CIPP/e questions
A company is placed in a rustic NOT taken into consideration through the European Union (EU)
to have an adequate degree of data protection. Which of the subsequent is an duty of the
business enterprise if it imports
non-public statistics from every other employer inside the European Economic Area (EEA)
underneath general
contractual clauses?
(A). Submit the contract to its own government authority.
(B). Ensure that word is given to and consent is received from data topics.
(C). Supply any statistics requested by using a records protection authority (DPA) within 30
days.
(D). Ensure that neighborhood laws do now not hinder the organization from meeting its
contractual duties. - ANS-A). Submit the contract to its own authorities authority.
A organisation plans to switch employee health facts among two of its entities in
France. To preserve the security of the processing, what will be the maximum critical security
measure to apply to the health information transmission?
(A). Inform the facts situation of the security measures in region.
(B). Ensure that the receiving entity has signed a facts processing agreement.
(C). Encrypt the transferred records in transit and at rest.
(D). Conduct a information safety effect assessment. - ANS-A). Inform the facts subject of the
safety measures in location.
A German records subject was the victim of an embarrassing prank twenty years in the past. A
newspaper
internet site published an editorial about the prank at the time, and the article remains available
on the
newspaper's internet site. Unfortunately, the prank is the top seek end result while a consumer
searches at the
victim's name. The records problem requests that SearchCo delist this result. SearchCo is of the
same opinion, and
instructs its era crew to avoid scanning or indexing the thing.
What else should SearchCo do?
(A). Notify the newspaper that its article it's miles delisting the item.
(B). Fully erase the URL to the content material, as opposed to delist that is in particular based
on data problem's
,call.
(C). Identify different controllers who are processing the same facts and tell them of the
delisting request.
(D). Prevent the thing from being listed in search effects regardless of what search phrases are
entered
into the quest engine. - ANS-(A). Notify the newspaper that its article it's far delisting the item.
A key component of the OECD Guidelines is the "Individual Participation Principle". What
parts of the General Data Protection Regulation (GDPR) provide the nearest equivalent to that
precept?
(A). The lawful processing standards stipulated by Articles 6 to nine
(B). The facts requirements set out in Articles thirteen and 14
(C). The breach notification necessities specified in Articles 33 and 34
(D). The rights granted to information topics underneath Articles 12 to 22 - ANS-(D). The rights
granted to records topics under Articles 12 to 22
A cell device application that makes use of cookies could be challenge to the consent
requirement of
which of the subsequent?
(A). The ePrivacy Directive
(B). The E-Commerce Directive
(C). The Data Retention Directive
(D). The EU Cybersecurity Directive - ANS-A). The ePrivacy Directive
A Spanish strength patron calls her local provider with Questions: about the enterprise's
upcoming merger. Specifically, the client wants to realize the recipients to whom her private
statistics could be disclosed as soon as the merger is very last. According to Article 13 of the
GDPR, what need to the
organization do before imparting the purchaser with the requested statistics?
(A). Verify that the request is relevant to the data accumulated before the GDPR entered into
pressure.
(B). Verify that the reason of the request from the customer is in keeping with the GDPR.
(C). Verify that the non-public records has not already been despatched to the patron.
(D). Verify that the identification of the patron can be proven via other method. - ANS-A). Verify
that the request is applicable to the statistics gathered before the GDPR entered into force.
A U.S.-primarily based on line store uses state-of-the-art software to track the browsing
behavior of its
European customers and predict future purchases. It also stocks this statistics with third parties.
Under the GDPR, what's the net store's PRIMARY duty at the same time as engaging in this
sort of profiling?
, (A). It must solicit knowledgeable consent through a observe on its website
(B). It must seek authorization from the European supervisory authorities
(C). It need to be able to show a prior enterprise relationship with the customers
(D). It ought to prove that it makes use of enough protection safeguards to shield client facts -
ANS-(A). It should solicit knowledgeable consent via a word on its website
A worker in a European Union (EU) member state has ceased his employment with a employer.
What need to the company maximum likely do in regard to the employee's private facts?
A) Destroy touchy statistics and save the relaxation according to applicable records safety
regulations
B) Store all of the records
C) Securely keep the records this is required through regulation
D) Provide the worker the cause for maintaining the statistics - ANS-A) Destroy sensitive facts
and store the rest in keeping with relevant statistics protection regulations
According to Article 14 of the GDPR, how lengthy does a controller should offer a statistics
challenge with vital privacy statistics, if that problem's non-public data has been received from
other resources?
(A). As soon as viable after acquiring the non-public data.
(B). As quickly as viable after the primary communication with the records situation.
(C). Within an inexpensive period after obtaining the non-public records, but no later than one
month.
(D). Within an affordable duration after obtaining the private information, but no later than eight
weeks. - ANS-A). As quickly as feasible after obtaining the non-public records.
According to Article eighty four of the GDPR, the regulations on consequences relevant to
infringements shall
be laid down by way of?
(A). The neighborhood Data Protection Supervisory Authorities.
(B). The European Data Protection Board.
(C). The EU Commission.
(D). The Member States. - ANS-D). The Member States.
According to the E-Commerce Directive 2000/31/EC, in which is the vicinity of "established
order"
for a company supplying offerings through an Internet website showed via the GDPR?
