Quiz IT certification exam

Question 1

A Spanish electricity customer calls her local supplier with Questions: about the company's upcoming merger. Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?

Accepted Answer

Verify that the identity of the customer can be proven by other means.

Answer

Verify that the request is applicable to the data collected before the GDPR entered into force.

Answer

Verify that the purpose of the request from the customer is in line with the GDPR.

Answer

Verify that the personal data has not already been sent to the customer.

Question 2

Under the GDPR, where personal data is not obtained directly from the data subject, a controller is exempt from directly providing information about processing to the data subject if?

Accepted Answer

The data subject already has information regarding how his data will be used

Answer

The provision of such information to the data subject would be too problematic

Answer

Third-party data would be disclosed by providing such information to the data subject

Answer

The processing of the data subject's data is protected by appropriate technical measures

Question 3

SCENARIOPlease use the following to answer the next question:Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B. Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees:NameAddressDate of BirthPayroll numberNational Insurance numberSick pay entitlementMaternity/paternity pay entitlementHoliday entitlementPension and benefits contributionsTrade union contributionsJenny is the compliance officer at CompanyA.  She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required. Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract. Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B. This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes. Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees. Under the GDPR, which of Company B's actions would NOT be likely to trigger a potential enforcement action?

Accepted Answer

Their failure to provide sufficient security safeguards to Company A's data.

Answer

Their omission of data protection provisions in their contract with Company C.

Answer

Their engagement of Company C to improve their payroll service.

Answer

Their decision to operate without a data protection officer.

Question 4

SCENARIOPlease use the following to answer the next question:Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B. Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees:NameAddressDate of BirthPayroll numberNational Insurance numberSick pay entitlementMaternity/paternity pay entitlementHoliday entitlementPension and benefits contributionsTrade union contributionsJenny is the compliance officer at Company A. She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required. Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract. Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B. This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes. Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees. The GDPR requires sufficient guarantees of a company's ability to implement adequate technical and organizational measures. What would be the most realistic way that Company B could have fulfilled this requirement?

Accepted Answer

Hiring companies whose measures are consistent with recommendations of accrediting bodies.

Answer

Requesting advice and technical support from Company A's IT team.

Answer

Avoiding the use of another company's data to improve their own services.

Answer

Vetting companies' measures with the appropriate supervisory authority.

Question 5

In 2016's Guidance, the United Kingdom's Information Commissioner's Office (ICO) reaffirmed the importance of using a "layered notice" to provide data subjects with what?

Accepted Answer

A privacy notice containing brief information whilst offering access to further detail.

Answer

A privacy notice explaining the consequences for opting out of the use of cookies on a website.

Answer

An explanation of the security measures used when personal data is transferred to a third party.

Answer

An efficient means of providing written consent in member states where they are required to do so.

Question 6

When collecting personal data in a European Union (EU) member state, what must a company do if it collects personal data from a source other than the data subjects themselves?

Accepted Answer

Inform the subjects about the collection

Answer

Provide a public notice regarding the data

Answer

Upgrade security to match that of the source

Answer

Update the data within a reasonable timeframe

Question 7

Under the GDPR, which essential pieces of information must be provided to data subjects before collecting their personal data?

Accepted Answer

The identity and contact details of the controller and the reasons the data is being collected.

Answer

The authority by which the controller is collecting the data and the third parties to whom the data will be sent.

Answer

The name/s of relevant government agencies involved and the steps needed for revising the data.

Answer

The contact information of the controller and a description of the retention policy.

Question 8

Assuming that the "without undue delay" provision is followed, what is the time limit for complying with a data access request?

Accepted Answer

Within one month of receipt, which may be extended by an additional two months

Answer

Within 40 days of receipt

Answer

Within 40 days of receipt, which may be extended by up to 40 additional days

Answer

Within one month of receipt, which may be extended by up to an additional month

Question 9

The GDPR requires controllers to supply data subjects with detailed information about the processing of their data. Where a controller obtains data directly from data subjects, which of the following items of information does NOT legally have to be supplied?

Accepted Answer

The categories of personal data concerned.

Answer

The recipients or categories of recipients.

Answer

The rights of access, erasure, restriction, and portability.

