(NEWEST) CIPP-E EXAM COMPREHENSIVE STUDY PACKAGE OF EXAM
QUESTIONS AND CORRECT RESPONSES TO HELP YOU PASS WITH
CONFIDENCE
The "individual participation principle" is a fundamental element of the OECD
Guidelines. Which GDPR provisions offer the closest analogy?
Articles 12 to 23 offer data subjects certain rights.
Which of the following is required of data controllers under the GDPR when
processing data for direct marketing purposes?
Give details about the marketing uses of personal data and how processing is
defined by the GDPR.
When weighing privacy rights under the GDPR, which of the following
freedoms or rights must be taken into account for any operation or series of
operations carried out on personal data or on sets of personal data?
Freedom of expression: According to the GDPR, which of the following
freedoms must be taken into account while weighing privacy rights?
Freedom to carry out legal business: The GDPR expands on the Data Protection
Directive in several ways. Which of the following rights of data subjects was
the only one that the Directive did not include in some way?
Right to data portability: What must a controller do in accordance with the right
to be forgotten when a data subject properly requests erasure?
Notify all third-party controllers handling shared personal data that they are
required to remove it. What is one important objective that the Data Protection
Directive, Convention 108, and the OECD Guidelines all shared but mainly fell
short of in Europe?
Harmonization of data protection strategies: Which of the following is a Privacy
Shield Principle of the seven EU-US and Swiss-US?
Security: Of the seven EU-US and Swiss-US Privacy Shield Principles, which
one is it?
Access: Which of the following factors could be considered by the supervisory
authority when calculating the fine amount?
Measures done by the controller to lessen the harm that the data subjects have
experienced How is pseudonymous personal data defined under the GDPR?
Data that cannot be linked to a particular data subject without the use of extra
information stored separately - Biometric data processing needs both a valid
reason and ________________; otherwise, the GDPR typically forbids it.
prerequisite for processing
True or False: Businesses with less than 250 employees are not exempt from
Article 30's record-keeping requirements.
, Untrue: Three exceptions exist.
Regardless of whether they are a controller or processor, a business must
designate a DPO if ______________ is a part of their primary operations.
large-scale processing of sensitive data
-
The European Union was established by which treaty?
The Maastricht Treaty of 1992
When is it most probable that a data sharing agreement will be required?
when businesses functioning as joint data controllers exchange personal
information.
What factors should a company take into account when deciding how long to
keep personal data?
if the stated reason for gathering the personal information is still relevant.
-
True or False: The GDPR establishes particular rules for background
investigations.
False: Although privacy considerations must be addressed, the GDPR does not
specify particular standards for background checks. For example, Company Z
violates Article 32 of the GDPR when it loses access to client data for six hours
due to an unplanned power outage. According to the 'Guidelines on Personal
data breach notification' published by the WP29 in February 2018 (later adopted
by the EDPB), what should Company Z do?
To show responsibility, record the loss of availability.
-
An online retailer receives a subject access request (SAR) from a data subject
for their personal information. The data subject claims that they are filing a
SAR in compliance with the GDPR; but, they will withdraw their request if the
business credits their online account with a certain amount of money. No one
else has ever requested access to the company before.
Which of the following would provide the business a valid reason to reject the
request for access?
The request is obviously excessive or baseless.
-. Which of the following statements regarding the options available to data
subjects to exercise their rights in circumstances of noncompliance under the
GDPR is TRUE?
Regardless of whether they have previously complained to the controller or
processor, people can take their grievances to DPAs and/or the courts.
-.Several regulators from various jurisdictions are looking into a corporation for
failing to provide the required fair notice under the GDPR. Of the penalties that
could be imposed on the business, which is TRUE?
QUESTIONS AND CORRECT RESPONSES TO HELP YOU PASS WITH
CONFIDENCE
The "individual participation principle" is a fundamental element of the OECD
Guidelines. Which GDPR provisions offer the closest analogy?
Articles 12 to 23 offer data subjects certain rights.
Which of the following is required of data controllers under the GDPR when
processing data for direct marketing purposes?
Give details about the marketing uses of personal data and how processing is
defined by the GDPR.
When weighing privacy rights under the GDPR, which of the following
freedoms or rights must be taken into account for any operation or series of
operations carried out on personal data or on sets of personal data?
Freedom of expression: According to the GDPR, which of the following
freedoms must be taken into account while weighing privacy rights?
Freedom to carry out legal business: The GDPR expands on the Data Protection
Directive in several ways. Which of the following rights of data subjects was
the only one that the Directive did not include in some way?
Right to data portability: What must a controller do in accordance with the right
to be forgotten when a data subject properly requests erasure?
Notify all third-party controllers handling shared personal data that they are
required to remove it. What is one important objective that the Data Protection
Directive, Convention 108, and the OECD Guidelines all shared but mainly fell
short of in Europe?
Harmonization of data protection strategies: Which of the following is a Privacy
Shield Principle of the seven EU-US and Swiss-US?
Security: Of the seven EU-US and Swiss-US Privacy Shield Principles, which
one is it?
Access: Which of the following factors could be considered by the supervisory
authority when calculating the fine amount?
Measures done by the controller to lessen the harm that the data subjects have
experienced How is pseudonymous personal data defined under the GDPR?
Data that cannot be linked to a particular data subject without the use of extra
information stored separately - Biometric data processing needs both a valid
reason and ________________; otherwise, the GDPR typically forbids it.
prerequisite for processing
True or False: Businesses with less than 250 employees are not exempt from
Article 30's record-keeping requirements.
, Untrue: Three exceptions exist.
Regardless of whether they are a controller or processor, a business must
designate a DPO if ______________ is a part of their primary operations.
large-scale processing of sensitive data
-
The European Union was established by which treaty?
The Maastricht Treaty of 1992
When is it most probable that a data sharing agreement will be required?
when businesses functioning as joint data controllers exchange personal
information.
What factors should a company take into account when deciding how long to
keep personal data?
if the stated reason for gathering the personal information is still relevant.
-
True or False: The GDPR establishes particular rules for background
investigations.
False: Although privacy considerations must be addressed, the GDPR does not
specify particular standards for background checks. For example, Company Z
violates Article 32 of the GDPR when it loses access to client data for six hours
due to an unplanned power outage. According to the 'Guidelines on Personal
data breach notification' published by the WP29 in February 2018 (later adopted
by the EDPB), what should Company Z do?
To show responsibility, record the loss of availability.
-
An online retailer receives a subject access request (SAR) from a data subject
for their personal information. The data subject claims that they are filing a
SAR in compliance with the GDPR; but, they will withdraw their request if the
business credits their online account with a certain amount of money. No one
else has ever requested access to the company before.
Which of the following would provide the business a valid reason to reject the
request for access?
The request is obviously excessive or baseless.
-. Which of the following statements regarding the options available to data
subjects to exercise their rights in circumstances of noncompliance under the
GDPR is TRUE?
Regardless of whether they have previously complained to the controller or
processor, people can take their grievances to DPAs and/or the courts.
-.Several regulators from various jurisdictions are looking into a corporation for
failing to provide the required fair notice under the GDPR. Of the penalties that
could be imposed on the business, which is TRUE?
