Quiz IT certification exam

Question 1

SCENARIOPlease use the following to answer the next question:Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a dedicated data center located in Malta (EU).People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a KYC due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations.The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and belong a checkbox on a separate page in order to get their account approved on the platform.The customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if aAre the cybersecurity assessors required to sign a data processing agreement with the company in order to comply with the GDPR''

Accepted Answer

Yes, the assessors are data processors and their processing of personal data must be governed by a separate contract or other legal act.

Answer

No, the assessors do not quality as data processors as they only have access to encrypted data.

Answer

No. the assessors do not quality as data processors as they do not copy the data to their facilities.

Answer

Yes. the assessors a-e considered to be joint data controllers and must sign a mutual data processing agreement.

Question 2

SCENARIOPlease use the following to answer the next question:Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a dedicated data center located in Malta |EU).People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a KYC due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations.The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and belong a checkbox on a separate page in order to get their account approved on the platform.The customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if aWhich of the following must be a component of the anti-money-laundering data-sharing practice of the platform?

Accepted Answer

Customers snail receive a clear and conspicuous notice about such data sharing before submitting their data during the registration process.

Answer

The terms of service shall also enumerate all applicable anti-money laundering few.

Answer

Customers shall have an opt-out feature to restrict data sharing with law enforcement agencies after the registration.

Answer

The terms of service shall include the address of the anti-money laundering agency and contacts of the investigators who may access me data.

Question 3

SCENARIOPlease use the following to answer the next question:Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a dedicated data center located m Malta |EU).People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a KYC due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations.The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and belong a checkbox on a separate page in order to get their account approved on the platform.The customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if aWhat is potentially wrong with the backup system operated in the AWS cloud?

Accepted Answer

The data storage period has to be revised, and a data processing agreement w*h AWS must be signed

Answer

The AWS servers are located in the EU but in a country different than the location of the corporate headquarters.

Answer

It is unlawful to process any personal data in a cloud unless the cloud is certified as GOPR-compliant by a competent supervisory authority.

Answer

AWS is a U S company, and no personal data of European residents may be transferred to it without explicit written consent from data subjects.

Question 4

A dynamic Internet Protocol (IP) address is considered persona! data when it is combined with what?

Accepted Answer

Other data held by the controller

Answer

Other data held by the processor.

Answer

Other data held by recipients of the data.

Answer

Other data held by Internet Service Providers (ISPs).

Question 5

Two companies, Gellcoat and Freifish, make plans to launch a co-branded product the prototype of which is called Gellifish 9090. The companies want to organize an event to introduce the new product, so they decide to share data from their client databases and come up with a list of people to invite. They agree on the content of the invitations and together build an app to gather feedback at the event.In this scenario, Gellcoat and Freifish are considered to be?

Accepted Answer

Joint controllers with respect to the personal data related to the event and separate controllers for their other purposes.

Answer

Joint controllers for all purposes because they have merged their databases and their data is now jointly owned.

Answer

Separate controllers because pint controllers^ requires a written designation in a contract

Answer

Separate controllers and processors since they are each providing services to the other

Question 6

Which of the following is NOT exempt from the material scope of the GDPR. insofar as the processing of personal data is concerned?

Accepted Answer

A natural person in the course of a large-scale but purely personal or household activity.

Answer

A natural person processing data foe a small-scale, purely personal or household activity.

Answer

A natural person in the course of processing purely personal or household data on behalf of a spouse who is beyond the age of majority.

Answer

A natural person in the course of activity conducted purely tor a personally-owned sole proprietorship.

Question 7

MagicClean is a web-based service located in the United States that matches home cleaning services to customers. It otters its services exclusively in the United States It uses a processor located in France to optimize its data. Is MagicClean subject to the GDPR?

Accepted Answer

No. because MagicClean is not offering services to EU data subjects.

