CIPP/E COMPREHENSIVE EXAM 2026 UPDATED
QUESTIONS AND ANSWERS SCORED A+
✔✔European Parliament - ✔✔The *only EU institution* whose *members* are *directly
elected* by citizens of individual member states, has *four responsibilities*—*legislative
development*, *supervisory oversight* of other institutions, *democratic representation*
and *budget development*.
✔✔European Union - ✔✔*replaced the EEC, which was created by the Treaty of Rome*
and first promoted a *single economic market across Europe*. Currently comprises *28
member states*: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia,
Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia,
Slovenia, Spain, Sweden and the United Kingdom.
✔✔Factortame - ✔✔A 1989 case brought before the European Court of Justice which
established the *precedence of EU law over national laws of member states* in areas
where the EU has competence. Spanish fisherman
✔✔Fairness - ✔✔One of three requirements established by the GDPR for the
processing of personal data: The first principle of processing personal data is
"lawfulness, fairness, and transparency," which states that personal data should be
processed lawfully, fairly and in a transparent manner in relation to the data subject.
Linked most often with transparency, *means data subjects must be aware of the fact
that their personal data will be processed*, including how the data will be collected, kept
and used, to allow them to make an *informed decision* about whether they agree with
such processing and to enable them to exercise their data protection rights. Consent
notices should not contain unfair terms and supervisory authority powers should
similarly be exercised fairly.
✔✔Four Classes of Privacy - ✔✔*bodily* privacy (invasion - genetic / drug testing*,
body cavity searches)
*communications* privacy (protection of correspondence)
*information* privacy (when, how, extent data is shared)
*territorial* privacy (intrude into another individual's environment)
✔✔Freely Given - ✔✔The GDPR requires that *consent* be a *freely given, specific,
informed and unambiguous* indication of the data subject's wishes by which he or she,
by a statement or by a clear affirmative action, signifies agreement to the processing of
personal data relating to him or her. The data subject *must have* a *genuine choice*,
must be able to refuse or withdraw consent without fear of consequence. *Where* there
is a *power imbalance*, as in an employer-employee relationship, for example, it's likely
that *consent cannot be freely given*.
,✔✔Gaskin v. United Kingdom - ✔✔A judgment delivered by the ECHR (European Court
of Human Rights) in 1989 held that the *restriction of* the applicant's *access to* his
*personal file* was *contrary to Article 8* of the Convention, citing a breach of *right to
respect for his family and private life*. Case related to *abuse whilst in social services
care*
✔✔General Data Protection Regulation - ✔✔Replaced the Data Protection Directive in
2018. The aim is to provide one set of data protection rules for all EU member states
and the European Economic Area (EEA). The document comprises *173 recitals* and
*99 articles*.
✔✔GET Method - ✔✔This and POST HTML method attributes specify how form data is
sent to a web page. Appends the form data to the URL in name/value pairs allowing
passwords and other sensitive information collected in a form to be visible in the
browser's address bar, and is thus *less secure than the POST method*.
✔✔Global Privacy Enforcement Network - ✔✔Organized following an OECD
(Organisation for Economic Co-operation and Development - an intergovernmental
economic organisation) recommendation for cooperation among member countries on
enforcement of privacy laws, is *collection of data protection authorities dedicated to
discussing aspects of privacy law enforcement cooperation*, the sharing of best
practices, development of shared enforcement priorities, and the support of joint
enforcement initiatives and awareness campaigns. As of 2018, counted *50 member
countries*
✔✔Haralambie v. Romania - ✔✔The *ECHR* (European Court of Human Rights)
decided in 2009 that the *Article 8 right to respect for private life and family life* had
been *violated when* the applicant *sought access* to the *secret service file* on him
drawn up in the days of Communist rule in Romania and was made to wait six years.
The court awarded 6,000 euros.
✔✔Individual Participation - ✔✔It is *fair information practices principle* that an
individual should have the right: a) to obtain from a data controller, or otherwise,
confirmation of whether or not the data controller has data relating to them; b) to have
data relating to them communicated to them within a reasonable time; at a charge, if
any, that is not excessive; in a reasonable manner, and in a form that is readily
intelligible to them; c) to be given reasons if a request made under subparagraphs (a)
and (b) is denied, and to be able to challenge such denial; and d) to challenge data
relating to them and, if the challenge is successful, to have the data erased, rectified,
completed or amended.
✔✔Information Life Cycle - ✔✔Recognizes that data has different value, and requires
approaches, as it moves through an organization from collection to deletion. The stages
are generally considered to be: *Collection, processing, use, disclosure, retention, and
destruction*.