Answer

The right to lodge a complaint with a supervisory authority.

Question 10

According to Article 14 of the GDPR, how long does a controller have to provide a data subject with necessary privacy information, if that subject's personal data has been obtained from other sources?

Accepted Answer

Within a reasonable period after obtaining the personal data, but no later than one month.

Answer

As soon as possible after obtaining the personal data.

Answer

As soon as possible after the first communication with the data subject.

Answer

Within a reasonable period after obtaining the personal data, but no later than eight weeks.

Question 11

When would a data subject NOT be able to exercise the right to portability?

Accepted Answer

When the processing is necessary to perform a task in the exercise of authority vested in the controller.

Answer

When the processing is carried out pursuant to a contract with the data subject.

Answer

When the data was supplied to the controller by the data subject.

Answer

When the processing is based on consent.

Question 12

In which of the following situations would an individual most likely to be able to withdraw her consent for processing?

Accepted Answer

When she no longer wishes to be sent marketing materials from an organization.

Answer

When she is leaving her bank and moving to another bank.

Answer

When she has recently changed jobs and no longer works for the same company.

Answer

When she disagrees with a diagnosis her doctor has recorded on her records.

Question 13

As a result of the European Court of Justice's ruling in the case of Google v. Spain, search engines outside the EEA are also likely to be subject to the Regulation's right to be forgotten. This holds true if the activities of an EU subsidiary and its U.S. parent are what?

Accepted Answer

Inextricably linked in their businesses.

Answer

Supervised by the same Data Protection Officer.

Answer

Consistent with Privacy Shield requirements

Answer

Bound by a standard contractual clause.

Question 14

A German data subject was the victim of an embarrassing prank 20 years ago. A newspaper website published an article about the prank at the time, and the article is still available on the newspaper's website. Unfortunately, the prank is the top search result when a user searches on the victim's name. The data subject requests that SearchCo delist this result. SearchCo agrees, and instructs its technology team to avoid scanning or indexing the article. What else must SearchCo do?

Accepted Answer

Notify the newspaper that its article it is delisting the article.

Answer

Fully erase the URL to the content, as opposed to delist which is mainly based on data subject's name.

Answer

Identify other controllers who are processing the same information and inform them of the delisting request.

Answer

Prevent the article from being listed in search results no matter what search terms are entered into the search engine.

Question 15

What are the obligations of a processor that engages a sub-processor?

Accepted Answer

The processor must obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor.

Answer

The processor must give the controller prior written notice and perform a preliminary audit of the sub- processor.

Answer

The processor must obtain the controller's specific written authorization and provide annual reports on the sub-processor's performance.

Answer

The processor must receive a written agreement that the sub-processor will be fully liable to the controller for the performance of its obligations in relation to the personal data concerned.

Question 16

What must be included in a written agreement between the controller and processor in relation to processing conducted on the controller's behalf?

Accepted Answer

An obligation on the processor to assist the controller in complying with the controller's obligations to notify the supervisory authority about personal data breaches.

Answer

An obligation on the processor to report any personal data breach to the controller within 72 hours.

Answer

An obligation on both parties to report any serious personal data breach to the supervisory authority.

Answer

An obligation on both parties to agree to a termination of the agreement if the other party is responsible for a personal data breach.

Question 17

To provide evidence of GDPR compliance, a company performs an internal audit. As a result, it finds a data base, password-protected, listing all the social network followers of the client.Regarding the domain of the controller-processor relationships, how is this situation considered?

Accepted Answer

Non-compliant, because the storage of the data exceeds the tasks contractually authorized by the controller.

Answer

Compliant with the security principle, because the data base is password-protected.

Answer

Not applicable, because the data base is password protected, and therefore is not at risk of identifying any data subject.

Answer

Compliant with the storage limitation principle, so long as the internal auditor permanently deletes the data base.

Question 18

There are three domains of security covered by Article 32 of the GDPR that apply to both the controller and the processor. These include all of the following EXCEPT?

Accepted Answer

Consent management and withdrawal.

Answer

Incident detection and response.

Answer

Preventative security.

Answer

Remedial security.

