingcampaign. After thorough research, Right Target determined that T-Craze is mostsuccessful with customers between the ages of 18 and 22. Thus, its first campaign targeteduniversity students in several European capitals, which yielded nearly 40% new customersfor T-Craze in one quarter. Right Target also ran subsequent campaigns for T- Craze,though with much less success.The last two campaigns included a wider demographic group and resulted in countlessunsubscribe requests, including a large number in Spain. In fact, the Spanish dataprotection authority received a complaint from Sofia, a mid-career investment banker. Sofiawas upset after receiving a marketing communication even after unsubscribing from suchcommunications from the Right Target on behalf of T-Craze.What is the best option for the lead regulator when responding to the Spanish supervisoryauthority’s notice that it plans to take action regarding Sofia’s complaint?

A. Accept, because it did not receive any complaints.  
B. Accept, because GDPR permits non-lead authorities to take action for such complaints.  
C. Reject, because Right Target’s processing was conducted throughout Europe.  
D. Reject, because GDPR does not allow other supervisory authorities to take action ifthere is a lead authority. 

  Show Answer

Question # 2

If a company chooses to ground an international data transfer on the contractual route,which of the following is NOT a valid set of standard contractual clauses?

A. Decision 2001/497/EC (EU controller to non-EU or EEA controller).  
B. Decision 2004/915/EC (EU controller to non-EU or EEA controller).  
C. Decision 2007/72/EC (EU processor to non-EU or EEA controller).  
D. Decision 2010/87/EU (Non-EU or EEA processor from EU controller).  

  Show Answer

Question # 3

Which statement is correct when considering the right to privacy under Article 8 of theEuropean Convention on Human Rights (ECHR)?

A. The right to privacy is an absolute right  
B. The right to privacy has to be balanced against other rights under the ECHR  
C. The right to freedom of expression under Article 10 of the ECHR will always override theright to privacy 
D. The right to privacy protects the right to hold opinions and to receive and impart ideaswithout interference 

  Show Answer

Question # 4

SCENARIOPlease use the following to answer the next question:Gentle Hedgehog Inc. is a privately owned website design agency incorporated inItaly. The company has numerous remote workers in different EU countries. Recently,the management of Gentle Hedgehog noticed a decrease in productivity of their salesteam, especially among remote workers. As a result, the company plans to implementa robust but privacy-friendly remote surveillance system to prevent absenteeism,reward top performers, and ensure the best quality of customer service when salespeople are interacting with customers.Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employeesurveillance software whose European headquarters is in Germany. Sauron Eye'ssoftware provides powerful remote-monitoring capabilities, including 24/7 access tocomputer cameras and microphones, screen captures, emails, website history, andkeystrokes. Any device can be remotely monitored from a central server that issecurely installed at Gentle Hedgehog headquarters. The monitoring is invisible bydefault; however, a so-called Transparent Mode, which regularly and conspicuouslynotifies all users about the monitoring and its precise scope, also exists. Additionally,the monitored employees are required to use a built-in verification technologyinvolving facial recognition each time they log in.All monitoring data, including the facial recognition data, is securely stored in MicrosoftAzure cloud servers operated by Sauron Eye, which are physically located in France.What monitoring may be lawfully performed within the scope of Gentle Hedgehog'sbusiness?

A. Everything offered by Sauron Eye's software with the exception of camera andmicrophone monitoring. 
B. Everything offered by Sauron Eye's software, assuming employees provide dailyconsent to the monitoring. 
C. Only video calls conducted during business hours and emails that do not contain a"private" or "personal" tag. 
D. Only emails, website browsing history and camera for internal video calls that areexpressly marked as monitored. 

  Show Answer

Question # 5

Under what circumstances might the “soft opt-in” rule apply in relation to direct marketing? 

A. When an individual has not consented to the marketing.  
B. When an individual’s details are obtained from their inquiries about buying a product.  
C. Where an individual’s details have been obtained from a bought-in marketing list.  
D. Where an individual is given the ability to unsubscribe from marketing emails sent to him. 

