CIPPE GENERAL TERMS AND PRACTICE
QUESTIONS
What is the Primary Task of the DPO - ANSWER-Provide advice on DPIA &
Advise on Mitigation of Risk
How long does one DPA have to reply to another on a cooperation
request? - ANSWER-1 Month
When is a DPO required? - ANSWER-1) Public Authorities Processing
Personal Data
2) Core Activities of entity involve regular & Systematic monitoring of data
sujbects on a large scale
3) Core activities of entity involve large scale processing of special
categories of data
When is a DPIA needed? - ANSWER-When the type of processing is likely
to result in a high risk to the rights & freedoms of natural persons
GDPR is influenced in part by what previous set of guidelines or
principles? - ANSWER-OECD Principles
Why was the Data Retention Directive Invalidated in 2014? - ANSWER-It
disproportionately interferes with European citizens' rights to private life &
the protection of personal data..
Basically it impacts everyone without exception
,What is out of scope in the GDPR? - ANSWER-Anonymous Data
Article 8 of the Universal Convention of Human Rights - ANSWER-Right to
privacy
What is required for a company to market to EU consumer via Email? -
ANSWER-Prior opt in consent
OR
Previous consumer purchase
What will an employer do with employee data once they are terminated? -
ANSWER-They will keep the data legally required to keep
What was the goal of the original EU Directive 95/46? - ANSWER-
Harmonize European data protection law...
To further reconcile the protection of fundamental rights w/free flow of
data from one member state to another.
What is the primary task of the DPO? - ANSWER-Provide advice on DPIA &
Advise mitigation of risk
What is not needed in article of processing records? - ANSWER-Links to
DPIA are not needed
Member state laws have the ability to enact local laws for what? -
ANSWER-Age of child consent
,(they can move parental consent from age 16 through 13)
What did ePrivacy make happen in 2009? - ANSWER-Mandatory data
breach notification from electronic communications providers
Multiple companies wish to use a single DPO...
What needs to happen? - ANSWER-The single DPO needs to be easily
accessible by ALL companies
If a Data Subject's personal data was collected via indirect means, what is
the controller's primary obligation? - ANSWER-Inform the data subject
about it
with CCTV, what would you NOT need to do first? - ANSWER-....Create a
retention policy
What is true when an employee requests information from their
employer? - ANSWER-Employer has to comply unless there's an exception
What is true of Binding Corporate Rules required by employees - ANSWER-
Employees must follow all rules of the BCR no matter where they work
What are the special categories of data? - ANSWER-1) Racial or Ethnic
Origin
2) Political Opinions
3) Religious or Philosophical Beliefs
4) Trade Union (membership)
5) Genetic Data
, 6) Biometric Data (used to identify individual)
7) Data Related to Sexual Preferences (sex life or orientation)
8) Health Data
What kind of law is the GDPR considered? - ANSWER-Comprehensive
What do GDPR and Convention 108 have in common? - ANSWER-They
both recognise the need for regulation on flow of internationally...
What is forum shopping? - ANSWER-a strategy of placing your HQ or main
establishment in a state with more relaxed privacy laws
When does a processor inform a controller of a breach? - ANSWER-without
undue delay after becoming aware of it
Article 58 of the GDPR give supervisory authorities power to do what? -
ANSWER--Order a controller or processor to provide information
-Conducting investigatory Audits
-Obtaining access to premises & data
-Issuing Warnings, reprimands, & imposing fines
-Ordering controllers/processors to comply with the GDPR and Data
subjects' rights
-Banning processing & transborder Data Flows outside the EU
QUESTIONS
What is the Primary Task of the DPO - ANSWER-Provide advice on DPIA &
Advise on Mitigation of Risk
How long does one DPA have to reply to another on a cooperation
request? - ANSWER-1 Month
When is a DPO required? - ANSWER-1) Public Authorities Processing
Personal Data
2) Core Activities of entity involve regular & Systematic monitoring of data
sujbects on a large scale
3) Core activities of entity involve large scale processing of special
categories of data
When is a DPIA needed? - ANSWER-When the type of processing is likely
to result in a high risk to the rights & freedoms of natural persons
GDPR is influenced in part by what previous set of guidelines or
principles? - ANSWER-OECD Principles
Why was the Data Retention Directive Invalidated in 2014? - ANSWER-It
disproportionately interferes with European citizens' rights to private life &
the protection of personal data..
Basically it impacts everyone without exception
,What is out of scope in the GDPR? - ANSWER-Anonymous Data
Article 8 of the Universal Convention of Human Rights - ANSWER-Right to
privacy
What is required for a company to market to EU consumer via Email? -
ANSWER-Prior opt in consent
OR
Previous consumer purchase
What will an employer do with employee data once they are terminated? -
ANSWER-They will keep the data legally required to keep
What was the goal of the original EU Directive 95/46? - ANSWER-
Harmonize European data protection law...
To further reconcile the protection of fundamental rights w/free flow of
data from one member state to another.
What is the primary task of the DPO? - ANSWER-Provide advice on DPIA &
Advise mitigation of risk
What is not needed in article of processing records? - ANSWER-Links to
DPIA are not needed
Member state laws have the ability to enact local laws for what? -
ANSWER-Age of child consent
,(they can move parental consent from age 16 through 13)
What did ePrivacy make happen in 2009? - ANSWER-Mandatory data
breach notification from electronic communications providers
Multiple companies wish to use a single DPO...
What needs to happen? - ANSWER-The single DPO needs to be easily
accessible by ALL companies
If a Data Subject's personal data was collected via indirect means, what is
the controller's primary obligation? - ANSWER-Inform the data subject
about it
with CCTV, what would you NOT need to do first? - ANSWER-....Create a
retention policy
What is true when an employee requests information from their
employer? - ANSWER-Employer has to comply unless there's an exception
What is true of Binding Corporate Rules required by employees - ANSWER-
Employees must follow all rules of the BCR no matter where they work
What are the special categories of data? - ANSWER-1) Racial or Ethnic
Origin
2) Political Opinions
3) Religious or Philosophical Beliefs
4) Trade Union (membership)
5) Genetic Data
, 6) Biometric Data (used to identify individual)
7) Data Related to Sexual Preferences (sex life or orientation)
8) Health Data
What kind of law is the GDPR considered? - ANSWER-Comprehensive
What do GDPR and Convention 108 have in common? - ANSWER-They
both recognise the need for regulation on flow of internationally...
What is forum shopping? - ANSWER-a strategy of placing your HQ or main
establishment in a state with more relaxed privacy laws
When does a processor inform a controller of a breach? - ANSWER-without
undue delay after becoming aware of it
Article 58 of the GDPR give supervisory authorities power to do what? -
ANSWER--Order a controller or processor to provide information
-Conducting investigatory Audits
-Obtaining access to premises & data
-Issuing Warnings, reprimands, & imposing fines
-Ordering controllers/processors to comply with the GDPR and Data
subjects' rights
-Banning processing & transborder Data Flows outside the EU
