The Best Valid CIPP-E Dumps for Helping Passing CIPP-E Exam!
UPDATED IAPP CIPP-E Exam Questions & Answer
NEW QUESTION # 85
According to Art 23 GDPR, which of the following data subject rights can NOT be restricted?
- A. Right to erasure ("Right to be forgotten").
- B. Right not to be subject to automated individual decision-making
- C. Right to restriction of processing.
- D. Right to lodge a complaint with a supervisory authority.
Answer: C
NEW QUESTION # 86
Under Article 58 of the GDPR, which of the following describes a power of supervisory authorities in European Union (EU) member states?
- A. The ability to enact new laws by executive order.
- B. The right to access data for investigative purposes.
- C. The discretion to carry out goals of elected officials within the member state.
- D. The authority to select penalties when a controller is found guilty in a court of law.
Answer: B
NEW QUESTION # 87
SCENARIO
Please use the following to answer the next question:
Brady is a computer programmer based in New Zealand who has been running his own business for two years. Brady's business provides a low-cost suite of services to customers throughout the European Economic Area (EEA). The services are targeted towards new and aspiring small business owners. Brady's company, called Brady Box, provides web page design services, a Social Networking Service (SNS) and consulting services that help people manage their own online stores.
Unfortunately, Brady has been receiving some complaints. A customer named Anna recently uploaded her plans for a new product onto Brady Box's chat area, which is open to public viewing. Although she realized her mistake two weeks later and removed the document, Anna is holding Brady Box responsible for not noticing the error through regular monitoring of the website. Brady believes he should not be held liable.
Another customer, Felipe, was alarmed to discover that his personal information was transferred to a third- party contractor called Hermes Designs and worries that sensitive information regarding his business plans may be misused. Brady does not believe he violated European privacy rules. He provides a privacy notice to all of his customers explicitly stating that personal data may be transferred to specific third parties in fulfillment of a requested service. Felipe says he read the privacy notice but that it was long and complicated Brady continues to insist that Felipe has no need to be concerned, as he can personally vouch for the integrity of Hermes Designs. In fact, Hermes Designs has taken the initiative to create sample customized banner advertisements for customers like Felipe. Brady is happy to provide a link to the example banner ads, now posted on the Hermes Designs webpage. Hermes Designs plans on following up with direct marketing to these customers.
Brady was surprised when another customer, Serge, expressed his dismay that a quotation by him is being used within a graphic collage on Brady Box's home webpage. The quotation is attributed to Serge by first and last name. Brady, however, was not worried about any sort of litigation. He wrote back to Serge to let him know that he found the quotation within Brady Box's Social Networking Service (SNS), as Serge himself had posted the quotation. In his response, Brady did offer to remove the quotation as a courtesy.
Despite some customer complaints, Brady's business is flourishing. He even supplements his income through online behavioral advertising (OBA) via a third-party ad network with whom he has set clearly defined roles. Brady is pleased that, although some customers are not explicitly aware of the OBA, the advertisements contain useful products and services.
Based on current trends in European privacy practices, which aspect of Brady Box' Online Behavioral Advertising (OBA) is most likely to be insufficient if the company becomes established in Europe?
- A. The level of security within the website.
- B. The need to have the contents of the advertising approved.
Section: (none)
Explanation - C. The lack of the option to opt in.
- D. The contract with the third-party advertising network.
Answer: C
NEW QUESTION # 88
What permissions are required for a marketer to send an email marketing message to a consumer in the EU?
- A. A notice that the consumer's email address will be used for marketing purposes.
- B. A prior opt-in consent for consumers unless they are already customers.
- C. No prior permission required, but an opt-out requirement on all emails sent to consumers.
- D. A pre-checked box stating that the consumer agrees to receive email marketing.
Answer: B
NEW QUESTION # 89
Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC). Why is the Directive no longer part of EU law?
- A. The Directive was annulled by the Court of Justice of the European Union.
- B. The Directive was superseded by the EU Directive on Privacy and Electronic Communications.
- C. The Directive was superseded by the General Data Protection Regulation.
- D. The Directive was annulled by the European Court of Human Rights.
Answer: A
NEW QUESTION # 90
SCENARIO
Please use the following to answer the next question:
Brady is a computer programmer based in New Zealand who has been running his own business for two years. Brady's business provides a low-cost suite of services to customers throughout the European Economic Area (EEA). The services are targeted towards new and aspiring small business owners. Brady's company, called Brady Box, provides web page design services, a Social Networking Service (SNS) and consulting services that help people manage their own online stores.