  Show Answer

Question # 6

The GDPR forbids the practice of “forum shopping”, which occurs when companies dowhat?

A. Choose the data protection officer that is most sympathetic to their business concerns.  
B. Designate their main establishment in member state with the most flexible practices.  
C. File appeals of infringement judgments with more than one EU institution simultaneously
D. Select third-party processors on the basis of cost rather than quality of privacy protection.  

  Show Answer

Question # 7

SCENARIOPlease use the following to answer the next question:You have just been hired by a toy manufacturer based in Hong Kong. The company sells abroad range of dolls, action figures and plush toys that can be found internationally in awide variety of retail stores. Although the manufacturer has no offices outside Hong Kongand in fact does not employ any staff outside Hong Kong, it has entered into a number oflocal distribution contracts. The toys produced by the company can be found in all populartoy stores throughout Europe, the United States and Asia. A large portion of the company’srevenue is due to international sales.The company now wishes to launch a new range of connected toys, ones that can talk andinteract with children. The CEO of the company is touting these toys as the next big thing,due to the increased possibilities offered: The figures can answer children’s Questions: onvarious subjects, such as mathematical calculations or the weather. Each figure isequipped with a microphone and speaker and can connect to any smartphone or tablet viaBluetooth. Any mobile device within a 10-meter radius can connect to the toys viaBluetooth as well. The figures can also be associated with other figures (from the samemanufacturer) and interact with each other for an enhanced play experience.When a child asks the toy a question, the request is sent to the cloud for analysis, and theanswer is generated on cloud servers and sent back to the figure. The answer is giventhrough the figure’s integratedspeakers, making it appear as though that the toy is actually responding to the child’squestion. The packaging of the toy does not provide technical details on how this works,nor does it mention that this feature requires an internet connection. The necessary dataprocessing for this has been outsourced to a data center located in South Africa. However,your company has not yet revised its consumer-facing privacy policy to indicate this.In parallel, the company is planning to introduce a new range of game systems throughwhich consumers can play the characters they acquire in the course of playing the game.The system will come bundled with a portal that includes a Near-Field Communications(NFC) reader. This device will read an RFID tag in the action figure, making the figurecome to life onscreen. Each character has its own stock features and abilities, but it is alsopossible to earn additional ones by accomplishing game goals. The only information storedin the tag relates to the figures’ abilities. It is easy to switch characters during the game,and it is possible to bring the figure to locations outside of the home and have thecharacter’s abilities remain intact.Why is this company obligated to comply with the GDPR?

A. The company has offices in the EU.  
B. The company employs staff in the EU.  
C. The company’s data center is located in a country outside the EU.  
D. The company’s products are marketed directly to EU customers.  

  Show Answer

Question # 8

SCENARIOPlease use the following to answer the next question:Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located inGreece (5), Italy (15) and Spain (1), have registered their most profitable resultsever. To celebrate this achievement, ARRA Hotels' Human Resources office, basedin ARRA's main Italian establishment, has organized a team event for its 420employees and their families at its hotel in Spain.Upon arrival at the hotel, each employee and family member is given an electronicwristband at the reception desk. The wristband serves a number of functions:. Allows access to the "party zone" of the hotel, and emits a buzz if the userapproaches any unauthorized areas. Allows up to three free drinks for each person of legal age, and emits abuzz once this limit has been reached. Grants a unique ID number for participating in the games and contests thathave been planned.Along with the wristband, each guest receives a QR code that leads to the onlineprivacy notice describing the use of the wristband. The page also contains anunchecked consent checkbox. In the case of employee family members under theage of 16, consent must be given by a parent.Among the various activities planned for the event, ARRA Hotels' HR office hasautonomously set up a photocall area, separate from the main event venue, whereemployees can come and have their pictures taken in traditional carnival costume.The photos will be posted on ARRA Hotels' main website for general marketingpurposes.On the night of the event, an employee from one of ARRA's Greek hotels isdispleased with the results of the photos in which he appears. He intends to file acomplaint with the relevant supervisory authority in regard to the following:. The lack of any privacy notice in the separate photocall areaThe unlawful cross-border processing of his personal data. The unacceptable aesthetic outcome of his photosWhich of the following principles has likely been violated in the processing of thephotocall photos containing personal data?

