[Jan-2024] The Best Certified Information Privacy Professional Study Guide for the CIPP-E Exam [Q97-Q113]

09Jan 2024 by admin No Comments

5/5 - (6 votes)

[Jan-2024] The Best Certified Information Privacy Professional Study Guide for the CIPP-E Exam

CIPP-E certification guide Q&A from Training Expert PracticeMaterial

The CIPP-E exam is ideal for professionals who handle personal data in the European Union, including privacy officers, data protection officers, compliance officers, lawyers, and anyone else who is responsible for ensuring that their organization is in compliance with data protection regulations. Certified Information Privacy Professional/Europe (CIPP/E) certification demonstrates a strong understanding of European data privacy regulations and can help to advance one’s career in the field of data privacy. CIPP-E exam consists of 90 multiple-choice questions and individuals have two hours to complete the exam.

NEW QUESTION 97
An entity’s website stores text files on EU users’ computer and mobile device browsers. Prior to doing so, the entity is required to provide users with notices containing information and consent under which of the following frameworks?

General Data Protection Regulation 2016/679.

E-Privacy Directive 2002/58/EC.

E-Commerce Directive 2000/31/EC.

Data Protection Directive 95/46/EC.

NEW QUESTION 98
Article 9 of the GDPR lists exceptions to the general prohibition against processing biometric dat a. Which of the following is NOT one of these exceptions?

The processing is done by a non-profit organization and the results are disclosed outside the organization.

The processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.

The processing is necessary for the establishment, exercise or defense of legal claims when courts are acting in a judicial capacity.

The processing is explicitly consented to by the data subject and he or she is allowed by Union or Member State law to lift the prohibition.

NEW QUESTION 99
Which of the following is NOT an explicit right granted to data subjects under the GDPR?

The right to request access to the personal data a controller holds about them.

The right to request the deletion of data a controller holds about them.

The right to opt-out of the sale of their personal data to third parties.

The right to request restriction of processing of personal data, under certain scenarios.

NEW QUESTION 100
The transparency principle is most directly related to which of the following rights?

Right to object

Right to be informed.

Right to be forgotten.

Right to restriction of processing.

NEW QUESTION 101
With respect to international transfers of personal data, the European Data Protection Board (EDPB) confirmed that derogations may be relied upon under what condition?

If the data controller has received preapproval from a Data Protection Authority (DPA), after submitting the appropriate documents.

When it has been determined that adequate protection can be performed.

Only if the Data Protection Impact Assessment (DPIA) shows low risk.

Only as a last resort and when interpreted restrictively.

NEW QUESTION 102
SCENARIO
Please use the following to answer the next question:
BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information – name, location, and prior purchase history – with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.
Prior to sharing its customer list, BHealthy conducted a review of Natural Insight’s security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy’s data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight’s machine learning algorithms.
Under the GDPR, what are Natural Insight’s security obligations with respect to the customer information it received from BHealthy?

Appropriate security that takes into account the industry practices for protecting customer contact information and purchase history.

Only the security measures assessed by BHealthy prior to entering into the data processing contract.

Absolute security since BHealthy is sharing personal data, including purchase history, with Natural Insight.

The level of security that a reasonable data subject whose data is processed would expect in relation to the data subject’s purchase history.

NEW QUESTION 103
Which of the following countries will continue to enjoy adequacy status under the GDPR, pending any future European Commission decision to the contrary?

Greece

Norway

Australia

Switzerland

NEW QUESTION 104
What must be included in a written agreement between the controller and processor in relation to processing conducted on the controller’s behalf?

An obligation on the processor to report any personal data breach to the controller within 72 hours.

An obligation on both parties to report any serious personal data breach to the supervisory authority.

An obligation on both parties to agree to a termination of the agreement if the other party is responsible for a personal data breach.

An obligation on the processor to assist the controller in complying with the controller’s obligations to notify the supervisory authority about personal data breaches.

NEW QUESTION 105
What permissions are required for a marketer to send an email marketing message to a consumer in the EU?

A prior opt-in consent for consumers unless they are already customers.

A pre-checked box stating that the consumer agrees to receive email marketing.

A notice that the consumer’s email address will be used for marketing purposes.

No prior permission required, but an opt-out requirement on all emails sent to consumers.

NEW QUESTION 106
Under which of the following conditions does the General Data Protection Regulation NOT apply to the processing of personal data?

When the personal data is processed only in non-electronic form

When the personal data is collected and then pseudonymised by the controller

When the personal data is held by the controller but not processed for further purposes

When the personal data is processed by an individual only for their household activities

NEW QUESTION 107
SCENARIO
Please use the following to answer the next question:
BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information – name, location, and prior purchase history – with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.
Prior to sharing its customer list, BHealthy conducted a review of Natural Insight’s security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy’s data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight’s machine learning algorithms.
What is the nature of BHealthy and Natural Insight’s relationship?

Natural Insight is BHealthy’s processor because the companies entered into data processing terms.