Answer

Yes, because MagicClean is processing data in the EU

Answer

Yes. because MagicClean's data processing agreement with the French processor is an establishment in the EU

Answer

No, because MagicClean is located m the United States only.

Question 8

A news website based m (he United Slates reports primarily on North American events The website is accessible to any user regardless of location, as the website operator does not block connections from outside of the U.S. The website offers a pad subscription that requires the creation of a user account; this subscription can only be paid in U.S. dollars.Which of the following explains why the website operator, who is the responsible for all processing related to account creation and subscriptions, is NOT required to comply with the GDPR?

Accepted Answer

Payments cannot be made in a European Union currency.

Answer

The controller does not have an establishment in the European Union.

Answer

The website is not available in several official languages of European Un on Member States

Answer

The website cannot block connections from outside the U.S. that use a Virtual Private Network (VPN) to simulate a US location.

Question 9

A company has collected personal data tor direct marketing purpose on the basis of consent. It is now considering using this data to develop new products through analytics. What is the company first required to do?

Accepted Answer

Obtain specific consent for the new processing

Answer

Only inform the data subjects of the new purpose.

Answer

Proceed no further, as such repurposing is unlawful

Answer

Update the privacy notice upon which consent was given

Question 10

Which kind of privacy notice, originally advocated by the Article 29 Working Party, is commonly recommended tor Al-based technologies because of the way it provides processing information at specific points of data collection?

Accepted Answer

Privacy dashboard notice

Answer

Visualization notice.

Answer

Just-in-lime notice.

Answer

Layered notice.

Question 11

Articles 13 and 14 of the GDPR provide details on the obligation of data controllers to inform data subjects when collecting personal data. However, both articles specify an exemption for situations in which the data subject already has the information.Which other situation would also exempt the data controller from this obligation under Article 14?

Accepted Answer

When providing the information would involve a disproportionate effort

Answer

When providing the information would go against a police order.

Answer

When the personal data was obtained through multiple source in the public domain

Answer

When the personal data was obtained 5 years before the entry into force of the GDPR

Question 12

The transparency principle is most directly related to which of the following rights?

Accepted Answer

Right to be informed.

Answer

Right to object

Answer

Right to be forgotten.

Answer

Right to restriction of processing.

Question 13

In the Planet 49 case, what was the man judgement of the Coon of Justice of the European Union (CJEU) regarding the issue of cookies?

Accepted Answer

If the ePrivacy Directive requires consent for cookies, then the GDPR's consent requirements apply.

Answer

If the cookies do not track personal data, then pre-checked boxes are acceptable.

Answer

If a website's cookie notice makes clear the information gathered and the lifespan of the cookie, then pre-checked boxes are acceptable.

Answer

If a data subject continues to scroll through a website after reading a cookie banner, this activity constitutes valid consent for the tracking described in the cookie banner.

Question 14

SCENARIOPlease use the following to answer the next question:Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient's name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissedJack's lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of 'all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents In relation to the emails Jack listed six members of the management team whose inboxes he required access.The company conducted an initial search of its IT systems, which returned a large amount of information They then contacted Jack, requesting that he be more specific regarding what information he required, so that they could carry out a targeted search Jack responded by stating that he would not narrow the scope of the information requester.Under Article 82 of the GDPR ('Right to compensation and liability-), which party is liable for the damage caused by the data breach?

Accepted Answer

Jack is liable

Answer

Both parties are exempt, as the company is involved in human health research

Answer

Jack and the pharmaceutical company are jointly liable.

Answer

The pharmaceutical company is liable.

Question 15

SCENARIOPlease use the following to answer the next question:Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient's name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissedJack's lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of 'all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents * In relation to the emails Jack listed six members of the management team whose inboxes he required access.The company conducted an initial search of its IT systems, which returned a large amount of information They then contacted Jack, requesting that he be more specific regarding what information he required, so that they could carry out a targeted search Jack responded by stating that he would not narrow the scope of the information requester.What would be the most appropriate response to Jacks data subject access request?