A. Adequacy.  
B. Lawfulness.  
C. Transparency.  
D. Data minimization.  

  Show Answer

Question # 9

A company would like to implement CCTV monitoring in its offices for safety and securitypurposes. Which of the following would be the best legal basis for the company to relyupon?

A. Public interest.  
B. Individual consent  
C. Legitimate interest.  
D. Exercise of pubic authority.  

  Show Answer

Question # 10

SCENARIOPlease use the following to answer the next question:ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. Theyuse an internet-based common platform for collecting and sharing their customer data witheach other, in order to integrate their marketing efforts. Additionally, they agree on the datato be stored, how reservations will be booked and confirmed, and who has access to thestored data.Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agencyto stay at ABC Hotel Chain’s locations. XYZ Travel Agency offers a rewards program thatallows customers to sign up to accumulate points that can later be redeemed for free travel.Mike has signed the agreement to be a rewards program member.Now Mike wants to know what personal information the company holds about him. Hesends an email requesting access to his data, in order to exercise what he believes are hisdata subject rights.What is the time period in which Mike should receive a response to his request?

A. Not more than one month of receipt of Mike’s request.  
B. Not more than two months after verifying Mike’s identity.  
C. When all the information about Mike has been collected.  
D. Not more than thirty days after submission of Mike’s request.  

  Show Answer

Question # 11

SCENARIOPlease use the following to answer the next question:Zandelay Fashion (‘Zandelay’) is a successful international online clothing retailer thatemploys approximately 650 people at its headquarters based in Dublin, Ireland. Martin istheir recently appointed data protection officer, who oversees the company’s compliancewith the General Data Protection Regulation (GDPR) and other privacy legislation.The company offers both male and female clothing lines across all age demographics,including children. In doing so, the company processes large amounts of information aboutsuch customers, including preferences and sensitive financial information such as creditcard and bank account numbers.In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the companyis launching a new mobile app and loyalty scheme that puts significant emphasis onprofiling the company’s customers by analyzing their purchases. Martin tells the CEO that:(a) the potential risks of such activities means that Zandelay needs to carry out a dataprotection impact assessment to assess this new venture and its privacy implications; and(b) where the results of this assessment indicate a high risk in the absence of appropriateprotection measures. Zandelay may have to undertake a prior consultation with the IrishData Protection Commissioner before implementing the app and loyalty scheme.Jerry tells Martin that he is not happy about the prospect of having to directly engage with asupervisory authority and having to disclose details of Zandelay’s business plan andassociated processing activities.What must Zandelay provide to the supervisory authority during the prior consultation?

A. An evaluation of the complexity of the intended processing.  
B. An explanation of the purposes and means of the intended processing.  
C. Records showing that customers have explicitly consented to the intended profiling activities.
D. Certificates that prove Martin’s professional qualities and expert knowledge of dataprotection law.

  Show Answer

Question # 12

Pursuant to Article 4(5) of the GDPR, data is considered “pseudonymized” if? 

A. It cannot be attributed to a data subject without the use of additional information.  
B. It cannot be attributed to a person under any circumstances.  
C. It can only be attributed to a person by the controller.  
D. It can only be attributed to a person by a third party.  

  Show Answer

Question # 13

An organisation receives a request multiple times from a data subject seeking to exercisehis rights with respect to his own personal data. Under what condition can the organisationcharge the data subject for processing the request?

A. Only where the organisation can show that it is reasonable to do so because more thanone request was made. 
B. Only to the extent this is allowed under the restrictions on data subjects’ rightsintroduced under Art 23 of GDPR. 
C. Only where the administrative costs of taking the action requested exceeds a certainthreshold.  
D. Only if the organisation can demonstrate that the request is clearly excessive or misguided. 

