CIPP/E EXAM PREP: 200 COMPREHENSIVE EXAM
QUESTIONS WITH DETAILED RATIONALES AND VERIFIED
ANSWERS
Domain I: Introduction to European Data Protection
1. Which historical document first articulated a right to privacy as
"the right to be let alone"?
A. The Universal Declaration of Human Rights
B. The OECD Privacy Guidelines
C. The Harvard Law Review article by Warren and Brandeis
D. The Council of Europe Convention 108
Rationale: The 1890 article "The Right to Privacy" by Samuel Warren
and Louis Brandeis is widely credited with introducing the concept
of privacy as a legal right in the United States.
2. What was the primary purpose of the Council of Europe
Convention 108?
A. To establish the European Union
B. To protect individuals against violations of privacy caused by the
automatic processing of personal data
C. To create the European Court of Human Rights
D. To regulate telecommunications
Rationale: Convention 108, opened for signature in 1981, was the
first legally binding international instrument on data protection.
,3. Which EU institution has the power to propose data protection
legislation?
A. The European Parliament
B. The Council of the European Union
C. The European Commission
D. The Court of Justice of the European Union
Rationale: The European Commission holds the right of legislative
initiative in most policy areas, including data protection.
4. What is the role of the European Data Protection Board (EDPB)?
A. To adjudicate disputes between member states
B. To ensure consistent application of the GDPR
C. To issue binding decisions on supervisory authorities
D. To propose amendments to the GDPR
Rationale: The EDPB is an independent body that contributes to the
consistent application of data protection rules throughout the EU.
5. Which treaty first introduced the concept of EU citizenship and
strengthened the role of the European Parliament?
A. The Treaty of Rome
B. The Maastricht Treaty
C. The Treaty of Lisbon
D. The Single European Act
Rationale: The Treaty of Lisbon, which entered into force in 2009,
made the Charter of Fundamental Rights legally binding and
reinforced the EU's institutional framework.
6. What is the purpose of the ePrivacy Directive (2002/58/EC)?
A. To regulate electronic commerce
B. To protect privacy in the electronic communications sector
, C. To harmonize data protection laws across the EU
D. To establish the European Data Protection Supervisor
Rationale: The ePrivacy Directive specifically addresses the
processing of personal data and the protection of privacy in the
electronic communications sector.
7. Which of the following is a key principle of the OECD Privacy
Guidelines?
A. Data localization
B. Collection limitation
C. Mandatory breach notification
D. Right to be forgotten
Rationale: The OECD Guidelines, first issued in 1980, include
principles such as collection limitation, data quality, purpose
specification, and use limitation.
8. What was the main reason for the EU Data Protection Directive
(95/46/EC)?
A. To implement Convention 108
B. To create a single market for data
C. To harmonize data protection laws across member states
D. To regulate telecommunications
Rationale: The Directive aimed to remove obstacles to the free flow
of personal data within the EU by ensuring a high and consistent
level of protection.
9. Which EU institution is responsible for ensuring that EU law is
applied correctly?
A. The European Parliament
B. The Council of the European Union
, C. The European Commission
D. The Court of Justice of the European Union
Rationale: The European Commission, as the guardian of the
Treaties, monitors the application of EU law and can bring
infringement proceedings against member states.
10. What is the significance of the EU Charter of Fundamental
Rights?
A. It is a non-binding declaration
B. It has the same legal value as the EU Treaties
C. It only applies to EU institutions
D. It replaced the European Convention on Human Rights
Rationale: Since the entry into force of the Treaty of Lisbon, the
Charter has the same legal value as the Treaties, making
fundamental rights legally enforceable within the EU.
11. Which of the following best describes the concept of "privacy by
design"?
A. A requirement to obtain consent before processing
B. Embedding data protection into the design of systems and
processes
C. A method for anonymizing data
D. A type of privacy notice
Rationale: Privacy by design requires that data protection be
considered from the outset of any project or system development.
