ISO 31700 has set forth requirements relating to consumer products and services. In particular, this international standard focuses on the implementation of which of the following?

Comprehensive ethical Al software.

Privacy notices for companies providing services to consumers.

Automated systems for identifying EU data subjects' personal data.

In the wake of the Schrems II ruling, which of the following actions has been recommended by the EDPB for companies transferring personal data to third countries?

Adopting a risk-based approach and implementing supplementary measures as needed.

Ensuring that all data transfers are encrypted with unbreakable encryption algorithms.

Obtaining explicit consent from each EU citizen for every individual data transfer.

Storing all personal data within the borders of the European Union.

Pursuant to the EDPB Guidelines 8/2022, all of the following criteria must be considered when identifying a lead supervisory authority of a controller EXCEPT?

Determining the supervisory authority according to what has been identified by the controller as the authority to which data subjects can lodge complaints.

Determining where the controller has its place of central administration in the EEA.

Determining the supervisory authority where the place of central administration of the controller is located.

Determining the supervisory authority according to what has been identified by the controller as the authority to which data subjects can lodge complaints.

Determining if decisions on the processing are taken in another establishment in the EEA, and if that establishment has the power to implement those decisions.

SCENARIOPlease use the following to answer the next question:ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorageIn support of Ruth's strategic goals of hiring more sales representatives, the HumanResources team is focused on improving its processes to ensure that new employees are sourced, interviewed, hired, and onboarded efficiently. To help with this, Mary identified two vendors, HRYourWay, a German based company, andInstaHR, an Australian based company. She decided to have both vendors go through ProStorage's vendor risk review process so she can work with Ruth to make the final decision. As part of the review process, Jackie, who is responsible for maintaining ProStorage's privacy program (including maintaining controller BCRs and conducting vendor risk assessments), reviewed both vendors but completed a transfer impact assessment only for InstaHR. After her review of both boasted a more established privacy program and provided third-party attestations, whereas HRYourWay was a small vendor with minimal data protection operations.Thus, she recommended InstaHR.ProStorage's marketing team also worked to meet the strategic goals of the company by focusing on industries where it needed to grow its market share. To help with this, the team selected as a partner UpFinance, a US based company with deep connections to financial industry customers. During ProStorage's diligence process, Jackie from the privacy team noted in the transfer impact assessment that UpFinance implements several data protection measures including end-to-end encryption, with encryption keys held by the customer.Notably, UpFinance has not received any government requests in its 7 years of business. Still, Jackie recommended that the contract require UpFinance to notifyProStorage if it receives a government request for personal data UpFinance processes on its behalf prior to disclosing such data.What transfer mechanism did ProStorage most likely rely on to transfer Ruth'smedical information to the hospital?

Protecting the vital interest of Ruth.

Performance of a contract with Ruth.

Protecting against legal liability from Ruth.

Which of the following elements does NOT need to be presented to a data subject in order to collect valid consent for the use of cookies?

A list of cookies that may be placed.

Information on the purpose of the cookies.

Since blockchain transactions are classified as pseudonymous, are they considered to be within the material scope of the GDPR, or outside of it?

Within the material scope of the GDPR to the extent that transactions include data subjects in the European Union.

Outside the material scope of the GDPR, because transactions do not include personal data about data subjects in the European Union.

Outside the material scope of the GDPR, because transactions are for personal or household purposes.

Within the material scope of the GDPR to the extent that transactions include data subjects in the European Union.

Within the material scope of the GDPR but outside of the territorial scope, because blockchains are decentralized.

Which of the following is NOT recognized as a common characteristic of cloud computing services?

The supplier assumes the vendor's business risk associated with data processed by the supplier.

The service's infrastructure is shared among the supplier's customers and can be located in a number of countries.

The supplier determines the location, security measures, and service standards applicable to the processing.

The supplier allows customer data to be transferred around the infrastructure according to capacity.

The supplier assumes the vendor's business risk associated with data processed by the supplier.

Jerry the Chief Marketing Officer for a sports apparel and trophy company, sells products to schools and athletic clubs globally Recently the company has decided to invest in a new line of customized sports equipment Jerry plans to email his current customer base to offer them a discount on their first purchase of such equipment.Jerry tells Kate, the Director of Privacy, about his plan. What is the best guidance Kate can provide to Jerry?

Require Jerry to send all current customers a second notice to allow them to opt-in to marketing emails

Permit Jerry to carry out his plan on the basis of marketing similar products to existing customers.

Require Jerry to send all current customers a second notice to allow them to opt-in to marketing emails

Permit Jerry to carry out his marketing plan on the basis of legitimate interest

Require Jerry to include an option to opt out of marketing emails in the future

A homeowner has installed a motion-detecting surveillance system that films his front doc and entryway. The camera does not film any public areas only areas that are the property of the homeowner. The system has seen declared to the authorities per the homeowner's country law, and a placard indicating the area is being video monitored is visible when entering the propertyWhy can the homeowner NOT depend on the household exemption with regards to the processing of the video images recorded by the surveillance camera system?