Accepted Answer

The company should decline to provide any information, as the amount of information requested is too excessive to provide in one month.

Answer

The company should not provide any information, as the company is headquartered outside of the EU.

Answer

The company should cite the need for an extension, and agree to provide the information requested in Jack's original DSAR within a period of 3 months.

Answer

The company should provide all requested information except for the emails, as they are excluded from data access request requirements under the GDPR.

Question 16

SCENARIOPlease use the following to answer the next question:Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient's name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissedJack's lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of 'all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents. In relation to the emails Jack listed six members of the management team whose inboxes the required access.How should the company respond to Jack's request to be forgotten?

Accepted Answer

The company should not erase the data at this time as it may be required to defend a legal claim of unfair dismissal.

Answer

The company should erase all data relating to Jack without undue delay as the right to be forgotten is an absolute right.

Answer

The company should claim that the right to be forgotten is not applicable to them, as only a fraction of their global workforce resides in the European Union.

Answer

The company should ensure that the information is stored outside of the European Union so that the right to be forgotten under the GDPR does not apply.

Question 17

Pursuant to Article 17 and EDPB Guidelines S'2019 on RTBF criteria in search engines cases, all of the following would be valid grounds for data subject delisting requests EXCEPT?

Accepted Answer

The processing s necessary for exercising the right of freedom of expression and information

Answer

The personal dale has been collected in relation to the offer of Information society services (ISS) to a child.

Answer

The data subject withdraws consent and there is no other legal basis for the processing.

Answer

The personal data is no longer necessary in relation to the search engine provider's processing

Question 18

According to Art 23 GDPR, which of the following data subject rights can NOT be restricted?

Accepted Answer

Right to lodge a complaint with a supervisory authority.

Answer

Right to restriction of processing.

Answer

Right to erasure ('Right to be forgotten').

Answer

Right not to be subject to automated individual decision-making

Question 19

The European Data Protection Board (EDPB) recommends measures to supplement transfer tools, in order to ensure compliance with the European Union (EU) level of personal data protection. According to these recommendations, what additional actions should be taken when a transfer to a third country is based upon an adequacy decision?

Accepted Answer

Monitor changes in the law or practice of the third country that would tower the level of protection of personal data

Answer

Adopt a supplementary data transfer mechanism.

Answer

Monitor the ongoing validity of the data transfer mechanism.

Answer

Adopt technical, contractual or organizational supplementary measures.

Question 20

SCENARIOPlease use the following to answer the next question:BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information -- name, location, and prior purchase history -- with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.Prior to sharing its customer list, BHealthy conducted a review of Natural Insight's security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy's data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight's machine learning algorithms.Under the GDPR, what are Natural Insight's security obligations with respect to the customer information it received from BHealthy?

Accepted Answer

Appropriate security that takes into account the industry practices for protecting customer contact information and purchase history.

Answer

Only the security measures assessed by BHealthy prior to entering into the data processing contract.

Answer

Absolute security since BHealthy is sharing personal data, including purchase history, with Natural Insight.

Answer

The level of security that a reasonable data subject whose data is processed would expect in relation to the data subject's purchase history.

Question 21

SCENARIOPlease use the following to answer the next question:BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information -- name, location, and prior purchase history -- with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.Prior to sharing its customer list, BHealthy conducted a review of Natural Insight's security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy's data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight's machine learning algorithms.In which case would Natural Insight's use of BHealthy's data for improvement of its algorithms be considered data processor activity?

Accepted Answer

If Natural Insight receives express contractual instructions from BHealthy to use its data for improving its algorithms.

Answer

If Natural Insight uses BHealthy's data for improving price point predictions only for BHealthy.

Answer

If Natural Insight agrees to be fully liable for its use of BHealthy's customer information in its product improvement activities.

Answer

If Natural Insight satisfies the transparency requirement by notifying BHealthy's customers of its plans to use their information for its product improvement activities.