Question 19

In the event of a data breach, which type of information are data controllers NOT required to provide to either the supervisory authorities or the data subjects?

Accepted Answer

The predicted consequences of the breach.

Answer

The measures being taken to address the breach.

Answer

The type of security safeguards used to protect the data.

Answer

The contact details of the appropriate data protection officer.

Question 20

In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?

Accepted Answer

Where the DPIA identifies high risks to individuals' rights and freedoms that the controller can take steps to reduce.

Answer

Where the DPIA identifies that personal data needs to be transferred to other countries outside of the EEA.

Answer

Where the DPIA identifies that the processing being proposed collects the sensitive data of EU citizens.

Answer

Where the DPIA identifies risks that will require insurance for protecting its business interests.

Question 21

According to the GDPR, what is the main task of a Data Protection Officer (DPO)?

Accepted Answer

To conduct Privacy Impact Assessments on behalf of the controller or processor.

Answer

To create and maintain records of processing activities.

Answer

To monitor compliance with other local or European data protection provisions.

Answer

To create procedures for notification of personal data breaches to competent supervisory authorities.

Question 22

A U.S.-based online shop uses sophisticated software to track the browsing behavior of its European customers and predict future purchases. It also shares this information with third parties. Under the GDPR, what is the online shop's PRIMARY obligation while engaging in this kind of profiling?

Accepted Answer

It must solicit informed consent through a notice on its website

Answer

It must seek authorization from the European supervisory authorities

Answer

It must be able to demonstrate a prior business relationship with the customers

Answer

It must prove that it uses sufficient security safeguards to protect customer data

Question 23

Which of the following would NOT be relevant when determining if a processing activity would be considered profiling?

Accepted Answer

If the processing is to be performed by a third-party vendor

Answer

If the processing involves data that is considered personal data

Answer

If the processing of the data is done through automated means

Answer

If the processing is used to predict the behavior of data subjects

Question 24

Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?

Accepted Answer

Demonstrate that the profiling is for the purposes of direct marketing.

Answer

Carry out an exercise that weighs the interests of the controller and the basis for the data subject's objection.

Answer

Consider the impact of the profiling on the data subject's interest, rights and freedoms.

Answer

Consider the importance of the profiling to their particular objective.

Question 25

SCENARIOPlease use the following to answer the next question:TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business.During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations. TripBliss Inc. can choose any number of data categories -- age, income, ethnicity -- that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services.Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered.If TripBliss Inc. decides not to report the incident to the supervisory authority, what would be their BEST defense?

Accepted Answer

The destruction of the stolen data makes any risk to the affected data subjects unlikely.

Answer

The resulting obligation to notify data subjects would involve disproportionate effort.

Answer

The incident resulted from the actions of a third-party that were beyond their control.

Answer

The sensitivity of the categories of data involved in the incident was not substantial enough.

Question 26

SCENARIOPlease use the following to answer the next question:TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business.During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations. TripBliss Inc. can choose any number of data categories -- age, income, ethnicity -- that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services.Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered.With regard to TripBliss Inc.'s use of website cookies, which of the following statements is correct?

Accepted Answer

Because not all of the cookies are strictly necessary to enable the use of a service requested from TripBliss Inc., consent requirements apply to their use of cookies.

Answer

Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers.

Answer

Because Techiva will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary.

Answer

Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.

Question 27

Company X has entrusted the processing of their payroll data to Provider Y. Provider Y stores this encrypted data on its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?

Accepted Answer

Company X

Answer

The public

Answer

Law enforcement

Answer

The supervisory authority

Question 28

When hiring a data processor, which action would a data controller NOT be able to depend upon to avoid liability in the event of a security breach?

Accepted Answer

Requiring that the processor directly notify the appropriate supervisory authority.

Answer

Documenting due diligence steps taken in the pre-contractual stage.

Answer

Conducting a risk assessment to analyze possible outsourcing threats.

Answer

Maintaining evidence that the processor was the best possible market choice available.

Question 29

WP29's "Guidelines on Personal data breach notification under Regulation 2016/679" provides examples of ways to communicate data breaches transparently. Which of the following was listed as a method that would NOT be effective for communicating a breach to data subjects?