Unfortunately, Brady has been receiving some complaints. A customer named Anna recently uploaded her plans for a new product onto Brady Box's chat area, which is open to public viewing. Although she realized her mistake two weeks later and removed the document, Anna is holding Brady Box responsible for not noticing the error through regular monitoring of the website. Brady believes he should not be held liable.
Another customer, Felipe, was alarmed to discover that his personal information was transferred to a third- party contractor called Hermes Designs and worries that sensitive information regarding his business plans may be misused. Brady does not believe he violated European privacy rules. He provides a privacy notice to all of his customers explicitly stating that personal data may be transferred to specific third parties in fulfillment of a requested service. Felipe says he read the privacy notice but that it was long and complicated Brady continues to insist that Felipe has no need to be concerned, as he can personally vouch for the integrity of Hermes Designs. In fact, Hermes Designs has taken the initiative to create sample customized banner advertisements for customers like Felipe. Brady is happy to provide a link to the example banner ads, now posted on the Hermes Designs webpage. Hermes Designs plans on following up with direct marketing to these customers.
Brady was surprised when another customer, Serge, expressed his dismay that a quotation by him is being used within a graphic collage on Brady Box's home webpage. The quotation is attributed to Serge by first and last name. Brady, however, was not worried about any sort of litigation. He wrote back to Serge to let him know that he found the quotation within Brady Box's Social Networking Service (SNS), as Serge himself had posted the quotation. In his response, Brady did offer to remove the quotation as a courtesy.
Despite some customer complaints, Brady's business is flourishing. He even supplements his income through online behavioral advertising (OBA) via a third-party ad network with whom he has set clearly defined roles. Brady is pleased that, although some customers are not explicitly aware of the OBA, the advertisements contain useful products and services.
Based on the scenario, what is the main reason that Brady should be concerned with Hermes Designs' handling of customer personal data?
- A. The data is being used for a new purpose.
- B. The data is being processed via a new means.
- C. The data is uncategorized.
- D. The data is sensitive.
Answer: A
NEW QUESTION # 91
Why is advisable to avoid consent as a legal basis for an employer to process employee data?
- A. An employer might have difficulty obtaining consent from every employee.
- B. Data protection laws do not apply to processing of employee data.
- C. Employee data can only be processed if there is an approval from the data protection officer.
- D. Consent may not be valid if the employee feels compelled to provide it.
Answer: D
NEW QUESTION # 92
Please use the following to answer the next question:
ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorage Why is the additional measure recommended by Jackie sufficient foe using UpFinance?
- A. UpFinance implements sufficient data protection measures
- B. UpFinance is an established 7-year-old business.
- C. UpFinance is in a highly regulated financial industry
- D. UpFinance is based in a country without surveillance laws.
Answer: D
NEW QUESTION # 93
According to the GDPR, how is pseudonymous personal data defined?
- A. Data that has been rendered anonymous in such a manner that the data subject is no longer identifiable.
- B. Data that can no longer be attributed to a specific data subject, with no possibility of re-identifying the data.
- C. Data that can no longer be attributed to a specific data subject without the use of additional information kept separately.
- D. Data that has been encrypted or is subject to other technical safeguards.
Answer: C
Explanation:
Reference https://www.chino.io/blog/what-is-pseudonymous-data-according-to-the-gdpr/
NEW QUESTION # 94
A mobile device application that uses cookies will be subject to the consent requirement of which of the following?
- A. The Data Retention Directive
- B. The ePrivacy Directive
- C. The EU Cybersecurity Directive
- D. The E-Commerce Directive
Answer: B
Explanation:
Reference https://www.iubenda.com/en/help/5525-cookies-gdpr-requirements
NEW QUESTION # 95
SCENARIO
Please use the following to answer the next question:
Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA.
Today, it is a multi-billion-dollar candy company operating in every continent. All of the company's IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father's company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.
Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company's online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers' philosophical beliefs, political opinions and marital status.
If a customer identifies as single, Ben then copies all of that customer's personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.
Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.
Joe also hires his best friend's daughter, Alice, who just graduated from law school in the U.S., to be the company's new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company's operations in the European Union to the U.S.
Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company's IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone's information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.
When Ben had the company collect additional data from its customers, the most serious violation of the GDPR occurred because the processing of the data created what?
- A. An information security risk by copying the data into a new database.
- B. A potential legal liability and financial exposure from its customers.
- C. A significant risk due to the lack of an informed consent mechanism.