Question 22

Which of the following is NOT an explicit right granted to data subjects under the GDPR?

Accepted Answer

The right to opt-out of the sale of their personal data to third parties.

Answer

The right to request access to the personal data a controller holds about them.

Answer

The right to request the deletion of data a controller holds about them.

Answer

The right to request restriction of processing of personal data, under certain scenarios.

Question 23

As per the GDPR, which legal basis would be the most appropriate for an online shop that wishes to process personal data for the purpose of fraud prevention?

Accepted Answer

Legitimate interest

Answer

Protection of the interests of the data subjects.

Answer

Performance of a contact

Answer

Consent

Question 24

The Planet 49 CJEU Judgement applies to?

Accepted Answer

Cookies regardless of whether the data accessed is personal or not.

Answer

Cookies used only by third parties.

Answer

Cookies that are deemed technically necessary.

Answer

Cookies where the data accessed is considered as personal data only.

Question 25

Bioface is a company based in the United States. It has no servers, personnel or assets in the European Union. By collecting photographs from social media and other web-based services, such as newspapers and blogs, it uses machine learning to develop a facial recognition algorithm. The algorithm identifies individuals in photographs who are not in its data set based the algorithm and its existing data. The service collects photographs of data subjects in the European Union and will identify them if presented with their photographs. Bioface offers its service to government agencies and companies in the United States and Canada, but not to those in the European Union. Bioface does not offer the service to individuals.Why is Bioface subject to the territorial scope of the General Data Protection Regulation?

Accepted Answer

It monitors the behavior of data subjects in the European Union.

Answer

It collects data from European Union websites, which constitutes an establishment in the European Union.

Answer

It offers services in the European Union by identifying data subjects in the European Union.

Answer

It collects data from subjects and uses it for automated processing.

Question 26

SCENARIOPlease use the following to answer the next question:Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy company operating in every continent. All of the company's IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father's company, but is also secretly working on launching a new global online dating website company called Ben Knows Best. Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company's online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers' philosophical beliefs, political opinions and marital status. If a customer identifies as single, Ben then copies all of that customer's personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out. Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland. Joe also hires his best friend's daughter, Alice, who just graduated from law school in the U.S., to be the company's new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company's operations in the European Union to the U.S. Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company's IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone's information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm. When Ben had the company collect additional data from its customers, the most serious violation of the GDPR occurred because the processing of the data created what?

Accepted Answer

A potential legal liability and financial exposure from its customers.

Answer

An information security risk by copying the data into a new database.

Answer

A significant risk to the customers' fundamental rights and freedoms.

Answer

A significant risk due to the lack of an informed consent mechanism.

Question 27

SCENARIOPlease use the following to answer the next question:Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA.  Today, it is a multi-billion-dollar candy company operating in every continent. All of the company's IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father's company, but is also secretly working on launching a new global online dating website company called Ben Knows Best. Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company's online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers' philosophical beliefs, political opinions and marital status. If a customer identifies as single, Ben then copies all of that customer's personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out. Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland. Joe also hires his best friend's daughter, Alice, who just graduated from law school in the U.S., to be the company's new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company's operations in the European Union to the U.S. Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company's IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone's information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm. In preparing the company for its impending lawsuit, Alice's instruction to the company's IT Department violated Article 5 of the GDPR because the company failed to first do what?

Accepted Answer

Send out consent forms to all of its employees.

Answer

Minimize the amount of data collected for the lawsuit.

Answer

Inform all of its employees about the lawsuit.

Answer

Encrypt the data from all of its employees.

Question 28

SCENARIOPlease use the following to answer the next question:Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA.  Today, it is a multi-billion-dollar candy company operating in every continent. All of the company's IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father's company, but is also secretly working on launching a new global online dating website company called Ben Knows Best. Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company's online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers' philosophical beliefs, political opinions and marital status. If a customer identifies as single, Ben then copies all of that customer's personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out. Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland. Joe also hires his best friend's daughter, Alice, who just graduated from law school in the U.S., to be the company's new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company's operations in the European Union to the U.S. Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company's IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone's information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm. As a result of Sam's actions, the Gummy Bear Company potentially violated Articles 33 and 34 of the GDPR and will be required to do what?

