IAPP CIPP-E Daily Practice Exam New 2026 Updated 310 Questions [Q68-Q90]

4.7/5 - (3 votes)

IAPP CIPP-E Daily Practice Exam New 2026 Updated 310 Questions

Use Valid CIPP-E Exam – Actual Exam Question & Answer

Exam Topics

The content of the CIPP/E certification exam revolves around three major subject areas, including the following:

Compliance with European Data Protection Law and Regulation
This area includes 9-18 exam questions. This topic unites the aspects, such as employment relations (storage of personnel records, whistleblowing systems, workplace monitoring & data loss prevention, EU Works councils, Bring Your Own Device (BYOD) programs); surveillance activities (interception of communications, surveillance by public authorities, closed-circuit television (CCTV), facial/biometrics recognition, geolocation); direct marketing (direct marketing, telemarketing, as well as online behavioural targeting); Internet technologies & communications (web cookies, search engine marketing (SEM), Artificial Intelligence (AI), cloud computing, social networking services).
European Data Protection Law and Regulation
This objective covers from 42 to 69 exam questions. Here the students should demonstrate that they have a good understanding of data protection principles (personal data as well as sensitive personal data, anonymous & pseudonymous data, controller, processing, processor, data subject); territorial & material GDPR scope (establishment as well as non-establishment in the EU); data processing concepts (purpose limitation, fairness & lawfulness, storage limitation/retention, accuracy, proportionality, integrity & confidentiality); lawful processing criteria (contractual necessity, consent, legitimate interests, vital interests as well as public interest, legal obligation, special categories of processing); information provision obligations (privacy notices, transparency principle, layered notices).

Additionally, the examinees must prove that they are proficient in data subjects rights (rectification, access, restriction & objection erasure as well as the right to be forgotten, automated decision making, consent (and withdrawal of), etc.); personal data security (relevant organizational & technical measures, vendor management, breach notification, data sharing); accountability requirements (responsibility of processors & controllers, data protection by default as well as by design, data protection influence evaluation, documentation & cooperation with regulators, auditing of privacy programs, compulsory data protection officers).

Lastly, the subject also requires your understanding of international data transfers (safe jurisdictions, prohibition rationale, Binding Corporate Rules (BCRs), Safe Harbor & Privacy Shield, model contracts, derogations, codes of conduct &certifications); supervision & enforcement (supervisory authorities as well as their powers, role of the European Data Protection Supervisor (EDPS), the European Data Protection Board); consequences for GDPR violations (infringement & fines, data subject compensation, process & procedures).
Introduction to European Data Protection
The certification exam can have 4 to 10 questions on this topic. This domain encompasses one’s knowledge of origins and historical context of data protection law (including human rights laws, early laws & regulations, data protection rationale, the Treaty of Lisbon; the need for a harmonized European approach, a modernized framework). The candidates must also be familiar with the European Union institutions, such as the European Court of Human Rights, the Council of Europe, the European Parliament, the European Commission, the European Court of Justice European Council. Moreover, in order to answer the questions in this section, the test takers must know the legal framework. This includes their knowledge of the EU Data Protection Directive (95/46/EC), European data retention regimes, the EU Directive on Privacy and Electronic Communications (2002/58/EC), the General Data Protection Regulation (GDPR), etc.

The CIPP-E certification is particularly relevant for professionals who work with personal data and are responsible for ensuring compliance with the General Data Protection Regulation (GDPR). GDPR is a regulation that came into effect in May 2018 and is applicable to all organizations that process personal data of EU citizens, regardless of where the organization is located. The regulation has a significant impact on how personal data is collected, processed, stored, and secured, and failure to comply with GDPR can result in severe penalties.