(A). Where the era supporting the internet site is positioned
(B). Where the internet site is accessed
(C). Where the selections approximately processing are made
A company is placed in a rustic NOT taken into consideration through the European Union (EU)
to have an adequate degree of data protection. Which of the subsequent is an duty of the
business enterprise if it imports
non-public statistics from every other employer inside the European Economic Area (EEA)
underneath general
contractual clauses?
(A). Submit the contract to its own government authority.
(B). Ensure that word is given to and consent is received from data topics.
(C). Supply any statistics requested by using a records protection authority (DPA) within 30
days.
(D). Ensure that neighborhood laws do now not hinder the organization from meeting its
contractual duties. - ANS-A). Submit the contract to its own authorities authority.
A organisation plans to switch employee health facts among two of its entities in
France. To preserve the security of the processing, what will be the maximum critical security
measure to apply to the health information transmission?
(A). Inform the facts situation of the security measures in region.
(B). Ensure that the receiving entity has signed a facts processing agreement.
(C). Encrypt the transferred records in transit and at rest.
(D). Conduct a information safety effect assessment. - ANS-A). Inform the facts subject of the
safety measures in location.
A German records subject was the victim of an embarrassing prank twenty years in the past. A
newspaper
internet site published an editorial about the prank at the time, and the article remains available
on the
newspaper's internet site. Unfortunately, the prank is the top seek end result while a consumer
searches at the
victim's name. The records problem requests that SearchCo delist this result. SearchCo is of the
same opinion, and
instructs its era crew to avoid scanning or indexing the thing.
What else should SearchCo do?
(A). Notify the newspaper that its article it's miles delisting the item.
(B). Fully erase the URL to the content material, as opposed to delist that is in particular based
on data problem's
,call.
(C). Identify different controllers who are processing the same facts and tell them of the
delisting request.
(D). Prevent the thing from being listed in search effects regardless of what search phrases are
entered
into the quest engine. - ANS-(A). Notify the newspaper that its article it's far delisting the item.
A key component of the OECD Guidelines is the "Individual Participation Principle". What
parts of the General Data Protection Regulation (GDPR) provide the nearest equivalent to that
precept?
(A). The lawful processing standards stipulated by Articles 6 to nine
(B). The facts requirements set out in Articles thirteen and 14
(C). The breach notification necessities specified in Articles 33 and 34
(D). The rights granted to information topics underneath Articles 12 to 22 - ANS-(D). The rights
granted to records topics under Articles 12 to 22
A cell device application that makes use of cookies could be challenge to the consent
requirement of
which of the subsequent?
(A). The ePrivacy Directive
(B). The E-Commerce Directive
(C). The Data Retention Directive
(D). The EU Cybersecurity Directive - ANS-A). The ePrivacy Directive
A Spanish strength patron calls her local provider with Questions: about the enterprise's
upcoming merger. Specifically, the client wants to realize the recipients to whom her private
statistics could be disclosed as soon as the merger is very last. According to Article 13 of the
GDPR, what need to the
organization do before imparting the purchaser with the requested statistics?
(A). Verify that the request is relevant to the data accumulated before the GDPR entered into
pressure.
(B). Verify that the reason of the request from the customer is in keeping with the GDPR.
(C). Verify that the non-public records has not already been despatched to the patron.
(D). Verify that the identification of the patron can be proven via other method. - ANS-A). Verify
that the request is applicable to the statistics gathered before the GDPR entered into force.
A U.S.-primarily based on line store uses state-of-the-art software to track the browsing
behavior of its
European customers and predict future purchases. It also stocks this statistics with third parties.
Under the GDPR, what's the net store's PRIMARY duty at the same time as engaging in this
sort of profiling?
, (A). It must solicit knowledgeable consent through a observe on its website
(B). It must seek authorization from the European supervisory authorities
(C). It need to be able to show a prior enterprise relationship with the customers
(D). It ought to prove that it makes use of enough protection safeguards to shield client facts -
ANS-(A). It should solicit knowledgeable consent via a word on its website
A worker in a European Union (EU) member state has ceased his employment with a employer.
What need to the company maximum likely do in regard to the employee's private facts?
A) Destroy touchy statistics and save the relaxation according to applicable records safety
regulations
B) Store all of the records
C) Securely keep the records this is required through regulation
D) Provide the worker the cause for maintaining the statistics - ANS-A) Destroy sensitive facts
and store the rest in keeping with relevant statistics protection regulations
According to Article 14 of the GDPR, how lengthy does a controller should offer a statistics
challenge with vital privacy statistics, if that problem's non-public data has been received from
other resources?
(A). As soon as viable after acquiring the non-public data.
(B). As quickly as viable after the primary communication with the records situation.
(C). Within an inexpensive period after obtaining the non-public records, but no later than one
month.
(D). Within an affordable duration after obtaining the private information, but no later than eight
weeks. - ANS-A). As quickly as feasible after obtaining the non-public records.
According to Article eighty four of the GDPR, the regulations on consequences relevant to
infringements shall
be laid down by way of?
(A). The neighborhood Data Protection Supervisory Authorities.
(B). The European Data Protection Board.
(C). The EU Commission.
(D). The Member States. - ANS-D). The Member States.
According to the E-Commerce Directive 2000/31/EC, in which is the vicinity of "established
order"
for a company supplying offerings through an Internet website showed via the GDPR?
(A). Where the era supporting the internet site is positioned
(B). Where the internet site is accessed
(C). Where the selections approximately processing are made
