Verified CIPP-E Q&As - Pass Guarantee CIPP-E Exam Dumps
Check the Free demo of our CIPP-E Exam Dumps with 252 Questions
NEW QUESTION # 24
According to Article 84 of the GDPR, the rules on penalties applicable to infringements shall be laid down by?
- A. The Member States.
- B. The EU Commission.
- C. The local Data Protection Supervisory Authorities.
- D. The European Data Protection Board.
Answer: A
NEW QUESTION # 25
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's questions on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well.
The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's question. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
In light of the requirements of Article 32 of the GDPR (related to the Security of Processing), which practice should the company institute?
- A. Include dual-factor authentication before each use by a child in order to ensure a minimum amount of security.
- B. Encrypt the data in transit over the wireless Bluetooth connection.
- C. Include three-factor authentication before each use by a child in order to ensure the best level of security possible.
- D. Insert contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union.
Answer: B
Explanation:
Explanation/Reference:
NEW QUESTION # 26
Which of the following countries will continue to enjoy adequacy status under the GDPR, pending any future European Commission decision to the contrary?
- A. Greece
- B. Norway
- C. Switzerland
- D. Australia
Answer: C
NEW QUESTION # 27
Please use the following to answer the next question:
Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a dedicated data center located in Malta (EU).
People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a KYC due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations.
The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and belong a checkbox on a separate page in order to get their account approved on the platform.
The customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if a Are the cybersecurity assessors required to sign a data processing agreement with the company in order to comply with the GDPR''
- A. No. the assessors do not quality as data processors as they do not copy the data to their facilities.
- B. Yes. the assessors a-e considered to be joint data controllers and must sign a mutual data processing agreement.
- C. No, the assessors do not quality as data processors as they only have access to encrypted data.
- D. Yes, the assessors are data processors and their processing of personal data must be governed by a separate contract or other legal act.
Answer: D
NEW QUESTION # 28
How does the GDPR now define "processing"?
- A. Any operation or set of operations performed on personal data or on sets of personal data.
- B. Any act involving the collecting and recording of personal data.
- C. Any use or disclosure of personal data compatible with the purpose for which the data was collected.
- D. Any operation or set of operations performed by automated means on personal data or on sets of personal data.
Answer: B
Explanation:
Explanation/Reference: https://gdpr-info.eu/issues/processing/
NEW QUESTION # 29
The GDPR requires controllers to supply data subjects with detailed information about the processing of their dat a. Where a controller obtains data directly from data subjects, which of the following items of information does NOT legally have to be supplied?
- A. The recipients or categories of recipients.
- B. The categories of personal data concerned.
- C. The right to lodge a complaint with a supervisory authority.
- D. The rights of access, erasure, restriction, and portability.
Answer: B
Explanation:
Reference https://gdpr-info.eu/art-13-gdpr/
NEW QUESTION # 30
In addition to the European Commission, who can adopt standard contractual clauses, assuming that all required conditions are met?
- A. The Council of the European Union.
- B. Approved data controllers.
- C. National data protection authorities.
- D. The European Data Protection Supervisor.
Answer: B
Explanation:
Explanation/Reference: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/ standard-contractual-clauses-scc_en
NEW QUESTION # 31
SCENARIO
Please use the following to answer the next question:
Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B. Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.
Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees:
Name
Address
Date of Birth
Payroll number
National Insurance number
Sick pay entitlement
Maternity/paternity pay entitlement
Holiday entitlement
Pension and benefits contributions
Trade union contributions
Jenny is the compliance officer at Company A.
She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required.
Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.
Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B.
This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.
Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees.
The GDPR requires sufficient guarantees of a company's ability to implement adequate technical and organizational measures. What would be the most realistic way that Company B could have fulfilled this requirement?
- A. Avoiding the use of another company's data to improve their own services.
- B. Requesting advice and technical support from Company A's IT team.
- C. Hiring companies whose measures are consistent with recommendations of accrediting bodies.
- D. Vetting companies' measures with the appropriate supervisory authority.
Answer: C
NEW QUESTION # 32
What is the consequence if a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller?
- A. The controller will be required to demonstrate that the unauthorized processing negatively affected one or more of the parties involved
- B. The controller will be liable to pay an administrative fine
- C. The processor will be considered to be a controller in respect of the processing concerned
- D. The processor will be liable to pay compensation to affected data subjects
Answer: D
Explanation:
Reference https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection- regulation-gdpr/key-definitions/controllers-and-processors/
NEW QUESTION # 33
If a French controller has a car-sharing app available only in Morocco, Algeria and Tunisia, but the data processing activities are carried out by the appointed processor in Spain, the GDPR will apply to the processing of the personal data so long as?
- A. The data processing activities are in Spain.
- B. The data controller is in France.
- C. The individuals are European citizens or residents.
- D. The EU individuals are targeted.
Answer: D
NEW QUESTION # 34
According to the GDPR, what is the main task of a Data Protection Officer (DPO)?
- A. To monitor compliance with other local or European data protection provisions.