Accepted Answer

Analyze and evaluate the liability for customers in Ireland.

Answer

Notify its Data Protection Authority about the data breach.

Answer

Analyze and evaluate all of its breach notification obligations.

Answer

Notify all of its customers that reside in the European Union.

Question 29

SCENARIOPlease use the following to answer the next question:Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA.  Today, it is a multi-billion-dollar candy company operating in every continent. All of the company's IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father's company, but is also secretly working on launching a new global online dating website company called Ben Knows Best. Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company's online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers' philosophical beliefs, political opinions and marital status. If a customer identifies as single, Ben then copies all of that customer's personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out. Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland. Joe also hires his best friend's daughter, Alice, who just graduated from law school in the U.S., to be the company's new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company's operations in the European Union to the U.S. Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company's IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone's information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm. The data transfer mechanism that Alice drafted violates the GDPR because the company did not first get approval from?

Accepted Answer

The European Data Protection Board.

Answer

The Court of Justice of the European Union.

Answer

The Data Protection Authority.

Answer

The European Commission.

Question 30

Which of the following is an accurate statement regarding the 'one-stop-shop' mechanism of the GDPR?

Accepted Answer

It allows supervisory authorities concerned (other than the lead supervisory authority) to act against organizations m exceptional cases even if they do not have any type of establishment in the Member State of the respective authority.

Answer

It can result in several lead supervisory authorities in the EU assuming competence over the same data processing activities of an organization.

Answer

It applies only to direct enforcement of data protection supervisory authorities (e.g.. finding a breach), but not to initiating or engaging m court proceedings

Answer

It gives competence to the lead supervisory authority to address privacy issues derived from processes carried out by public authorities established in different countries.

Question 31

SCENARIOPlease use the following to answer the next question:ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorageIn support of Ruth's strategic goals of hiring more sales representatives, the HumanResources team is focused on improving its processes to ensure that new employees are sourced, interviewed, hired, and onboarded efficiently. To help with this, Mary identified two vendors, HRYourWay, a German based company, andInstaHR, an Australian based company. She decided to have both vendors go through ProStorage's vendor risk review process so she can work with Ruth to make the final decision. As part of the review process, Jackie, who is responsible for maintaining ProStorage's privacy program (including maintaining controller BCRs and conducting vendor risk assessments), reviewed both vendors but completed a transfer impact assessment only for InstaHR. After her review of both boasted a more established privacy program and provided third-party attestations, whereas HRYourWay was a small vendor with minimal data protection operations.Thus, she recommended InstaHR.ProStorage's marketing team also worked to meet the strategic goals of the company by focusing on industries where it needed to grow its market share. To help with this, the team selected as a partner UpFinance, a US based company with deep connections to financial industry customers. During ProStorage's diligence process, Jackie from the privacy team noted in the transfer impact assessment that UpFinance implements several data protection measures including end-to-end encryption, with encryption keys held by the customer.Notably, UpFinance has not received any government requests in its 7 years of business. Still, Jackie recommended that the contract require UpFinance to notifyProStorage if it receives a government request for personal data UpFinance processes on its behalf prior to disclosing such data.What transfer mechanism did ProStorage most likely rely on to transfer Ruth's medical information to the hospital?

Accepted Answer

Protecting the vital interest of Ruth

Answer

Ruth's implied consent.

Answer

Performance of a contract with Ruth.

Answer

Protecting against legal liability from Ruth.

