CIPP E CASE STUDIES EXAM
QUESTIONS WITH CORRECT ANSWERS
University Data - Answer-Anna is a lawyer for university tasked with student records.
Frank is professor.
4 Types of Data
1. Student Data - Personal Info
2. Employee Data - Personal Info
3. Alumni Data - Personal Info
4. Department of Education: Demographic - no personal identifiers
University Data Continued - Answer-Frank wants to build a database to process data
and see how 1st year student in his class progress.
He builds algorithm to process data without identifiers, all UNV systems encrypted.
Takes laptop home, not encrypted, loses it.
What should Anna / DPO check to confirm he can process that data? - Answer-More
info about algorithm he developed.
Which types of data does Anna not have to include in her records of processing? -
Answer-Dept. of Education Records (No personal data included & not likely to be
identified by data included in this)
He loses data, what should happen next? - Answer-- Report to SA
- Most likely tell students
ABC Insurance - Answer-ABC Insurance gives data to subsidiary, which begins direct
marketing to Jason.
Jason decides to switch insurance companies.
ABC Insurance is direct marketing to Jason, he asks them to stop - Answer-They say
there is a line in the contract he signed saying he consents to direct marketing and they
dont stop.
If Jason asks to stop use of his data, what must the ABC Subsidiary do? - Answer-First
stop processing immediately, then stop using data
According to GDPR regulations on direct marketing, can Jason stop ABC from direct
marketing? - Answer-Jason has the right to object & ABC must immediately stop using
his data.
QUESTIONS WITH CORRECT ANSWERS
University Data - Answer-Anna is a lawyer for university tasked with student records.
Frank is professor.
4 Types of Data
1. Student Data - Personal Info
2. Employee Data - Personal Info
3. Alumni Data - Personal Info
4. Department of Education: Demographic - no personal identifiers
University Data Continued - Answer-Frank wants to build a database to process data
and see how 1st year student in his class progress.
He builds algorithm to process data without identifiers, all UNV systems encrypted.
Takes laptop home, not encrypted, loses it.
What should Anna / DPO check to confirm he can process that data? - Answer-More
info about algorithm he developed.
Which types of data does Anna not have to include in her records of processing? -
Answer-Dept. of Education Records (No personal data included & not likely to be
identified by data included in this)
He loses data, what should happen next? - Answer-- Report to SA
- Most likely tell students
ABC Insurance - Answer-ABC Insurance gives data to subsidiary, which begins direct
marketing to Jason.
Jason decides to switch insurance companies.
ABC Insurance is direct marketing to Jason, he asks them to stop - Answer-They say
there is a line in the contract he signed saying he consents to direct marketing and they
dont stop.
If Jason asks to stop use of his data, what must the ABC Subsidiary do? - Answer-First
stop processing immediately, then stop using data
According to GDPR regulations on direct marketing, can Jason stop ABC from direct
marketing? - Answer-Jason has the right to object & ABC must immediately stop using
his data.
