CIPP/E EVALUATION EXAM 2026 QUESTIONS AND
ANSWERS SCORED A+
✔✔E-Privacy Directive - ✔✔Concerns the processing of personal data and the
protection of privacy in the electronic communications sector and covers all forms of
electronic communications.
✔✔E-Privacy Directive Amendment - ✔✔The changes generally relate to the
introduction of mandatory notification of personal data breaches by electronic
communications services provider. Perhaps the most pertinent and controversial
amendment concerns the new provision affecting cookies: the storing of information (or
the gaining of access to information already stored) in the terminal equipment of a
subscriber or user is allowed only on the condition that the user concerned has given
consent, having been provided with clear and comprehensive information.
✔✔Data Retention Directive (2006/24/EC) - ✔✔Retention of data generated or
processed in connection with the provision of publicly available electronic
communications services or of public communication networks amends the relevant
data retention provisions of the e-Privacy Directive.
The Directive does not cover retention of the actual content of communications--rather it
applies to traffic and location data of both individuals and organizations, as well as to
the relevant data necessary to identify the subscriber or registered user.
✔✔Personal Data - ✔✔Any information relating to an identified or identifiable natural
person.
✔✔Sensitive Personal Data - ✔✔Personal data revealing:
1. Racial or ethnic origin;
2. Political opinions;
3. Religious beliefs;
4. Philosophical beliefs;
5. Trade union membership;
6. Health; or
7. Sex life.
✔✔Controller - ✔✔Natural or legal person, public authority, agency, or any other body
that alone or jointly with others determines the purposes and means of the processing
of personal data.
✔✔Processor - ✔✔A person (other than an employee of the controller) who processes
personal data on behalf of a controller. A processor may be more closely involved in the
processing of personal data but does not have the authority to allocate responsibility
, that a controller has. The processor is only acting on behalf of the controller, although
the processor's status can have a direct legal effect.
✔✔Data Protection Directive - Article 4(1)(a) - ✔✔The law of a member state applies
when the data processing is carried out in the context of the activities of an
establishment of the controller on the territory of the member state.
Where the controller has establishments in more than one member state, it must follow
each national law attributable to its data processing operations.
✔✔Data Protection Directive - Article 4(1)(c) - ✔✔The provision is intended to allow a
member state to apply its national data protection law to a controller who, although not
established in the EU, makes use of equipment situated in that member state unless
that equipment is used only for the purposes of transit though EU.
✔✔Data Protection Principles - ✔✔1. Fairness and lawfulness
2. Purpose limitation (AKA principle of finality)
3. Proportionality
4. Data quality
✔✔Fairness - ✔✔For data processing to be fair, the controller must provide data
subjects with:
1. the identify of the controller and of its reps.;
2. the processing purpose; and
3. any further information, such as the recipients of the data or the existence of the right
of access to and the right to rectify the data.
✔✔Lawfulness - ✔✔For the data processing to be lawful, personal data must be
processed in a way that satisfies both data protection laws and other legal
requirements.
Processing is unlawful where information is obtained (or otherwise processed) in breach
of:
1. an enforceable contractual agreement;
2. the duty of confidence; or
3. the human right to privacy
✔✔Purpose Limitation - ✔✔Imposes limits on data controllers' use of personal data.
The principle of purpose limitation is also called the principle of finality, as it imposes
limits on the processing of data for purposes other than those for which it was obtained.
Exception: the Directive allows for the further processing of personal data for research
purposes, even if the data was not collected for those purposes, as long as the member
states provide "appropriate safeguards."
ANSWERS SCORED A+
✔✔E-Privacy Directive - ✔✔Concerns the processing of personal data and the
protection of privacy in the electronic communications sector and covers all forms of
electronic communications.
✔✔E-Privacy Directive Amendment - ✔✔The changes generally relate to the
introduction of mandatory notification of personal data breaches by electronic
communications services provider. Perhaps the most pertinent and controversial
amendment concerns the new provision affecting cookies: the storing of information (or
the gaining of access to information already stored) in the terminal equipment of a
subscriber or user is allowed only on the condition that the user concerned has given
consent, having been provided with clear and comprehensive information.
✔✔Data Retention Directive (2006/24/EC) - ✔✔Retention of data generated or
processed in connection with the provision of publicly available electronic
communications services or of public communication networks amends the relevant
data retention provisions of the e-Privacy Directive.
The Directive does not cover retention of the actual content of communications--rather it
applies to traffic and location data of both individuals and organizations, as well as to
the relevant data necessary to identify the subscriber or registered user.
✔✔Personal Data - ✔✔Any information relating to an identified or identifiable natural
person.
✔✔Sensitive Personal Data - ✔✔Personal data revealing:
1. Racial or ethnic origin;
2. Political opinions;
3. Religious beliefs;
4. Philosophical beliefs;
5. Trade union membership;
6. Health; or
7. Sex life.
✔✔Controller - ✔✔Natural or legal person, public authority, agency, or any other body
that alone or jointly with others determines the purposes and means of the processing
of personal data.
✔✔Processor - ✔✔A person (other than an employee of the controller) who processes
personal data on behalf of a controller. A processor may be more closely involved in the
processing of personal data but does not have the authority to allocate responsibility
, that a controller has. The processor is only acting on behalf of the controller, although
the processor's status can have a direct legal effect.
✔✔Data Protection Directive - Article 4(1)(a) - ✔✔The law of a member state applies
when the data processing is carried out in the context of the activities of an
establishment of the controller on the territory of the member state.
Where the controller has establishments in more than one member state, it must follow
each national law attributable to its data processing operations.
✔✔Data Protection Directive - Article 4(1)(c) - ✔✔The provision is intended to allow a
member state to apply its national data protection law to a controller who, although not
established in the EU, makes use of equipment situated in that member state unless
that equipment is used only for the purposes of transit though EU.
✔✔Data Protection Principles - ✔✔1. Fairness and lawfulness
2. Purpose limitation (AKA principle of finality)
3. Proportionality
4. Data quality
✔✔Fairness - ✔✔For data processing to be fair, the controller must provide data
subjects with:
1. the identify of the controller and of its reps.;
2. the processing purpose; and
3. any further information, such as the recipients of the data or the existence of the right
of access to and the right to rectify the data.
✔✔Lawfulness - ✔✔For the data processing to be lawful, personal data must be
processed in a way that satisfies both data protection laws and other legal
requirements.
Processing is unlawful where information is obtained (or otherwise processed) in breach
of:
1. an enforceable contractual agreement;
2. the duty of confidence; or
3. the human right to privacy
✔✔Purpose Limitation - ✔✔Imposes limits on data controllers' use of personal data.
The principle of purpose limitation is also called the principle of finality, as it imposes
limits on the processing of data for purposes other than those for which it was obtained.
Exception: the Directive allows for the further processing of personal data for research
purposes, even if the data was not collected for those purposes, as long as the member
states provide "appropriate safeguards."