Question 32

SCENARIOPlease use the following to answer the next question:ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorageIn support of Ruth's strategic goals of hiring more sales representatives, the HumanResources team is focused on improving its processes to ensure that new employees are sourced, interviewed, hired, and onboarded efficiently. To help with this, Mary identified two vendors, HRYourWay, a German based company, andInstaHR, an Australian based company. She decided to have both vendors go through ProStorage's vendor risk review process so she can work with Ruth to make the final decision. As part of the review process, Jackie, who is responsible for maintaining ProStorage's privacy program (including maintaining controller BCRs and conducting vendor risk assessments), reviewed both vendors but completed a transfer impact assessment only for InstaHR. After her review of both boasted a more established privacy program and provided third-party attestations, whereas HRYourWay was a small vendor with minimal data protection operations.Thus, she recommended InstaHR.ProStorage's marketing team also worked to meet the strategic goals of the company by focusing on industries where it needed to grow its market share. To help with this, the team selected as a partner UpFinance, a US based company with deep connections to financial industry customers. During ProStorage's diligence process, Jackie from the privacy team noted in the transfer impact assessment that UpFinance implements several data protection measures including end-to-end encryption, with encryption keys held by the customer.Notably, UpFinance has not received any government requests in its 7 years of business. Still, Jackie recommended that the contract require UpFinance to notifyProStorage if it receives a government request for personal data UpFinance processes on its behalf prior to disclosing such data.What transfer mechanism should Jackie recommend for using InstaHR?

Accepted Answer

Standard contractual clauses

Answer

Adequacy

Answer

Binding corporate rules.

Answer

Explicit consent of employees.

Question 33

SCENARIOPlease use the following to answer the next question:ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorageIn support of Ruth's strategic goals of hiring more sales representatives, the HumanResources team is focused on improving its processes to ensure that new employees are sourced, interviewed, hired, and onboarded efficiently. To help with this, Mary identified two vendors, HRYourWay, a German based company, andInstaHR, an Australian based company. She decided to have both vendors go through ProStorage's vendor risk review process so she can work with Ruth to make the final decision. As part of the review process, Jackie, who is responsible for maintaining ProStorage's privacy program (including maintaining controller BCRs and conducting vendor risk assessments), reviewed both vendors but completed a transfer impact assessment only for InstaHR. After her review of both boasted a more established privacy program and provided third-party attestations, whereas HRYourWay was a small vendor with minimal data protection operations.Thus, she recommended InstaHR.ProStorage's marketing team also worked to meet the strategic goals of the company by focusing on industries where it needed to grow its market share. To help with this, the team selected as a partner UpFinance, a US based company with deep connections to financial industry customers. During ProStorage's diligence process, Jackie from the privacy team noted in the transfer impact assessment that UpFinance implements several data protection measures including end-to-end encryption, with encryption keys held by the customer.Notably, UpFinance has not received any government requests in its 7 years of business. Still, Jackie recommended that the contract require UpFinance to notifyProStorage if it receives a government request for personal data UpFinance processes on its behalf prior to disclosing such data.Why is the additional measure recommended by Jackie sufficient foe using UpFinance?

Accepted Answer

UpFinance implements sufficient data protection measures

Answer

UpFinance is an established 7-year-old business.

Answer

UpFinance is in a highly regulated financial industry

Answer

UpFinance is based in a country without surveillance laws.

Question 34

SCENARIOPlease use the following to answer the next question:Why was Jackie correct in not completing a transfer impact assessment for HRYourWay?

Accepted Answer

HRYourWay is not located in a third country.

Answer

HRYourWay was ultimately not selected

Answer

ProStorage will obtain consent for all transfers.

Answer

ProStorage can rely on its Binding Corporate Rules

Question 35

Sanctions for non-compliance with the EU Artificial Intelligence Act (Al Act) could result in a maximum fine of?

Accepted Answer

The higher of up to 30 million Euro or up to 6% of the entity's total worldwide turnover for the preceding financial year.

Answer

The higher of up to 10 million Euro or up to 2% of the entity's total worldwide turnover for the preceding financial year.