- B. To conduct Privacy Impact Assessments on behalf of the controller or processor.
- C. To create and maintain records of processing activities.
- D. To create procedures for notification of personal data breaches to competent supervisory authorities.
Answer: A
Explanation:
Reference https://digitalguardian.com/blog/what-data-protection-officer-dpo-learn-about-new-role-required- gdpr-compliance
NEW QUESTION # 35
A well-known video production company, based in Spain but specializing in documentaries filmed worldwide, has just finished recording several hours of footage featuring senior citizens in the streets of Madrid. Under what condition would the company NOT be required to obtain the consent of everyone whose image they use for their documentary?
- A. If obtaining consent is deemed voluntary by local legislation.
- B. If obtaining consent is deemed to involve disproportionate effort.
- C. If the company limits the footage to data subjects solely of legal age.
- D. If the company's status as a documentary provider allows it to claim legitimate interest.
Answer: A
NEW QUESTION # 36
Which of the following is the weakest lawful basis for processing employee personal data?
- A. Processing based on fulfilling an employment contract.
- B. Processing based on legitimate interests.
- C. Processing based on legal obligation.
- D. Processing based on employee consent.
Answer: D
Explanation:
Reference https://www.itgovernance.co.uk/blog/gdpr-lawful-bases-for-processing-with-examples
NEW QUESTION # 37
SCENARIO
Please use the following to answer the next question:
Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.
After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient's name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissed Jack's lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of "all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents. In relation to the emails Jack listed six members of the management team whose inboxes the required access.
How should the company respond to Jack's request to be forgotten?
- A. The company should erase all data relating to Jack without undue delay as the right to be forgotten is an absolute right.
- B. The company should ensure that the information is stored outside of the European Union so that the right to be forgotten under the GDPR does not apply.
- C. The company should claim that the right to be forgotten is not applicable to them, as only a fraction of their global workforce resides in the European Union.
- D. The company should not erase the data at this time as it may be required to defend a legal claim of unfair dismissal.
Answer: C
NEW QUESTION # 38
Under what circumstances might the "soft opt-in" rule apply in relation to direct marketing?
- A. When an individual's details are obtained from their inquiries about buying a product.
- B. Where an individual is given the ability to unsubscribe from marketing emails sent to him.
- C. Where an individual's details have been obtained from a bought-in marketing list.
- D. When an individual has not consented to the marketing.
Answer: A
NEW QUESTION # 39
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's questions on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well.
The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's question. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
In light of the requirements of Article 32 of the GDPR (related to the Security of Processing), which practice should the company institute?
- A. Include dual-factor authentication before each use by a child in order to ensure a minimum amount of security.
- B. Encrypt the data in transit over the wireless Bluetooth connection.
- C. Include three-factor authentication before each use by a child in order to ensure the best level of security possible.
- D. Insert contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union.
Answer: B
NEW QUESTION # 40
What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?
- A. ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.
- B. ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.
- C. CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.
- D. CJEU can force national governments to implement and honor EU law, while the ECHR cannot.
Answer: D
NEW QUESTION # 41
According to the GDPR, when should the processing of photographs be considered processing of special categories of personal data?
- A. When processed with the intent to publish information regarding a natural person on publicly accessible media.
- B. When processed with the intent to uniquely identify or authenticate a natural person.
- C. When processed with the intent to comply with a law.
- D. When processed with the intent to proceed to scientific or historical research projects.
Answer: B
Explanation:
Reference https://www.privacy-regulation.eu/en/recital-51-GDPR.htm
NEW QUESTION # 42
If a multi-national company wanted to conduct background checks on all current and potential employees, including those based in Europe, what key provision would the company have to follow?
- A. Background checks are only authorized with prior notice and express consent from all employees including those based in Europe.
- B. Background checks may not be allowed on European employees, but the company can create lists based on its legitimate interests, identifying individuals who are ineligible for employment.
- C. Background checks on employees could be performed only under prior notice to all employees.
- D. Background checks on European employees will stem from data protection and employment law, which can vary between member states.
Answer: D
Explanation:
Explanation/Reference: https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/ conductingbackgroundinvestigations.aspx
NEW QUESTION # 43
A homeowner has installed a motion-detecting surveillance system that films his front doc and entryway. The camera does not film any public areas only areas that are the property of the homeowner. The system has seen declared to the authorities per the homeowner's country law, and a placard indicating the area is being video monitored is visible when entering the property Why can the homeowner NOT depend on the household exemption with regards to the processing of the video images recorded by the surveillance camera system?
- A. The surveillance camera system can potentially capture biometric information of the homeowner's family, which would be considered a processing of special categories of personal data.
- B. The surveillance camera system can potentially film individuals who enter its filming perimeter
- C. The homeowner has not specified which security measures ore in place as part of the surveillance camera system
- D. The GDPR specifically excludes surveillance camera images from the household exemption
Answer: B
NEW QUESTION # 44
......
Get professional help from our CIPP-E Dumps PDF: https://examsboost.pass4training.com/CIPP-E-test-questions.html