The surveillance camera system can potentially capture biometric information of the homeowner's family, which would be considered a processing of special categories of personal data.

The homeowner has not specified which security measures ore in place as part of the surveillance camera system

The GDPR specifically excludes surveillance camera images from the household exemption

The surveillance camera system can potentially film individuals who enter its filming perimeter

Which of the following is NOT one of the 4 principles developed by the European Al Alliance regarding the ethical use of Artificial Intelligence?

It should respect human autonomy.

Since blockchain transactions are classified as pseudonymous, are they considered to be within the material scope of the GDPR or outside of it?

Within the material scope of the GDPR to the extent that transactions include data subjects in the European Union.

Outside the material scope of the GDPR, because transactions do not include personal data about data subjects m the European Union.

Within the material scope of the GDPR but outside of the territorial scope, because blockchains are decentralized.

Within the material scope of the GDPR to the extent that transactions include data subjects in the European Union.

Outside the material scope of the GDPR, because transactions are for personal or household purposes

After detecting an intrusion involving the theft of unencrypted personal data, who shall the breached company notify first under GDPR requirements?

Any affected customers whose data was compromised.

Any parents of children whose personal data was compromised.

Any affected customers whose data was compromised.

A competent supervisory authority.

What ruling did the Planet 49 CJEU judgment make regarding the issue of pre-ticked boxes?

They constitute valid consent if the processing is necessary for purposes of legitimate interest

They are allowed if determined to be technically necessary.

They do not amount to valid consent under any circumstances.

They are allowed if recorded In the register of processing activities.

They constitute valid consent if the processing is necessary for purposes of legitimate interest

Higher fines are assessed for GDPR violations due to which of the following?

Violations of a data subject's rights

Failure to notify a supervisory authority and data subjects of a personal data breach

Violations of a data controller's obligations to obtain a child's consent

Failure to appoint a data protection officer.

Violations of a data subject's rights

According to the European Data Protection Board, data subjects should be aware of any video surveillance in operation. How should a retail shop operator ensure that data subjects receive at information required for such a purpose under EU data protection law?

The shop operator should provide full notice of the intended video surveillance outside the shop, for example with a sign or a stand-up display.

The shop operator should post a copy of the manual of the video surveillance system in the shop and on its social media channels.

The shop operator should provide full notice of the intended video surveillance outside the shop, for example with a sign or a stand-up display.

The shop operator should instruct the data protection officer to hand out a comprehensive notice to data subjects every time they enter the shop.

The shop operator should provide the most important information on a clearly readable warning sign to data subjects before they enter the monitored area, and additional mandatory details by other means.

In relation to third countries and international organizations, which of the following shall, along with the supervisory authorities, take appropriate steps to develop international cooperation mechanisms for the enforcement of data protection legislation?

The designated Data Protection Officers

The Council of the European Union.

The designated Data Protection Officers

A company wishes to transfer personal data to a country outside of the European Union/EEA In order to do so, they are planning an assessment of the country's laws and practices, knowing that these may impinge upon the transfer safeguards they intend to useAll of the following factors would be relevant for the company to consider EXCEPT'?

The process of modernization in the third country concerned and their access to emerging technologies that rely on international transfers of personal data

Any onward transfers, such as transfers of personal data to a sub-processor in the same or another third country.

The process of modernization in the third country concerned and their access to emerging technologies that rely on international transfers of personal data

The technical, financial, and staff resources available to an authority m the third country concerned that may access the personal data to be transferred

The contractual clauses between the data controller or processor established in the European Union/EEA and the recipient of the transfer established in the third country concerned

What is the primary purpose of Convention 108+, which amends the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data?

To strengthen data protection in line with the European and international regulatory framework.

To issue updated guidelines for data transfers from the EU to third-country signatories to the Convention.

To modify the process for third countries to obtain an adequacy decision from the European Commission.

To strengthen data protection in line with the European and international regulatory framework.

To establish new data subject rights and safeguards for consumers in the EU member states.