Q68. SCENARIO
Please use the following to answer the next question:
Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located in Greece (5), Italy (15) and Spain (1), have registered their most profitable results ever. To celebrate this achievement, ARRA Hotels’ Human Resources office, based in ARRA’s main Italian establishment, has organized a team event for its 420 employees and their families at its hotel in Spain.
Upon arrival at the hotel, each employee and family member is given an electronic wristband at the reception desk. The wristband serves a number of functions:
. Allows access to the “party zone” of the hotel, and emits a buzz if the user approaches any unauthorized areas
. Allows up to three free drinks for each person of legal age, and emits a buzz once this limit has been reached
. Grants a unique ID number for participating in the games and contests that have been planned.
Along with the wristband, each guest receives a QR code that leads to the online privacy notice describing the use of the wristband. The page also contains an unchecked consent checkbox. In the case of employee family members under the age of 16, consent must be given by a parent.
Among the various activities planned for the event, ARRA Hotels’ HR office has autonomously set up a photocall area, separate from the main event venue, where employees can come and have their pictures taken in traditional carnival costume.
The photos will be posted on ARRA Hotels’ main website for general marketing purposes.
On the night of the event, an employee from one of ARRA’s Greek hotels is displeased with the results of the photos in which he appears. He intends to file a complaint with the relevant supervisory authority in regard to the following:
. The lack of any privacy notice in the separate photocall area
The unlawful cross-border processing of his personal data
. The unacceptable aesthetic outcome of his photos
Which of the following is NOT necessarily considered a factor in identifying whether the processing could be considered a “cross-border processing”?

The total number of the data subjects interested.

The potential harm for the data subjects affected.

The limitation of rights of the data subjects concerned.

The exposure of the information of the data subjects involved.

Q69. Under the GDPR, which essential pieces of information must be provided to data subjects before collecting their personal data?

The authority by which the controller is collecting the data and the third parties to whom the data will be sent.

The name/s of relevant government agencies involved and the steps needed for revising the data.

The identity and contact details of the controller and the reasons the data is being collected.

The contact information of the controller and a description of the retention policy.

Q70. SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores.
Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company’s revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children’s Questions: on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well. The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a QUESTION, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure’s integrated speakers, making it appear as though that the toy is actually responding to the child’s QUESTION. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures’ abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character’s abilities remain intact.
In light of the requirements of Article 32 of the GDPR (related to the Security of Processing), which practice should the company institute?

Encrypt the data in transit over the wireless Bluetooth connection.

Include dual-factor authentication before each use by a child in order to ensure a minimum amount of security.

Include three-factor authentication before each use by a child in order to ensure the best level of security possible.

Insert contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union.

According to Article 32 of the GDPR, the controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing personal data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The GDPR also provides some examples of such measures, including the pseudonymisation and encryption of personal data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, and a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
In this scenario, the company is processing personal data of children, such as their voice, questions, preferences, and location, through the connected toys that use a wireless Bluetooth connection to communicate with smartphones, tablets, cloud servers, and other toys. This poses a high risk to the security of the data, as Bluetooth is a short-range wireless technology that can be easily intercepted, hacked, or compromised by malicious actors. Therefore, the company should encrypt the data in transit over the Bluetooth connection, to prevent unauthorized access, disclosure, or alteration of the data. Encryption is a process of transforming data into an unreadable form, using a secret key or algorithm, that can only be reversed by authorized parties who have the corresponding key or algorithm. Encryption can protect the data from being accessed or modified by anyone who does not have the key or algorithm, thus ensuring the confidentiality and integrity of the data.
The other options are incorrect because:
* B. Including dual-factor authentication before each use by a child in order to ensure a minimum amount of security is not a sufficient measure to protect the data in transit over the Bluetooth connection. Dual- factor authentication is a process of verifying the identity of a user by requiring two pieces of evidence, such as a password and a code sent to a phone or email. While this may enhance the security of the user’ s account or device, it does not protect the data that is transmitted over the wireless connection, which can still be intercepted, hacked, or compromised by malicious actors. Moreover, dual-factor authentication may not be suitable or convenient for children, who may not have access to a phone or email, or who may forget their passwords or codes.
* C. Including three-factor authentication before each use by a child in order to ensure the best level of security possible is not a necessary or proportionate measure to protect the data in transit over the Bluetooth connection. Three-factor authentication is a process of verifying the identity of a user by requiring three pieces of evidence, such as a password, a code sent to a phone or email, and a biometric feature, such as a fingerprint or a face scan. While this may provide a high level of security for the user’ s account or device, it does not protect the data that is transmitted over the wireless connection, which can still be intercepted, hacked, or compromised by malicious actors. Furthermore, three-factor authentication may not be appropriate or feasible for children, who may not have access to a phone or email, or who may not have reliable biometric features, or who may find the process too complex or cumbersome.
* D. Inserting contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union, is not a relevant measure to protect the data in transit over the Bluetooth connection. Contractual clauses are legal agreements that specify the obligations and responsibilities of the parties involved in a data transfer, such as the level of data protection, the rights of data subjects, and the remedies for breaches. While contractual clauses may be necessary to ensure the compliance of the data transfer to South Africa, which is a non-EU country that does not have an adequacy decision from the European Commission, they do not address the security of the data that is transmitted over the wireless connection, which can still be intercepted, hacked, or compromised by malicious actors. Moreover, contractual clauses are not a technical or organisational measure, but a legal measure, that falls under a different provision of the GDPR, namely Article 46.
References: Article 32 and Recitals (75), (76), (78), (83), and (85) of the GDPR, Security of processing, Encryption, Authentication, [Contractual clauses]

Q71. What is the consequence if a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller?