- D. A significant risk to the customers' fundamental rights and freedoms.
Answer: D
NEW QUESTION # 96
SCENARIO
Please use the following to answer the next Question:
Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a few months ago. Although no one was hurt, Louis has been plagued by texts and calls from a company called Accidentable offering to help him recover compensation for personal injury. Louis has heard about insurance companies selling customers' data to third parties, and he's convinced that Accidentable must have gotten his information from Bedrock Insurance.
Louis has also been receiving an increased amount of marketing information from Bedrock, trying to sell him their full range of their insurance policies.
Perturbed by this, Louis has started looking at price comparison sites on the internet and has been shocked to find that other insurers offer much cheaper rates than Bedrock, even though he has been a loyal customer for many years. When his Bedrock policy comes up for renewal, he decides to switch to Zantrum Insurance.
In order to activate his new insurance policy, Louis needs to supply Zantrum with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask Bedrock to transfer his information directly to Zantrum. He also takes this opportunity to ask Bedrock to stop using his personal data for marketing purposes.
Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Louis it cannot transfer his data directly to Zantrum as this is not technically feasible. Bedrock also explains that Louis's contract included a provision whereby Louis agreed that his data could be used for marketing purposes; according to Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which was filled with legal jargon and very confusing.
In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He writes to Accidentable to ask for the name of the organization that supplied his details to them. He warns Accidentable that he plans to complain to the data protection authority, because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.
Accidentable's response letter confirms Louis's suspicions. Accidentable is Bedrock Insurance's wholly owned subsidiary, and they received information about Louis's accident from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis that there has been no breach of the GDPR, as Louis's contract included, a provision in which he agreed to share his information with Bedrock's affiliates for business purposes.
Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them insisting that all his information be erased from their computer system.
Based on the GDPR's position on the use of personal data for direct marketing purposes, which of the following is true about Louis's rights as a data subject?
- A. Louis has the right to object at any time to the use of his data and Bedrock must honor his request to cease use.
- B. Louis has the right to object to the use of his data, unless his data is required by Bedrock for the purpose of exercising a legal claim.
- C. Louis does not have the right to object to the use of his data if Bedrock can demonstrate compelling legitimate grounds for the processing.
- D. Louis does not have the right to object to the use of his data because he previously consented to it.
Answer: A
NEW QUESTION # 97
To receive a preliminary interpretation on provisions of the GDPR, a national court will refer its case to which of the following?
- A. The Court of Justice of the European Union.
- B. The European Data Protection Supervisor.
- C. The European Court of Human Rights.
- D. The European Data Protection Board.
Answer: A
NEW QUESTION # 98
The transparency principle is most directly related to which of the following rights?
- A. Right to be forgotten.
- B. Right to object
- C. Right to be informed.
- D. Right to restriction of processing.
Answer: B
NEW QUESTION # 99
A grade school is planning to use facial recognition to track student attendance. Which of the following may provide a lawful basis for this processing?
- A. A state law requires facial recognition to verify attendance.
- B. The school gets explicit consent from the students.
- C. The school places a notice near each camera.
- D. Processing is necessary for the legitimate interests pursed by the school.
Answer: B
Explanation:
Reference https://www.jdsupra.com/legalnews/let-s-face-it-facial-recognition-1134180/
NEW QUESTION # 100
Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?
- A. Consider the importance of the profiling to their particular objective.
- B. Consider the impact of the profiling on the data subject's interest, rights and freedoms.
- C. Demonstrate that the profiling is for the purposes of direct marketing.
- D. Carry out an exercise that weighs the interests of the controller and the basis for the data subject's objection.
Answer: C
NEW QUESTION # 101
A multinational company is appointing a mandatory data protection officer. In addition to considering the rules set out in Article 37 (1) of the GDPR, which of the following actions must the company also undertake to ensure compliance in all EU jurisdictions in which it operates?
- A. Revise the data processing activities of the company that affect more than one jurisdiction to evaluate whether they comply with the principles of privacy by design and by default.
- B. Consult national derogations to evaluate if there are additional cases to be considered in relation to the matter.
- C. Assess whether the company has more than 250 employees in each of the EU member-states in which it is established.
- D. Conduct a Data Protection Privacy Assessment on the processing operations of the company in all the countries it operates.
Answer: D
NEW QUESTION # 102
Which of the following is NOT a role of works councils?
- A. Determining whether to approve or reject certain decisions of the employer that affect employees.
- B. Determining the monetary fines to be levied against employers for data breach violations of employee data.
