CIPP/E MAIN EXAMINATION 2026 SET QUESTIONS AND
ANSWERS SCORED A+
✔✔Council of the European Union ("the Council") - ✔✔a. Can adopt EU laws together
w/ Parliament upon proposal of Commission
b. Made up of government ministers from each EU member state
✔✔CoE Convention 108 (1981) - ✔✔a. CoE Convention 108
i. the 1st (and only) international legally binding instrument to specifically address data
protection.
ii. Protects individuals from abuse
iii. Regulates trans-border flow of personal data
✔✔Treaty No. 181 - ✔✔i. Improves upon Convention 108
a) Provides for setting up of national supervisory authorities responsible for ensuring
compliance w/ data protection/trans-border data flow laws adopted in pursuance of the
convention
b) Data may only be transferred to third-countries if recipient State or international
organization is able to afford adequate level of protection
✔✔The EU Data Protection Directive (95/46/EC) - ✔✔a. Principal EU legal instrument
on data protection (for now, until GDPR)
b. Adopted 1995
c. Aimed to harmonize data protection law at national level
d. Sets a floor for data protection law
e. Seeks to give substance to and expand the principles in Convention 108
f. Extends beyond the EU, including non-member states that are part of the EEA
g. CJEU has jurisdiction to determine whether a Member State has fulfilled its
obligations under the Directive
✔✔The EU Directive on Privacy and Electronic Communications (2002/58/EC) (e-
Privacy Directive) - ✔✔i. Complements the Data Protection Directive
ii. Addresses requirements of new digital technologies and eases advance of electronic
communications services
iii. Security obligations
iv. Duty to inform subscribers of risk (virus, malware, etc.)
v. Confidentiality
vi. Member States should prohibit wire-tapping, interception, surveillance, etc. of
communications
b. Unsolicited e-mail and other messages
i. Use of email addresses for marketing purposes is prohibited
ii. Opt-in only for unsolicited emails
c. Cookies
, i. Exempts cookies that are "strictly necessary for the delivery of a service requested by
the user" (e.g., shopping cart cookies)
ii. Cookies allowed only if user:
a) is provided notice about purpose, storage, access to the cookie information; and
b) Gives consent (opt-in only).
✔✔The EU Directive on Electronic Commerce (2000/31/EC) (e-Commerce Directive) -
✔✔a. Addresses legal aspects of e-commerce.
✔✔EU Data Retention Directive (2006/24/EC) - ✔✔i. Declared invalid in April 2014.
a) In absence, Member States may still provide their own data retention scheme, but
they must still comply with the ePrivacy Directive, the EU Charter of Fundamental
Rights and the CJEU ruling.
ii. Member states must store citizens/ telecommunications data for minimum 6 months
and max 24 months.
iii. Service providers are obligated to erase/anonymize traffic data processed when no
longer needed, unless exception applies
✔✔Personal Data - ✔✔a. Any information relating to an identified or identifiable natural
person ('data subject')
i. "identifiable natural person" is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an ID number, location data,
online identifier or to one or more factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that natural person.
✔✔Sensitive Personal Data - ✔✔a. Personal data revealing:
i. racial or ethnic origin,
ii. political opinions,
iii. religious or philosophical beliefs, or
iv. trade union membership, and
b. the processing of:
i. genetic data,
ii. biometric data,
iii. health data
iv. data concerning a natural person's sex life or sexual orientation
c. shall be prohibited, except in certain cases [see Art 9(2)]
✔✔Pseudonymous Data - ✔✔The processing of personal data in such a manner that
the personal data can no longer be attributed to a specific data subject without the use
of additional information, provided that such additional information is kept separately
and is subject to technical and organizational measures to ensure that the personal data
are not attributed to an identified or identifiable natural person.
, ✔✔Anonymous Data - ✔✔Anonymous data' means information which does not relate to
an identified or identifiable natural person or to personal data rendered anonymous in
such a manner that the data subject is not or no longer identifiable.
✔✔Where does GDPR processing of personal data apply if establishment is in
EU/EEA? - ✔✔GDPR applies to processing of personal data in the context of controller
or processor activities in the EU/EEA, regardless of whether the processing takes place
in the EU/EEA or not
✔✔Where does GDPR processing of personal data apply if establishment is outside of
EU/EEA? - ✔✔a. GDPR applies to processing of personal data of data subjects who are
in the EU/EEA by a controller or processor not established in the EU/EEA, where the
processing activities are related to:
i. The offering of goods or services, irrespective of whether a payment of the data
subject is required, to such data subjects in the EU/EEA; or
ii. The monitoring of their behavior as far as their behavior takes place within the
EU/EEA.
b. GDPR applies to the processing of personal data by a controller not established in
the EU/EEA, but in a place where Member State law applies by virtue of public
international law.
✔✔Data Protection Principles - ✔✔1. Fairness and lawfulness transparency
2. Purpose limitation
3. Proportionality
4. Data Quality
5. Accuracy
6. Storage Limitation
7. Integrity and confidentiality
8. Accountability
✔✔Legitimate Processing Criteria - ✔✔1. Consent
2. Contractual Necessity
3. Legal Obligation, vital interests, and public interest
4. Legitimate interests
5. Special categories of processing
6. Processing of personal data relating to criminal convictions and offences
✔✔Consent - ✔✔a. 'Consent' = freely given, specific, informed and unambiguous
indication of the data subject's wishes, by a statement or clear affirmative action,
signifying agreement to the processing of personal data relating to him/her. (Art. 4(11))
b. Controller must be able to demonstrate that the data subject has consented.
c. The request for consent must be clearly distinguishable from other matters (i.e., must
be explicit), intelligible, easily accessible, clear and plain language.
d. Data subject has right to withdraw consent at any time, and must be informed of this
right prior to giving consent.