Accepted Answer

A notice on a corporate blog

Answer

A postal notification

Answer

A direct electronic message

Answer

A prominent advertisement in print media

Question 30

Which of the following would require designating a data protection officer?

Accepted Answer

The core activities of the controller or processor consist of processing operations that require systematic monitoring of data subjects on a large scale.

Answer

Processing is carried out by an organization employing 250 persons or more.

Answer

Processing is carried out for the purpose of providing for-profit goods or services to individuals in the EU.

Answer

The core activities of the controller or processor consist of processing operations of financial information or information relating to children.

Question 31

Which statement is correct when considering the right to privacy under Article 8 of the European Convention on Human Rights (ECHR)?

Accepted Answer

The right to privacy has to be balanced against other rights under the ECHR

Answer

The right to privacy is an absolute right

Answer

The right to freedom of expression under Article 10 of the ECHR will always override the right to privacy

Answer

The right to privacy protects the right to hold opinions and to receive and impart ideas without interference

Question 32

What is one major goal that the OECD Guidelines, Convention 108 and the Data Protection Directive (Directive 95/46/EC) all had in common but largely failed to achieve in Europe?

Accepted Answer

The synchronization of approaches to data protection

Answer

The establishment of a list of legitimate data processing criteria

Answer

The creation of legally binding data protection principles

Answer

The restriction of cross-border data flow

Question 33

A key component of the OECD Guidelines is the "Individual Participation Principle''. What parts of the General Data Protection Regulation (GDPR) provide the closest equivalent to that principle?

Accepted Answer

The rights granted to data subjects under Articles 12 to 22

Answer

The lawful processing criteria stipulated by Articles 6 to 9

Answer

The information requirements set out in Articles 13 and 14

Answer

The breach notification requirements specified in Articles 33 and 34

Question 34

Which EU institution is vested with the competence to propose new data protection legislation on its own initiative?

Accepted Answer

The European Commission

Answer

The European Council

Answer

The European Parliament

Answer

The Council of the European Union

Question 35

What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?

Accepted Answer

CJEU can force national governments to implement and honor EU law, while the ECHR cannot.

Answer

ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.

Answer

CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.

Answer

ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.

Question 36

SCENARIOPlease use the following to answer the next question:Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester's Alumni portal. Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.Under their security policy, the University encrypts all of its personal data records in transit and at rest.In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.One of Anna's tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informsAnna about his performance database.Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.Which of the University's records does Anna NOT have to include in her record of processing activities?

Accepted Answer

Frank's performance database

Answer

Student records

Answer

Staff and alumni records

Answer

Department for Education records

Question 37

SCENARIOPlease use the following to answer the next question:Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester's Alumni portal. Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.Under their security policy, the University encrypts all of its personal data records in transit and at rest.In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.One of Anna's tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.Before Anna determines whether Frank's performance database is permissible, what additional information does she need?

Accepted Answer

More information about what students have been told and how the research will be used.

Answer

More information about Frank's data protection training.

Answer

More information about the extent of the information loss.

Answer

More information about the algorithm Frank used to mask student numbers.

Question 38

SCENARIOPlease use the following to answer the next question:Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester's Alumni portal. Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.Under their security policy, the University encrypts all of its personal data records in transit and at rest.In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.One of Anna's tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.Anna will find that a risk analysis is NOT necessary in this situation as long as?

Accepted Answer

The data subjects are no longer current students of Frank's

Answer

The processing will not negatively affect the rights of the data subjects

Answer

The algorithms that Frank uses for the processing are technologically sound

Answer

The data subjects gave their unambiguous consent for the original processing

Question 39

Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?

Accepted Answer

The European Commission

Answer

The European Parliament

Answer

The Article 29 Working Party

Answer

The European Council

Question 40

What is true of both the General Data Protection Regulation (GDPR) and the Council of Europe Convention 108?

Accepted Answer

Both require notification of processing activities to a supervisory authority

Answer

Both govern international transfers of personal data

Answer

Both govern the manual processing of personal data

Answer

Both only apply to European Union countries

IAPP CIPP-E Practice Test 1

IAPP CIPP-E Practice Tests