, ✔✔Information Privacy - ✔✔One of the four classes of privacy, along with territorial
privacy, bodily privacy, and communications privacy. The *claim of individuals*, groups
or institutions *to determine for themselves when, how and to what extent information
about them is communicated to others*.
✔✔Information Security - ✔✔The protection of information for the purposes of
preventing *loss*, *unauthorized access* and/or *misuse*. It is also the process of
assessing threats and risks to information and the procedures and controls to preserve
confidentiality, integrity and availability of information.
✔✔Integrity - ✔✔The GDPR requires that controllers and processors implement
measures to ensure the ongoing confidentiality, integrity, availability and resilience of
processing systems and services. This refers to the *consistency, accuracy and
trustworthiness* of the data (see Accuracy).
✔✔Internet Protocol Address (EU specific) - ✔✔Listed within the GDPR as a form of
personal information, a unique string of numbers that identifies a computer on the
Internet or other TCP/IP network. The address is expressed in four groups of up to three
numbers, separated by periods. For example: 123.123.23.2. An address may be
*"dynamic," meaning that it is assigned temporarily* whenever a device logs on to a
network or an Internet service provider and consequently may be different each time a
device connects. Alternatively, an address may be *"static," meaning that it is assigned
to a particular device* and does not change, but remains assigned to one computer or
device.
✔✔Internet Service Provider - ✔✔A company that provides Internet access to homes
and businesses through *modem dial-up, DSL, cable modem broadband, dedicated
T1/T3 lines or wireless connections*.
✔✔ISO (International Organization for Standardization) 27001 - ✔✔The standard is a
*code of practice for implementing* an *information security management system*,
against which organizations can be *certified*.
✔✔ISO (International Organization for Standardization) 27002 - ✔✔The standard is a
*code of practice* for information security with hundreds of potential controls and control
mechanisms. The standard is intended to provide a guide for the development of
"organizational security standards and effective security management practices and to
help build confidence in inter-organizational activities". It can be considered *a guide to
implementing ISO 27001*
✔✔Joint Operations - ✔✔A reference to *joint investigations and* joint *enforcement
measures* in which members or staff from the *supervisory authorities of multiple
member states* are involved. The GDPR requires supervisory authorities to work with
one another when processing operations affect data subjects in multiple member states.
QUESTIONS AND ANSWERS SCORED A+
✔✔European Parliament - ✔✔The *only EU institution* whose *members* are *directly
elected* by citizens of individual member states, has *four responsibilities*—*legislative
development*, *supervisory oversight* of other institutions, *democratic representation*
and *budget development*.
✔✔European Union - ✔✔*replaced the EEC, which was created by the Treaty of Rome*
and first promoted a *single economic market across Europe*. Currently comprises *28
member states*: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia,
Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia,
Slovenia, Spain, Sweden and the United Kingdom.
✔✔Factortame - ✔✔A 1989 case brought before the European Court of Justice which
established the *precedence of EU law over national laws of member states* in areas
where the EU has competence. Spanish fisherman
✔✔Fairness - ✔✔One of three requirements established by the GDPR for the
processing of personal data: The first principle of processing personal data is
"lawfulness, fairness, and transparency," which states that personal data should be
processed lawfully, fairly and in a transparent manner in relation to the data subject.
Linked most often with transparency, *means data subjects must be aware of the fact
that their personal data will be processed*, including how the data will be collected, kept
and used, to allow them to make an *informed decision* about whether they agree with
such processing and to enable them to exercise their data protection rights. Consent
notices should not contain unfair terms and supervisory authority powers should
similarly be exercised fairly.
✔✔Four Classes of Privacy - ✔✔*bodily* privacy (invasion - genetic / drug testing*,
body cavity searches)
*communications* privacy (protection of correspondence)
*information* privacy (when, how, extent data is shared)
*territorial* privacy (intrude into another individual's environment)
✔✔Freely Given - ✔✔The GDPR requires that *consent* be a *freely given, specific,
informed and unambiguous* indication of the data subject's wishes by which he or she,
by a statement or by a clear affirmative action, signifies agreement to the processing of
personal data relating to him or her. The data subject *must have* a *genuine choice*,
must be able to refuse or withdraw consent without fear of consequence. *Where* there
is a *power imbalance*, as in an employer-employee relationship, for example, it's likely
that *consent cannot be freely given*.
