IAPP CIPP-E Practice Test - Questions Answers, Page 2
Question list
List of questions
Related questions
When would a data subject NOT be able to exercise the right to portability?
When the processing is necessary to perform a task in the exercise of authority vested in the controller.
When the processing is carried out pursuant to a contract with the data subject.
When the data was supplied to the controller by the data subject.
When the processing is based on consent.
In which of the following situations would an individual most likely to be able to withdraw her consent for processing?
When she is leaving her bank and moving to another bank.
When she has recently changed jobs and no longer works for the same company.
When she disagrees with a diagnosis her doctor has recorded on her records.
When she no longer wishes to be sent marketing materials from an organization.
As a result of the European Court of Justice's ruling in the case of Google v. Spain, search engines outside the EEA are also likely to be subject to the Regulation's right to be forgotten. This holds true if the activities of an EU subsidiary and its U.S. parent are what?
Supervised by the same Data Protection Officer.
Consistent with Privacy Shield requirements
Bound by a standard contractual clause.
Inextricably linked in their businesses.
A German data subject was the victim of an embarrassing prank 20 years ago. A newspaper website published an article about the prank at the time, and the article is still available on the newspaper's website. Unfortunately, the prank is the top search result when a user searches on the victim's name. The data subject requests that SearchCo delist this result. SearchCo agrees, and instructs its technology team to avoid scanning or indexing the article. What else must SearchCo do?
Notify the newspaper that its article it is delisting the article.
Fully erase the URL to the content, as opposed to delist which is mainly based on data subject's name.
Identify other controllers who are processing the same information and inform them of the delisting request.
Prevent the article from being listed in search results no matter what search terms are entered into the search engine.
What are the obligations of a processor that engages a sub-processor?
The processor must give the controller prior written notice and perform a preliminary audit of the sub- processor.
The processor must obtain the controller's specific written authorization and provide annual reports on the sub-processor's performance.
The processor must receive a written agreement that the sub-processor will be fully liable to the controller for the performance of its obligations in relation to the personal data concerned.
The processor must obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor.
What must be included in a written agreement between the controller and processor in relation to processing conducted on the controller's behalf?
An obligation on the processor to report any personal data breach to the controller within 72 hours.
An obligation on both parties to report any serious personal data breach to the supervisory authority.
An obligation on both parties to agree to a termination of the agreement if the other party is responsible for a personal data breach.
An obligation on the processor to assist the controller in complying with the controller's obligations to notify the supervisory authority about personal data breaches.
To provide evidence of GDPR compliance, a company performs an internal audit. As a result, it finds a data base, password-protected, listing all the social network followers of the client.
Regarding the domain of the controller-processor relationships, how is this situation considered?
Compliant with the security principle, because the data base is password-protected.
Non-compliant, because the storage of the data exceeds the tasks contractually authorized by the controller.
Not applicable, because the data base is password protected, and therefore is not at risk of identifying any data subject.
Compliant with the storage limitation principle, so long as the internal auditor permanently deletes the data base.
There are three domains of security covered by Article 32 of the GDPR that apply to both the controller and the processor. These include all of the following EXCEPT?
Consent management and withdrawal.
Incident detection and response.
Preventative security.
Remedial security.
In the event of a data breach, which type of information are data controllers NOT required to provide to either the supervisory authorities or the data subjects?
The predicted consequences of the breach.
The measures being taken to address the breach.
The type of security safeguards used to protect the data.
The contact details of the appropriate data protection officer.
In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?
Where the DPIA identifies that personal data needs to be transferred to other countries outside of the EEA.
Where the DPIA identifies high risks to individuals' rights and freedoms that the controller can take steps to reduce.
Where the DPIA identifies that the processing being proposed collects the sensitive data of EU citizens.
Where the DPIA identifies risks that will require insurance for protecting its business interests.
Question