- C. Determining what changes will affect employee working conditions.
- D. Determining whether employees' personal data can be processed or not.
Answer: B
NEW QUESTION # 103
SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
What are ABC Hotel Chain and XYZ Travel Agency's roles in this relationship?
- A. ABC Hotel Chain and XYZ Travel Agency are joint controllers.
- B. XYZ Travel Agency is the controller and ABC Hotel Chain is the processor.
- C. ABC Hotel Chain and XYZ Travel Agency are independent controllers.
- D. ABC Hotel Chain is the controller and XYZ Travel Agency is the processor.
Answer: D
NEW QUESTION # 104
SCENARIO
Please use the following to answer the next question:
Sandy recently joined Market4U, an advertising technology company founded in 2016, as their VP of Privacy and Data Governance. Through her first initiative in conducting a data inventory, Sandy learned that Market4U maintains a list of 19 million global contacts that were collected throughout the course of Market4U's existence. Knowing the risk of having such a large amount of data, Sandy wanted to purge all contacts that were entered into Market4U's systems prior to May 2018, unless such contacts had a more recent interaction with Market4U content. However, Dan, the VP of Sales, informed Sandy that all of the contacts provide useful information regarding successful marketing campaigns and trends in industry verticals for Market4U's clients.
Dan also informed Sandy that he had wanted to focus on gaining more customers within the sports and entertainment industry. To assist with this behavior, Market4U's marketing team decided to add several new fields to Market4U's website forms, including forms for downloading white papers, creating accounts to participate in Market4U's forum, and attending events. Such fields include birth date and salary.
What is the best way that Sandy can gain the insights that Dan seeks while still minimizing risks for Market4U?
- A. Delete all data collected prior to May 2018 after conducting the trend analysis.
- B. Procure a third party to conduct the analysis and delete the data from Market4U's systems.
- C. Conduct analysis only on anonymized personal data.
- D. Conduct analysis only on pseudonymized personal data.
Answer: C
NEW QUESTION # 105
Which of the following is one of the supervisory authority's investigative powers?
- A. To notify the controller or the processor of an alleged infringement of the GDPR.
- B. To require that controllers or processors adopt approved data protection certification mechanisms.
- C. To require data controllers to provide them with written notification of all new processing activities.
- D. To determine whether a controller or processor has the right to a judicial remedy concerning a compensation decision made against them.
Answer: A
Explanation:
Reference https://gdpr-info.eu/art-58-gdpr/
NEW QUESTION # 106
When does the European Data Protection Board (EDPB) recommend reevaluating whether a transfer tool is effectively providing a level of personal data protection that is in compliance with the European Union (EU) level?
- A. Every year.
- B. On an ongoing basis.
- C. After a personal data breach.
- D. Every three (3) years.
Answer: B
NEW QUESTION # 107
SCENARIO
Please use the following to answer the next question:
Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.
After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient's name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissed Jack's lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of "all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents. In relation to the emails Jack listed six members of the management team whose inboxes the required access.
How should the company respond to Jack's request to be forgotten?
- A. The company should erase all data relating to Jack without undue delay as the right to be forgotten is an absolute right.
- B. The company should ensure that the information is stored outside of the European Union so that the right to be forgotten under the GDPR does not apply.
- C. The company should claim that the right to be forgotten is not applicable to them, as only a fraction of their global workforce resides in the European Union.
- D. The company should not erase the data at this time as it may be required to defend a legal claim of unfair dismissal.
Answer: C
NEW QUESTION # 108
SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester's Alumni portal. Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna's tasks is to complete the record of processing activities, as required by the GDPR.
After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Anna will find that a risk analysis is NOT necessary in this situation as long as?
- A. The processing will not negatively affect the rights of the data subjects
- B. The data subjects gave their unambiguous consent for the original processing
- C. The data subjects are no longer current students of Frank's
- D. The algorithms that Frank uses for the processing are technologically sound
Answer: B
NEW QUESTION # 109
......
The CIPP-E certification exam is a comprehensive assessment of a candidate's knowledge and understanding of European data protection laws and practices. CIPP-E exam covers a broad range of topics, including the General Data Protection Regulation (GDPR), data protection principles, privacy management, and data breach management. Candidates who pass the exam demonstrate their ability to understand and apply European data protection laws and regulations, making them highly valuable to organizations that operate in Europe.
Updated CIPP-E Dumps Questions For IAPP Exam: https://dumpsstar.vce4plus.com/IAPP/CIPP-E-valid-vce-dumps.html