The controller will be liable to pay an administrative fine

The processor will be liable to pay compensation to affected data subjects

The processor will be considered to be a controller in respect of the processing concerned

The controller will be required to demonstrate that the unauthorized processing negatively affected one or more of the parties involved

Q72. An online company’s privacy practices vary due to the fact that it offers a wide variety of services. How could it best address the concern that explaining them all would make the policies incomprehensible?

Use a layered privacy notice on its website and in its email communications.

Identify uses of data in a privacy notice mailed to the data subject.

Provide only general information about its processing activities and offer a toll-free number for more information.

Place a banner on its website stipulating that visitors agree to its privacy policy and terms of use by visiting the site.

Q73. What obligation does a data controller or processor have after appointing a data protection officer?

To ensure that the data protection officer receives sufficient instructions regarding the exercise of his or her defined tasks.

To provide resources necessary to carry out the defined tasks of the data protection officer and to maintain his or her expert knowledge.

To ensure that the data protection officer acts as the sole point of contact for individuals’ Questions: about their personal data.

To submit for approval to the data protection officer a code of conduct to govern organizational practices and demonstrate compliance with data protection principles.

Q74. Which judicial body makes decisions on actions taken by individuals wishing to enforce their rights under EU law?

Court of Auditors

Court of Justice of European Union

European Court of Human Rights

European Data Protection Board

Q75. As per the GDPR, which legal basis would be the most appropriate for an online shop that wishes to process personal data for the purpose of fraud prevention?

Protection of the interests of the data subjects.

Performance of a contact

Legitimate interest

Consent

According to the GDPR, legitimate interest is one of the possible legal bases for processing personal data, which means that the data controller has a valid reason to process the data that is not overridden by the interests or rights of the data subject1. The GDPR specifically mentions fraud prevention as a potential legitimate interest of the data controller, as it serves both the interests of the online shop and the data subjects who may be victims of fraud1. However, the data controller must conduct a balancing test to ensure that the legitimate interest is not outweighed by the potential harm or intrusion to the data subject’s privacy1. The data controller must also provide clear and transparent information to the data subject about the processing of their data for fraud prevention purposes, and respect their right to object to such processing1.
The other options are incorrect because:
A) Protection of the interests of the data subjects is not a legal basis for processing personal data, but rather a condition for processing special categories of personal data under Article 9 of the GDPR2. Moreover, fraud prevention does not necessarily protect the interests of the data subjects, but rather the interests of the online shop and the general public.
B) Performance of a contract is a legal basis for processing personal data that is necessary for the execution or fulfilment of a contract between the data controller and the data subject2. However, fraud prevention is not strictly necessary for the performance of a contract, as it is not directly related to the delivery of goods or services that the data subject has purchased from the online shop.
D) Consent is a legal basis for processing personal data that requires the data subject to give their informed, specific, and freely given agreement to the processing of their data for one or more purposes2. However, consent is not the most appropriate legal basis for fraud prevention, as it may not be freely given by the data subject, who may feel pressured to agree to the processing of their data in order to complete their purchase. Moreover, consent may not be reliable or effective for fraud prevention, as it can be withdrawn by the data subject at any time, or may be given by a fraudster who is not the legitimate owner of the data.

Q76. What should a controller do after a data subject opts out of a direct marketing activity?

Without exception, securely delete all personal data relating to the data subject.

Without undue delay, provide information to the data subject on the action that will be taken.

Refrain from processing personal data relating to the data subject for the relevant type of communication.

Take reasonable steps to inform third-party recipients that the data subject’s personal data should be deleted and no longer processed.