Answer

The higher of up to 40 million Euro or up to 8% of the entity's total worldwide turnover for the preceding financial year.

Answer

The higher of up to 20 million Euro or up to 4% of the entity's total worldwide turnover for the preceding financial year.

Question 36

SCENARIOPlease use the following to answer the next question:Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located inGreece (5), Italy (15) and Spain (1), have registered their most profitable results ever. To celebrate this achievement, ARRA Hotels' Human Resources office, based in ARRA's main Italian establishment, has organized a team event for its 420employees and their families at its hotel in Spain.Upon arrival at the hotel, each employee and family member is given an electronic wristband at the reception desk. The wristband serves a number of functions:. Allows access to the 'party zone' of the hotel, and emits a buzz if the user approaches any unauthorized areas. Allows up to three free drinks for each person of legal age, and emits a buzz once this limit has been reached. Grants a unique ID number for participating in the games and contests that have been planned.Along with the wristband, each guest receives a QR code that leads to the online privacy notice describing the use of the wristband. The page also contains an unchecked consent checkbox. In the case of employee family members under the age of 16, consent must be given by a parent.Among the various activities planned for the event, ARRA Hotels' HR office has autonomously set up a photocall area, separate from the main event venue, where employees can come and have their pictures taken in traditional carnival costume.The photos will be posted on ARRA Hotels' main website for general marketing purposes.On the night of the event, an employee from one of ARRA's Greek hotels is displeased with the results of the photos in which he appears. He intends to file a complaint with the relevant supervisory authority in regard to the following:. The lack of any privacy notice in the separate photocall areaThe unlawful cross-border processing of his personal data. The unacceptable aesthetic outcome of his photosWhich of the following is NOT necessarily considered a factor in identifying whether the processing could be considered a 'cross-border processing'?

Accepted Answer

The total number of the data subjects interested.

Answer

The potential harm for the data subjects affected.

Answer

The limitation of rights of the data subjects concerned.

Answer

The exposure of the information of the data subjects involved.

Question 37

SCENARIOPlease use the following to answer the next question:Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located inGreece (5), Italy (15) and Spain (1), have registered their most profitable results ever. To celebrate this achievement, ARRA Hotels' Human Resources office, based in ARRA's main Italian establishment, has organized a team event for its 420employees and their families at its hotel in Spain.Upon arrival at the hotel, each employee and family member is given an electronic wristband at the reception desk. The wristband serves a number of functions:. Allows access to the 'party zone' of the hotel, and emits a buzz if the user approaches any unauthorized areas. Allows up to three free drinks for each person of legal age, and emits a buzz once this limit has been reached. Grants a unique ID number for participating in the games and contests that have been planned.Along with the wristband, each guest receives a QR code that leads to the online privacy notice describing the use of the wristband. The page also contains an unchecked consent checkbox. In the case of employee family members under the age of 16, consent must be given by a parent.Among the various activities planned for the event, ARRA Hotels' HR office has autonomously set up a photocall area, separate from the main event venue, where employees can come and have their pictures taken in traditional carnival costume.The photos will be posted on ARRA Hotels' main website for general marketing purposes.On the night of the event, an employee from one of ARRA's Greek hotels is displeased with the results of the photos in which he appears. He intends to file a complaint with the relevant supervisory authority in regard to the following:. The lack of any privacy notice in the separate photocall areaThe unlawful cross-border processing of his personal data. The unacceptable aesthetic outcome of his photosWhich of the following principles has likely been violated in the processing of the photocall photos containing personal data?

Accepted Answer

Transparency.

Answer

Adequacy.

Answer

Lawfulness.

Answer

Data minimization.