Natural Insight is BHealthy’s processor because BHealthy is sharing its customer information with Natural Insight.

Natural Insight is the controller because it determines the security measures to implement to protect data it processes; BHealthy is a co-controller because it engaged Natural Insight to determine pricing for the new sunscreens.

Natural Insight is a controller because it is separately determine the purpose of processing when it uses BHealthy’s customer information to improve its machine learning algorithms.

NEW QUESTION 108
How is the retention of communications traffic data for law enforcement purposes addressed by European data protection law?

The ePrivacy Directive allows individual EU member states to engage in such data retention.

The ePrivacy Directive harmonizes EU member states’ rules concerning such data retention.

The Data Retention Directive’s annulment makes such data retention now permissible.

The GDPR allows the retention of such data for the prevention, investigation, detection or prosecution of criminal offences only.

NEW QUESTION 109
A German data subject was the victim of an embarrassing prank 20 years ago. A newspaper website published an article about the prank at the time, and the article is still available on the newspaper’s website. Unfortunately, the prank is the top search result when a user searches on the victim’s name. The data subject requests that SearchCo delist this result. SearchCo agrees, and instructs its technology team to avoid scanning or indexing the article. What else must SearchCo do?

Notify the newspaper that its article it is delisting the article.

Fully erase the URL to the content, as opposed to delist which is mainly based on data subject’s name.

Identify other controllers who are processing the same information and inform them of the delisting request.

Prevent the article from being listed in search results no matter what search terms are entered into the search engine.

NEW QUESTION 110
Under the GDPR, which essential pieces of information must be provided to data subjects before collecting their personal data?

The authority by which the controller is collecting the data and the third parties to whom the data will be sent.

The name/s of relevant government agencies involved and the steps needed for revising the data.

The identity and contact details of the controller and the reasons the data is being collected.

The contact information of the controller and a description of the retention policy.

NEW QUESTION 111
SCENARIO
Please use the following to answer the next question:
Javier is a member of the fitness club EVERFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Javier lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Javier was photographed while working out at a branch of EVERFIT in Frankfurt, Germany. At the time, Javier gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club’s U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Javier no longer feels comfortable with his photograph being publicly associated with the fitness club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Javier sends a letter to EVETFIT requesting that his image be removed from the website and all promotional materials. Months pass and Javier, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact EVETFIT through alternate channels, he decides to take action against the company.
Javier contacts the U.K. Information Commissioner’s Office (‘ICO’ – the U.K.’s supervisory authority) to lodge a complaint about this matter. The ICO, pursuant to Article 56 (3) of the GDPR, informs the CNIL (i.e. the supervisory authority of EVERFIT’s main establishment) about this matter. Despite the fact that EVERFIT has an establishment in the U.K., the CNIL decides to handle the case in accordance with Article 60 of the GDPR. The CNIL liaises with the ICO, as relevant under the cooperation procedure. In light of issues amongst the supervisory authorities to reach a decision, the European Data Protection Board becomes involved and, pursuant to the consistency mechanism, issues a binding decision.
Additionally, Javier sues EVERFIT for the damages caused as a result of its failure to honor his request to have his photograph removed from the brochure and website.
Under the cooperation mechanism, what should the lead authority (the CNIL) do after it has formed its view on the matter?

Submit a draft decision to other supervisory authorities for their opinion.

Request that the other supervisory authorities provide the lead authority with a draft decision for its consideration.

Submit a draft decision directly to the Commission to ensure the effectiveness of the consistency mechanism.

Request that members of the seconding supervisory authority and the host supervisory authority co-draft a decision.

NEW QUESTION 112
According to the GDPR, when should the processing of photographs be considered processing of special categories of personal data?

When processed with the intent to publish information regarding a natural person on publicly accessible media.

When processed with the intent to proceed to scientific or historical research projects.

When processed with the intent to uniquely identify or authenticate a natural person.

When processed with the intent to comply with a law.

NEW QUESTION 113
If a company chooses to ground an international data transfer on the contractual route, which of the following is NOT a valid set of standard contractual clauses?

Decision 2001/497/EC (EU controller to non-EU or EEA controller).

Decision 2004/915/EC (EU controller to non-EU or EEA controller).

Decision 2007/72/EC (EU processor to non-EU or EEA controller).

Decision 2010/87/EU (Non-EU or EEA processor from EU controller).

IAPP CIPP-E exam, or the Certified Information Privacy Professional/Europe (CIPP/E), is a certification exam designed for professionals who want to demonstrate their expertise in European data protection laws and regulations. CIPP-E exam is intended to test a candidate’s knowledge of the General Data Protection Regulation (GDPR) and other relevant privacy laws in Europe. The IAPP CIPP-E certification is highly respected in the privacy industry and can be a valuable credential for professionals looking to advance their careers.

The Best IAPP CIPP-E Study Guides and Dumps of 2024: https://www.practicematerial.com/CIPP-E-exam-materials.html

Leave a Reply Cancel reply