CIPPE Scenario Practice
SCENARIO: Granchester University & Student Records - ANS-ANSWER THESE
CARDS IN ORDER AND USE THE NEXT CARD FOR THE FOLLOWING QUESTIONS
SCENARIO: Granchester University & Student Records
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for
data protection, while Frank is a lecturer in the engineering department. The University
maintains a number of types of records: Student records, including names, student
numbers, home addresses, pre-university information, university attendance and
performance records, details of special educational needs and financial information.
· Staff records, including autobiographical materials (such as curricula, professional
contact files, student evaluations and other relevant teaching files).
· Alumni records, including birthplaces, years of birth, dates of matriculation and
conferrals of degrees. These records are available to former students after registering
through Granchester's Alumni portal.
· Department for Education records, showing how certain demographic groups (such as
fir - ANS-USE THIS PARAGRAPH FOR THE NEXT FEW QUESTIONS UNTIL THE
NEXT SCENARIO IS LISTED
Which of the University's records does Anna NOT have to include in her record of
processing activities?
A. Student records
B. Staff and alumni records
C. Frank's performance database
D. Department for Education records - ANS-Department for Education records
Before Anna determines whether Frank's performance database is permissible, what
additional information does she need?
A. More information about Frank's data protection training.
B. More information about the extent of the information loss.
C. More information about the algorithm Frank used to mask student numbers.
, D. More information about what students have been told and how the research will be
used. - ANS-More information about what students have been told and how the
research will be used.
Anna will find that a risk analysis is NOT necessary in this situation as long as?
A. The data subjects are no longer current students of Frank's
B. The processing will not negatively affect the rights of the data subjects
C. The algorithms that Frank uses for the processing are technologically sound
D. The data subjects gave their unambiguous consent for the original processing -
ANS-The processing will not negatively affect the rights of the data subjects
SCENARIO: THE TOY MANUFACTURER - ANS-ANSWER THESE CARDS IN ORDER
AND USE THE NEXT CARD FOR THE FOLLOWING QUESTIONS
SCENARIO: THE TOY MANUFACTURER
You have just been hired by a toy manufacturer based in Hong Kong. The company
sells a broad range of dolls, action figures and plush toys that can be found
internationally in a wide variety of retail stores. Although the manufacturer has no offices
outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has
entered into a number of local distribution contracts. The toys produced by the company
can be found in all popular toy stores throughout Europe, the United States and Asia. A
large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk
and interact with children. The CEO of the company is touting these toys as the next big
thing, due to the increased possibilities offered: The figures can answer children's
questions on various subjects, such as mathematical calculatio - ANS-USE THIS
PARAGRAPH FOR THE NEXT FEW QUESTIONS UNTIL THE NEXT SCENARIO IS
LISTED
Why is this company obligated to comply with the GDPR?
A. The company has offices in the EU.
SCENARIO: Granchester University & Student Records - ANS-ANSWER THESE
CARDS IN ORDER AND USE THE NEXT CARD FOR THE FOLLOWING QUESTIONS
SCENARIO: Granchester University & Student Records
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for
data protection, while Frank is a lecturer in the engineering department. The University
maintains a number of types of records: Student records, including names, student
numbers, home addresses, pre-university information, university attendance and
performance records, details of special educational needs and financial information.
· Staff records, including autobiographical materials (such as curricula, professional
contact files, student evaluations and other relevant teaching files).
· Alumni records, including birthplaces, years of birth, dates of matriculation and
conferrals of degrees. These records are available to former students after registering
through Granchester's Alumni portal.
· Department for Education records, showing how certain demographic groups (such as
fir - ANS-USE THIS PARAGRAPH FOR THE NEXT FEW QUESTIONS UNTIL THE
NEXT SCENARIO IS LISTED
Which of the University's records does Anna NOT have to include in her record of
processing activities?
A. Student records
B. Staff and alumni records
C. Frank's performance database
D. Department for Education records - ANS-Department for Education records
Before Anna determines whether Frank's performance database is permissible, what
additional information does she need?
A. More information about Frank's data protection training.
B. More information about the extent of the information loss.
C. More information about the algorithm Frank used to mask student numbers.
, D. More information about what students have been told and how the research will be
used. - ANS-More information about what students have been told and how the
research will be used.
Anna will find that a risk analysis is NOT necessary in this situation as long as?
A. The data subjects are no longer current students of Frank's
B. The processing will not negatively affect the rights of the data subjects
C. The algorithms that Frank uses for the processing are technologically sound
D. The data subjects gave their unambiguous consent for the original processing -
ANS-The processing will not negatively affect the rights of the data subjects
SCENARIO: THE TOY MANUFACTURER - ANS-ANSWER THESE CARDS IN ORDER
AND USE THE NEXT CARD FOR THE FOLLOWING QUESTIONS
SCENARIO: THE TOY MANUFACTURER
You have just been hired by a toy manufacturer based in Hong Kong. The company
sells a broad range of dolls, action figures and plush toys that can be found
internationally in a wide variety of retail stores. Although the manufacturer has no offices
outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has
entered into a number of local distribution contracts. The toys produced by the company
can be found in all popular toy stores throughout Europe, the United States and Asia. A
large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk
and interact with children. The CEO of the company is touting these toys as the next big
thing, due to the increased possibilities offered: The figures can answer children's
questions on various subjects, such as mathematical calculatio - ANS-USE THIS
PARAGRAPH FOR THE NEXT FEW QUESTIONS UNTIL THE NEXT SCENARIO IS
LISTED
Why is this company obligated to comply with the GDPR?
A. The company has offices in the EU.