  Show Answer

Question # 14

SCENARIOPlease use the following to answer the next question:BHealthy, a company based in Italy, is ready to launch a new line of natural products, witha focus on sunscreen. The last step prior to product launch is for BHealthy to conductresearch to decide how extensively to market its new line of sunscreens across Europe. Todo so, BHealthy teamed up with Natural Insight, a company specializing in determiningpricing for natural products. BHealthy decided to share its existing customer information –name, location, and prior purchase history – with Natural Insight. Natural Insight intends touse this information to train its algorithm to help determine the price point at whichBHealthy can sell its new sunscreens.Prior to sharing its customer list, BHealthy conducted a review of Natural Insight’s securitypractices and concluded that the company has sufficient security measures to protect thecontact information. Additionally, BHealthy’s data processing contractual terms with NaturalInsight require continued implementation of technical and organization measures. Alsoindicated in the contract are restrictions on use of the data provided by BHealthy for anypurpose beyond provision of the services, which include use of the data for continuedimprovement of Natural Insight’s machine learning algorithms.What is the nature of BHealthy and Natural Insight’s relationship?

A. Natural Insight is BHealthy’s processor because the companies entered into dataprocessing terms. 
B. Natural Insight is BHealthy’s processor because BHealthy is sharing its customerinformation with Natural Insight. 
C. Natural Insight is the controller because it determines the security measures toimplement to protect data it processes; BHealthy is a co-controller because it engagedNatural Insight to determine pricing for the new sunscreens. 
D. Natural Insight is a controller because it is separately determine the purpose ofprocessing when it uses BHealthy’s customer information to improve its machine learningalgorithms. 

  Show Answer

Question # 15

SCENARIOPlease use the following to answer the next question:Anna and Frank both work at Granchester University. Anna is a lawyer responsible for dataprotection, while Frank is a lecturer in the engineering department. The Universitymaintains a number of types of records:Student records, including names, student numbers, home addresses, preuniversity information, university attendance and performance records, details ofspecial educational needs and financial information.Staff records, including autobiographical materials (such as curricula, professionalcontact files, student evaluations and other relevant teaching files).Alumni records, including birthplaces, years of birth, dates of matriculation andconferrals of degrees. These records are available to former students afterregistering through Granchester’s Alumni portal. Department for Educationrecords, showing how certain demographic groups (such as first-generationstudents) could be expected, on average, to progress. These records do notcontain names or identification numbers.Under their security policy, the University encrypts all of its personal data recordsin transit and at rest.In order to improve his teaching, Frank wants to investigate how his engineering studentsperform in relational to Department for Education expectations. He has attended one ofAnna’s data protection training courses and knows that he should use no more personaldata than necessary to accomplish his goal. He creates aprogram that will only export some student data: previous schools attended, gradesoriginally obtained, grades currently obtained and first time university attended. He wants tokeep the records at the individual student level. Mindful of Anna’s training, Frank runs thestudent numbers through an algorithm to transform them into different reference numbers.He uses the same algorithm on each occasion so that he can update each record overtime.One of Anna’s tasks is to complete the record of processing activities, as required by theGDPR. After receiving her email reminder, as required by the GDPR. After receiving heremail reminder, Frank informs Anna about his performance database.Ann explains to Frank that, as well as minimizing personal data, the University has to checkthat this new use of existing data is permissible. She also suspects that, under the GDPR,a risk analysis may have to be carried out before the data processing can take place. Annaarranges to discuss this further with Frank after she hasdone some additional research.Frank wants to be able to work on his analysis in his spare time, so he transfers it to hishome laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into theUniversity he loses it on the train. Frank has to see Anna that day to discuss compatibleprocessing. He knows that he needs to report security incidents, so he decides to tell Annaabout his lost laptop at the same time.Anna will find that a risk analysis is NOT necessary in this situation as long as?

A. The data subjects are no longer current students of Frank’s  
B. The processing will not negatively affect the rights of the data subjects  
C. The algorithms that Frank uses for the processing are technologically sound  
D. The data subjects gave their unambiguous consent for the original processing  

  Show Answer