Question 38

SCENARIOPlease use the following to answer the next question:Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located inGreece (5), Italy (15) and Spain (1), have registered their most profitable results ever. To celebrate this achievement, ARRA Hotels' Human Resources office, based in ARRA's main Italian establishment, has organized a team event for its 420employees and their families at its hotel in Spain.Upon arrival at the hotel, each employee and family member is given an electronic wristband at the reception desk. The wristband serves a number of functions:. Allows access to the 'party zone' of the hotel, and emits a buzz if the user approaches any unauthorized areas. Allows up to three free drinks for each person of legal age, and emits a buzz once this limit has been reached. Grants a unique ID number for participating in the games and contests that have been planned.Along with the wristband, each guest receives a QR code that leads to the online privacy notice describing the use of the wristband. The page also contains an unchecked consent checkbox. In the case of employee family members under the age of 16, consent must be given by a parent.Among the various activities planned for the event, ARRA Hotels' HR office has autonomously set up a photocall area, separate from the main event venue, where employees can come and have their pictures taken in traditional carnival costume.The photos will be posted on ARRA Hotels' main website for general marketing purposes.On the night of the event, an employee from one of ARRA's Greek hotels is displeased with the results of the photos in which he appears. He intends to file a complaint with the relevant supervisory authority in regard to the following:. The lack of any privacy notice in the separate photocall areaThe unlawful cross-border processing of his personal data. The unacceptable aesthetic outcome of his photosWhy would consent NOT be considered an adequate legal basis for accessing the party zone?

Accepted Answer

The consent is not freely given.

Answer

The consent is not completely unambiguous.

Answer

The consent is not sufficiently informed.

Answer

The consent is not in writing.

Question 39

SCENARIOPlease use the following to answer the next question:Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located inGreece (5), Italy (15) and Spain (1), have registered their most profitable results ever. To celebrate this achievement, ARRA Hotels' Human Resources office, based in ARRA's main Italian establishment, has organized a team event for its 420employees and their families at its hotel in Spain.Upon arrival at the hotel, each employee and family member is given an electronic wristband at the reception desk. The wristband serves a number of functions:. Allows access to the 'party zone' of the hotel, and emits a buzz if the user approaches any unauthorized areas. Allows up to three free drinks for each person of legal age, and emits a buzz once this limit has been reached. Grants a unique ID number for participating in the games and contests that have been planned.Along with the wristband, each guest receives a QR code that leads to the online privacy notice describing the use of the wristband. The page also contains an unchecked consent checkbox. In the case of employee family members under the age of 16, consent must be given by a parent.Among the various activities planned for the event, ARRA Hotels' HR office has autonomously set up a photocall area, separate from the main event venue, where employees can come and have their pictures taken in traditional carnival costume.The photos will be posted on ARRA Hotels' main website for general marketing purposes.On the night of the event, an employee from one of ARRA's Greek hotels is displeased with the results of the photos in which he appears. He intends to file a complaint with the relevant supervisory authority in regard to the following:. The lack of any privacy notice in the separate photocall areaThe unlawful cross-border processing of his personal data. The unacceptable aesthetic outcome of his photosAssuming that there is a cross-border processing of personal data, which of the following criteria would NOT be useful to the lead supervisory authority responsible for the Greek employee's complaint when trying to determine the location of the controller's main establishment?

Accepted Answer

Where the processor is registered as a company.

Answer

Where the controller is registered as a company.

Answer

Where decisions about the processing activities are made.

Answer

Where the director with responsibility for processing activities is located.

Question 40

As a Data Protection Officer for a small bank in the European Union, you receive a data subject access request from one of your customers. The customer provides you with his name, and has used the email address registered in your system.What would be the most appropriate way to confirm the identity of the customer?

Accepted Answer

Request that the customer answer additional security questions.

Answer

Request that the customer provide his bank account number.

Answer

Request a copy of the customer's last bank account statement.

Answer

Request a copy of the customer's government-issued ID document.

IAPP CIPP-E Practice Test 6

IAPP CIPP-E Practice Tests

IAPP CIPP-E Practice Test 6

Question

IAPP CIPP-E Practice Tests

Practice Tests