12. What is the role of the European Court of Human Rights (ECtHR)?
A. To interpret EU law
B. To enforce the GDPR
C. To ensure that states comply with the European Convention on
QUESTIONS WITH DETAILED RATIONALES AND VERIFIED
ANSWERS
Domain I: Introduction to European Data Protection
1. Which historical document first articulated a right to privacy as
"the right to be let alone"?
A. The Universal Declaration of Human Rights
B. The OECD Privacy Guidelines
C. The Harvard Law Review article by Warren and Brandeis
D. The Council of Europe Convention 108
Rationale: The 1890 article "The Right to Privacy" by Samuel Warren
and Louis Brandeis is widely credited with introducing the concept
of privacy as a legal right in the United States.
2. What was the primary purpose of the Council of Europe
Convention 108?
A. To establish the European Union
B. To protect individuals against violations of privacy caused by the
automatic processing of personal data
C. To create the European Court of Human Rights
D. To regulate telecommunications
Rationale: Convention 108, opened for signature in 1981, was the
first legally binding international instrument on data protection.
,3. Which EU institution has the power to propose data protection
legislation?
A. The European Parliament
B. The Council of the European Union
C. The European Commission
D. The Court of Justice of the European Union
Rationale: The European Commission holds the right of legislative
initiative in most policy areas, including data protection.
4. What is the role of the European Data Protection Board (EDPB)?
A. To adjudicate disputes between member states
B. To ensure consistent application of the GDPR
C. To issue binding decisions on supervisory authorities
D. To propose amendments to the GDPR
Rationale: The EDPB is an independent body that contributes to the
consistent application of data protection rules throughout the EU.
5. Which treaty first introduced the concept of EU citizenship and
strengthened the role of the European Parliament?
A. The Treaty of Rome
B. The Maastricht Treaty
C. The Treaty of Lisbon
D. The Single European Act
Rationale: The Treaty of Lisbon, which entered into force in 2009,
made the Charter of Fundamental Rights legally binding and
reinforced the EU's institutional framework.
6. What is the purpose of the ePrivacy Directive (2002/58/EC)?
A. To regulate electronic commerce
B. To protect privacy in the electronic communications sector
, C. To harmonize data protection laws across the EU
D. To establish the European Data Protection Supervisor
Rationale: The ePrivacy Directive specifically addresses the
processing of personal data and the protection of privacy in the
electronic communications sector.
7. Which of the following is a key principle of the OECD Privacy
Guidelines?
A. Data localization
B. Collection limitation
C. Mandatory breach notification
D. Right to be forgotten
Rationale: The OECD Guidelines, first issued in 1980, include
principles such as collection limitation, data quality, purpose
specification, and use limitation.
8. What was the main reason for the EU Data Protection Directive
(95/46/EC)?
A. To implement Convention 108
B. To create a single market for data
C. To harmonize data protection laws across member states
D. To regulate telecommunications
Rationale: The Directive aimed to remove obstacles to the free flow
of personal data within the EU by ensuring a high and consistent
level of protection.
9. Which EU institution is responsible for ensuring that EU law is
applied correctly?
A. The European Parliament
B. The Council of the European Union
, C. The European Commission
D. The Court of Justice of the European Union
Rationale: The European Commission, as the guardian of the
Treaties, monitors the application of EU law and can bring
infringement proceedings against member states.
10. What is the significance of the EU Charter of Fundamental
Rights?
A. It is a non-binding declaration
B. It has the same legal value as the EU Treaties
C. It only applies to EU institutions
D. It replaced the European Convention on Human Rights
Rationale: Since the entry into force of the Treaty of Lisbon, the
Charter has the same legal value as the Treaties, making
fundamental rights legally enforceable within the EU.
11. Which of the following best describes the concept of "privacy by
design"?
A. A requirement to obtain consent before processing
B. Embedding data protection into the design of systems and
processes
C. A method for anonymizing data
D. A type of privacy notice
Rationale: Privacy by design requires that data protection be
considered from the outset of any project or system development.
12. What is the role of the European Court of Human Rights (ECtHR)?
A. To interpret EU law
B. To enforce the GDPR
C. To ensure that states comply with the European Convention on