ANSWERS SCORED A+
✔✔Council of the European Union ("the Council") - ✔✔a. Can adopt EU laws together
w/ Parliament upon proposal of Commission
b. Made up of government ministers from each EU member state
✔✔CoE Convention 108 (1981) - ✔✔a. CoE Convention 108
i. the 1st (and only) international legally binding instrument to specifically address data
protection.
ii. Protects individuals from abuse
iii. Regulates trans-border flow of personal data
✔✔Treaty No. 181 - ✔✔i. Improves upon Convention 108
a) Provides for setting up of national supervisory authorities responsible for ensuring
compliance w/ data protection/trans-border data flow laws adopted in pursuance of the
convention
b) Data may only be transferred to third-countries if recipient State or international
organization is able to afford adequate level of protection
✔✔The EU Data Protection Directive (95/46/EC) - ✔✔a. Principal EU legal instrument
on data protection (for now, until GDPR)
b. Adopted 1995
c. Aimed to harmonize data protection law at national level
d. Sets a floor for data protection law
e. Seeks to give substance to and expand the principles in Convention 108
f. Extends beyond the EU, including non-member states that are part of the EEA
g. CJEU has jurisdiction to determine whether a Member State has fulfilled its
obligations under the Directive
✔✔The EU Directive on Privacy and Electronic Communications (2002/58/EC) (e-
Privacy Directive) - ✔✔i. Complements the Data Protection Directive
ii. Addresses requirements of new digital technologies and eases advance of electronic
communications services
iii. Security obligations
iv. Duty to inform subscribers of risk (virus, malware, etc.)
v. Confidentiality
vi. Member States should prohibit wire-tapping, interception, surveillance, etc. of
communications
b. Unsolicited e-mail and other messages
i. Use of email addresses for marketing purposes is prohibited
ii. Opt-in only for unsolicited emails
c. Cookies
, i. Exempts cookies that are "strictly necessary for the delivery of a service requested by
the user" (e.g., shopping cart cookies)
ii. Cookies allowed only if user:
a) is provided notice about purpose, storage, access to the cookie information; and
b) Gives consent (opt-in only).
✔✔The EU Directive on Electronic Commerce (2000/31/EC) (e-Commerce Directive) -
✔✔a. Addresses legal aspects of e-commerce.
✔✔EU Data Retention Directive (2006/24/EC) - ✔✔i. Declared invalid in April 2014.
a) In absence, Member States may still provide their own data retention scheme, but
they must still comply with the ePrivacy Directive, the EU Charter of Fundamental
Rights and the CJEU ruling.
ii. Member states must store citizens/ telecommunications data for minimum 6 months
and max 24 months.
iii. Service providers are obligated to erase/anonymize traffic data processed when no
longer needed, unless exception applies
✔✔Personal Data - ✔✔a. Any information relating to an identified or identifiable natural
person ('data subject')
i. "identifiable natural person" is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an ID number, location data,
online identifier or to one or more factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that natural person.
✔✔Sensitive Personal Data - ✔✔a. Personal data revealing:
i. racial or ethnic origin,
ii. political opinions,
iii. religious or philosophical beliefs, or
iv. trade union membership, and
b. the processing of:
i. genetic data,
ii. biometric data,
iii. health data
iv. data concerning a natural person's sex life or sexual orientation
c. shall be prohibited, except in certain cases [see Art 9(2)]
✔✔Pseudonymous Data - ✔✔The processing of personal data in such a manner that
the personal data can no longer be attributed to a specific data subject without the use
of additional information, provided that such additional information is kept separately
and is subject to technical and organizational measures to ensure that the personal data
are not attributed to an identified or identifiable natural person.
, ✔✔Anonymous Data - ✔✔Anonymous data' means information which does not relate to
an identified or identifiable natural person or to personal data rendered anonymous in
such a manner that the data subject is not or no longer identifiable.
✔✔Where does GDPR processing of personal data apply if establishment is in
EU/EEA? - ✔✔GDPR applies to processing of personal data in the context of controller
or processor activities in the EU/EEA, regardless of whether the processing takes place
in the EU/EEA or not
✔✔Where does GDPR processing of personal data apply if establishment is outside of
EU/EEA? - ✔✔a. GDPR applies to processing of personal data of data subjects who are
in the EU/EEA by a controller or processor not established in the EU/EEA, where the
processing activities are related to:
i. The offering of goods or services, irrespective of whether a payment of the data
subject is required, to such data subjects in the EU/EEA; or
ii. The monitoring of their behavior as far as their behavior takes place within the
EU/EEA.
b. GDPR applies to the processing of personal data by a controller not established in
the EU/EEA, but in a place where Member State law applies by virtue of public
international law.
✔✔Data Protection Principles - ✔✔1. Fairness and lawfulness transparency
2. Purpose limitation
3. Proportionality
4. Data Quality
5. Accuracy
6. Storage Limitation
7. Integrity and confidentiality
8. Accountability
✔✔Legitimate Processing Criteria - ✔✔1. Consent
2. Contractual Necessity
3. Legal Obligation, vital interests, and public interest
4. Legitimate interests
5. Special categories of processing
6. Processing of personal data relating to criminal convictions and offences
✔✔Consent - ✔✔a. 'Consent' = freely given, specific, informed and unambiguous
indication of the data subject's wishes, by a statement or clear affirmative action,
signifying agreement to the processing of personal data relating to him/her. (Art. 4(11))
b. Controller must be able to demonstrate that the data subject has consented.
c. The request for consent must be clearly distinguishable from other matters (i.e., must
be explicit), intelligible, easily accessible, clear and plain language.
d. Data subject has right to withdraw consent at any time, and must be informed of this
right prior to giving consent.