SCENARIOPlease use the following to answer the next question:Jane starts her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform.The company stores and processes the personal data of its customers in a dedicated data center located in Malta (EU).People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a Know Your Customer (KYC) due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations.The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and ticking a checkbox on a separate page in order to get their account approved on the platform.All customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if a customer fails the KYC process, its KYC data will be automatically shared with the national anti-money laundering agency.The KYC procedure requires customers to answer many questions, including whether they have any criminal convictions, whether they use recreational drugs or have problems with alcohol, and whether they have a terminal illness. While providing this data, customers see a conspicuous message saying that this data is meant only to prevent fraud and account takeover, and will be never shared with private third parties.The company regularly conducts external security testing of its online systems by independent cybersecurity companies from the EU. At the final stage of testing, the company provides cybersecurity assessors with access to its central database to review security permissions, roles and policies. Personal data in the database is encrypted; however, cybersecurity assessors usually have access to the decryption keys obtained while running initial security testing. The assessors must strictly follow the guidelines imposed by the company during the entire testing and auditing process.All customer data, including trading activities and all internal communications with technical support, are permanently stored in a secured AWS S3 Glacier cloud data storage, located in Ireland, for backup and compliance purposes. The data is securely transferred to the cloud and then is properly encrypted while at rest by using AWS-native encryption mechanisms. These mechanisms give AWS the necessary technical means to encrypt and decrypt the data when such is required by the company. There is no data processing agreement between AWS and the company.Should Jane modify the required GDPR rights waiver for non-European residents?

Yes, this clause must be entirely removed as all customers, regardless of residence or nationality, shall enjoy the same individual rights granted under GDPR.

Yes, the waiver must not apply to any residents of countries with an adequacy decision from the EC.

Yes, this clause must be entirely removed as all customers, regardless of residence or nationality, shall enjoy the same individual rights granted under GDPR.

No, the non-EU residents are not protected by GDPR unless they are physically located in the EU.

No, but all non-EU residents must manually sign a separate waiver to ensure its lawfulness and enforceability under GDPR.

You are the new Data Protection Officer for your company and have to determine whether the company has implemented appropriate technical and organizational measures as required by Article 32 of the GDPR. Which of the following would be the most important to consider when trying to determine this?

How the public perceives what constitutes adequate security measures

How security measures might evolve in the future

Which security measures are endorsed by a majority of experts.

How the public perceives what constitutes adequate security measures

Which kinds of security measures your company has employed in the past

It a company receives an anonymous email demanding ransom for the stolen personal data of its clients, what must the company do next, per GDPR requirements'3

Send a notification to the competent supervisory authority describing the incident.

Notify the police and Tile a criminal complaint about the incident

Start an investigation to understand the incident's possible scope, duration and nature

Send a notification to the competent supervisory authority describing the incident.

Send an email about the incident to all clients and ask them to change their passwords

If two controllers act as joint controllers pursuant to Article 26 of the GDPR, which of the following may NOT be validly determined by said controllers?

The rules to provide information to data subjects in Articles 13 and 14.

The definition of a central contact point for data subjects.

The rules regarding the exercising of data subjects' rights.

The rules to provide information to data subjects in Articles 13 and 14.

The non-disclosure of the essence of their arrangement to data subjects

What is the main task of the European Data Protection Board?

To ensure consistent application of the GDPR.

To assess adequacy of data protection in third countries

To ensure consistent application of the GDPR.

To proactively prevent disputes between national supervisory authorities.

To publish guidelines tor data subjects on how to property enforce their rights

SCENARIOPlease use the following to answer the next question:Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester's Alumni portal. Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.Under their security policy, the University encrypts all of its personal data records in transit and at rest.In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.One of Anna's tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.Anna will find that a risk analysis is NOT necessary in this situation as long as?

The data subjects are no longer current students of Frank's

The processing will not negatively affect the rights of the data subjects

The algorithms that Frank uses for the processing are technologically sound

The data subjects gave their unambiguous consent for the original processing

Under Article 58 of the GDPR, which of the following describes a power of supervisory authorities in European Union (EU) member states?

The right to access data for investigative purposes.

The ability to enact new laws by executive order.

The right to access data for investigative purposes.

The discretion to carry out goals of elected officials within the member state.

The authority to select penalties when a controller is found guilty in a court of law.

Which of the following entities would most likely be exempt from complying with the GDPR?

A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.

A South American company that regularly collects European customers' personal data.

A company that stores all customer data in Australia and is headquartered in a European Union (EU) member state.

A Chinese company that has opened a satellite office in a European Union (EU) member state to service European customers.

A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.

The GDPR's list of processor obligations regarding cloud computing includes all of the following EXCEPT?

Any personal data related to data subjects must be securely maintained for a maximum of ten years.

Controllers must be given notice of any subprocessors and have a right of objection.

Individuals authorized to process the personal data are subject to an obligation of confidentiality.

Any personal data related to data subjects must be securely maintained for a maximum of ten years.

Processors must implement technical and organizational measures to ensure a level of security appropriate to the risk.

To comply with the GDPR and the EU Court of Justice's decision in Schrems II, the European Commission issued what are commonly referred to as the new standard contractual clauses (SCCs). As a result, businesses must do all of the following EXCEPT?

Implement the new SCCs in the U.K. following Brexit, as the U.K. Information Commissioner's Office does not have the authority to publish its own set of SCCs.

Consider the new optional docking clause, which expressly permits adding new parties to the SCCs.