,✔✔Gaskin v. United Kingdom - ✔✔A judgment delivered by the ECHR (European Court
of Human Rights) in 1989 held that the *restriction of* the applicant's *access to* his
*personal file* was *contrary to Article 8* of the Convention, citing a breach of *right to
respect for his family and private life*. Case related to *abuse whilst in social services
care*
✔✔General Data Protection Regulation - ✔✔Replaced the Data Protection Directive in
2018. The aim is to provide one set of data protection rules for all EU member states
and the European Economic Area (EEA). The document comprises *173 recitals* and
*99 articles*.
✔✔GET Method - ✔✔This and POST HTML method attributes specify how form data is
sent to a web page. Appends the form data to the URL in name/value pairs allowing
passwords and other sensitive information collected in a form to be visible in the
browser's address bar, and is thus *less secure than the POST method*.
✔✔Global Privacy Enforcement Network - ✔✔Organized following an OECD
(Organisation for Economic Co-operation and Development - an intergovernmental
economic organisation) recommendation for cooperation among member countries on
enforcement of privacy laws, is *collection of data protection authorities dedicated to
discussing aspects of privacy law enforcement cooperation*, the sharing of best
practices, development of shared enforcement priorities, and the support of joint
enforcement initiatives and awareness campaigns. As of 2018, counted *50 member
countries*
✔✔Haralambie v. Romania - ✔✔The *ECHR* (European Court of Human Rights)
decided in 2009 that the *Article 8 right to respect for private life and family life* had
been *violated when* the applicant *sought access* to the *secret service file* on him
drawn up in the days of Communist rule in Romania and was made to wait six years.
The court awarded 6,000 euros.
✔✔Individual Participation - ✔✔It is *fair information practices principle* that an
individual should have the right: a) to obtain from a data controller, or otherwise,
confirmation of whether or not the data controller has data relating to them; b) to have
data relating to them communicated to them within a reasonable time; at a charge, if
any, that is not excessive; in a reasonable manner, and in a form that is readily
intelligible to them; c) to be given reasons if a request made under subparagraphs (a)
and (b) is denied, and to be able to challenge such denial; and d) to challenge data
relating to them and, if the challenge is successful, to have the data erased, rectified,
completed or amended.
✔✔Information Life Cycle - ✔✔Recognizes that data has different value, and requires
approaches, as it moves through an organization from collection to deletion. The stages
are generally considered to be: *Collection, processing, use, disclosure, retention, and
destruction*.
, ✔✔Information Privacy - ✔✔One of the four classes of privacy, along with territorial
privacy, bodily privacy, and communications privacy. The *claim of individuals*, groups
or institutions *to determine for themselves when, how and to what extent information
about them is communicated to others*.
✔✔Information Security - ✔✔The protection of information for the purposes of
preventing *loss*, *unauthorized access* and/or *misuse*. It is also the process of
assessing threats and risks to information and the procedures and controls to preserve
confidentiality, integrity and availability of information.
✔✔Integrity - ✔✔The GDPR requires that controllers and processors implement
measures to ensure the ongoing confidentiality, integrity, availability and resilience of
processing systems and services. This refers to the *consistency, accuracy and
trustworthiness* of the data (see Accuracy).
✔✔Internet Protocol Address (EU specific) - ✔✔Listed within the GDPR as a form of
personal information, a unique string of numbers that identifies a computer on the
Internet or other TCP/IP network. The address is expressed in four groups of up to three
numbers, separated by periods. For example: 123.123.23.2. An address may be
*"dynamic," meaning that it is assigned temporarily* whenever a device logs on to a
network or an Internet service provider and consequently may be different each time a
device connects. Alternatively, an address may be *"static," meaning that it is assigned
to a particular device* and does not change, but remains assigned to one computer or
device.
✔✔Internet Service Provider - ✔✔A company that provides Internet access to homes
and businesses through *modem dial-up, DSL, cable modem broadband, dedicated
T1/T3 lines or wireless connections*.
✔✔ISO (International Organization for Standardization) 27001 - ✔✔The standard is a
*code of practice for implementing* an *information security management system*,
against which organizations can be *certified*.
✔✔ISO (International Organization for Standardization) 27002 - ✔✔The standard is a
*code of practice* for information security with hundreds of potential controls and control
mechanisms. The standard is intended to provide a guide for the development of
"organizational security standards and effective security management practices and to
help build confidence in inter-organizational activities". It can be considered *a guide to
implementing ISO 27001*
✔✔Joint Operations - ✔✔A reference to *joint investigations and* joint *enforcement
measures* in which members or staff from the *supervisory authorities of multiple
member states* are involved. The GDPR requires supervisory authorities to work with
one another when processing operations affect data subjects in multiple member states.