Migrate all contracts entered into before September 27, 2021, that use the old SCCs to the new SCCs by December 27, 2022.

Take steps to flow down the new SCCs to relevant parts of their supply chain using the new SCCs as of September 27, 2021, if the business is a data importer.

Implement the new SCCs in the U.K. following Brexit, as the U.K. Information Commissioner's Office does not have the authority to publish its own set of SCCs.

SCENARIOPlease use the following to answer the next question:Gentle Hedgehog Inc. is a privately owned website design agency incorporated inItaly. The company has numerous remote workers in different EU countries. Recently, the management of Gentle Hedgehog noticed a decrease in productivity of their sales team, especially among remote workers. As a result, the company plans to implement a robust but privacy-friendly remote surveillance system to prevent absenteeism, reward top performers, and ensure the best quality of customer service when sales people are interacting with customers.Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employee surveillance software whose European headquarters is in Germany. Sauron Eye's software provides powerful remote-monitoring capabilities, including 24/7 access to computer cameras and microphones, screen captures, emails, website history, and keystrokes. Any device can be remotely monitored from a central server that is securely installed at Gentle Hedgehog headquarters. The monitoring is invisible by default; however, a so-called Transparent Mode, which regularly and conspicuously notifies all users about the monitoring and its precise scope, also exists. Additionally, the monitored employees are required to use a built-in verification technology involving facial recognition each time they log in.All monitoring data, including the facial recognition data, is securely stored in Microsoft Azure cloud servers operated by Sauron Eye, which are physically located in France.What is the main problem with the 24/7 camera monitoring?

It has no valid legal basis to be implemented in the context of Gentle Hedgehog's business.

It must not be operated during non-business hours and employee holidays.

It may accidentally film third parties whose consent is required for monitoring.

It has no valid legal basis to be implemented in the context of Gentle Hedgehog's business.

It must first be approved by the trade union and then granted a license from the national DPA.

In the EDPB's Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, all of the following practices follow from the principles relating to the processing of personal data under EU data protection law EXCEPT?

Frequent pseudonymization key rotation.

Error propagation avoidance along the processing chain.

Which aspect of processing does the GDPR allow processors to determine for themselves?

Their own type of hardware or software and the specific security measures for the processing.

The question of whether the controller needs to be informed about the substitution of another processor carrying out specific processing activities on behalf of the controller.

Their own purposes for the processing, if such purposes are compatible with those for which the personal data were initially collected.

The parameters of their marketing campaigns using personal data relating to the controller's customers.

Their own type of hardware or software and the specific security measures for the processing.

SCENARIOPlease use the following to answer the next question:Gentle Hedgehog Inc. is a privately owned website design agency incorporated inItaly. The company has numerous remote workers in different EU countries. Recently, the management of Gentle Hedgehog noticed a decrease in productivity of their sales team, especially among remote workers. As a result, the company plans to implement a robust but privacy-friendly remote surveillance system to prevent absenteeism, reward top performers, and ensure the best quality of customer service when sales people are interacting with customers.Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employee surveillance software whose European headquarters is in Germany. Sauron Eye's software provides powerful remote-monitoring capabilities, including 24/7 access to computer cameras and microphones, screen captures, emails, website history, and keystrokes. Any device can be remotely monitored from a central server that is securely installed at Gentle Hedgehog headquarters. The monitoring is invisible by default; however, a so-called Transparent Mode, which regularly and conspicuously notifies all users about the monitoring and its precise scope, also exists. Additionally, the monitored employees are required to use a built-in verification technology involving facial recognition each time they log in.After fixing the privacy problems, how long may Gentle Hedgehog store the monitoring data, assuming that no valid data erasure request is received?

As long as stated in the privacy policy that all employees must follow when processing personal data.

As long as required by the company's legitimate interests.

As long as a concerned employee does not request erasure of the data.

As long as provided by the EDPB guidelines for remote employee monitoring.

As long as stated in the privacy policy that all employees must follow when processing personal data.

According to the European Data Protection Board, if a controller that is not established in the EU but still subject to the GDPR becomes aware of a personal data breach, which supervisory authority or authorities must be notified?

Only the supervisory authority of the EU member state in which the controller's EU representative (pursuant to Article 27) is established.

Only one lead supervisory authority, as a controller benefits from the one-stop shop mechanism under the GDPR's enforcement regime.

Every supervisory authority of the EU member states where the controller is offering goods or services.

Every supervisory authority for which affected data subjects reside in their EU member state.

IAPP CIPP-E Practice Test 7 - Free Online Exam Questions 241-280

In the Planet 49 case, what was the main judgement of the Court of Justice of the European Union (CJEU) regarding the issue of cookies?

Become a Premium Member for full access

Unlock Premium Member

IAPP CIPP-E Practice Test 7

Question

IAPP CIPP-E Practice Tests

Practice Tests