According to Article 21 of the GDPR, the data subject has the right to object at any time to the processing of his or her personal data for direct marketing purposes, which includes profiling related to such marketing. When the data subject exercises this right, the controller must stop processing the personal data for that purpose, unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. The controller must also inform the data subject of this right before the first communication with him or her, and in a clear and separate manner from other information. The controller must also provide the data subject with a simple and effective way to opt out of receiving direct marketing communications, such as an unsubscribe link or a STOP text message. The controller must respect the data subject’s choice and refrain from sending any further direct marketing messages of the relevant type (e.g., email, phone, post, etc.) to the data subject, unless he or she opts in again. The controller does not need to delete the personal data of the data subject who opts out, unless the data subject also requests the erasure of his or her data under Article 17 of the GDPR, or the data is no longer necessary for the purposes for which it was collected or processed. The controller may also retain some minimal information about the data subject (such as name and email address) to ensure that his or her opt-out request is honored and that he or she is not contacted again for direct marketing purposes. The controller must also ensure that any third parties to whom it has disclosed the personal data of the data subject for direct marketing purposes are informed of the opt-out request and comply with it, unless this proves impossible or involves disproportionate effort. Reference: Direct marketing rules and exceptions under the GDPR, Direct marketing and privacy and electronic communications, Marketing and advertising: the law: Direct marketing, Direct Marketing – What you need to know about direct marketing

Q77. SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
* Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
* Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
* Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees.
These records are available to former students after registering through Granchester’s Alumni portal.
* Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
* Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna’s data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level.
Mindful of Anna’s training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna’s tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Anna will find that a risk analysis is NOT necessary in this situation as long as?

The data subjects are no longer current students of Frank’s

The processing will not negatively affect the rights of the data subjects

The algorithms that Frank uses for the processing are technologically sound

The data subjects gave their unambiguous consent for the original processing

Q78. For which of the following operations would an employer most likely be justified in requesting the data subject’s consent?

Posting an employee’s bicycle race photo on the company’s social media.

Processing an employee’s health certificate in order to provide sick leave.

Operating a CCTV system on company premises.

Assessing a potential employee’s job application.

Q79. Under Article 30 of the GDPR, controllers are required to keep records of all of the following EXCEPT?

Incidents of personal data breaches, whether disclosed or not.

Data inventory or data mapping exercises that have been conducted.

Categories of recipients to whom the personal data have been disclosed.

Retention periods for erasure and deletion of categories of personal data.
Section: (none)
Explanation

Q80. Many businesses print their employees’ photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?

Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption.

Because photographs qualify as biometric data only when they undergo a “specific technical processing”.

Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer.

Because photographic ID is a physical security measure which is “necessary for reasons of substantial public interest”.

Q81. SCENARIO
Please use the following to answer the next question:
Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.
After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient’s name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissed Jack’s lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of “all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents. In relation to the emails Jack listed six members of the management team whose inboxes the required access.
How should the company respond to Jack’s request to be forgotten?

The company should ensure that the information is stored outside of the European Union so that the right to be forgotten under the GDPR does not apply.

The company should not erase the data at this time as it may be required to defend a legal claim of unfair dismissal.

The company should erase all data relating to Jack without undue delay as the right to be forgotten is an absolute right.

The company should claim that the right to be forgotten is not applicable to them, as only a fraction of their global workforce resides in the European Union.

Q82. According to Article 14 of the GDPR, how long does a controller have to provide a data subject with necessary privacy information, if that subject’s personal data has been obtained from other sources?

As soon as possible after obtaining the personal data.

As soon as possible after the first communication with the data subject.

Within a reasonable period after obtaining the personal data, but no later than one month.

Within a reasonable period after obtaining the personal data, but no later than eight weeks.

Q83. Which of the following does NOT have to be included in the records most processors must maintain in relation to their data processing activities?

Name and contact details of each controller on behalf of which the processor is acting.

Categories of processing carried out on behalf of each controller for which the processor is acting.

Details of transfers of personal data to a third country carried out on behalf of each controller for which the processor is acting.

Details of any data protection impact assessment conducted in relation to any processing activities carried out by the processor on behalf of each controller for which the processor is acting.

According to the GDPR, processors must maintain records of all categories of processing activities carried out on behalf of each controller, containing the following information12:
the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller’s or the processor’s representative, and the data protection officer; the categories of processing carried out on behalf of each controller; where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; where possible, a general description of the technical and organisational security measures referred to in Article 32(1).
The records must be in writing, including in electronic form, and must be made available to the supervisory authority on request. The obligation to maintain records does not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data or personal data relating to criminal convictions and offences.
The GDPR does not require processors to include details of any data protection impact assessment (DPIA) conducted in relation to any processing activities carried out by the processor on behalf of each controller for which the processor is acting. A DPIA is a process to help identify and minimise the data protection risks of a project. It is the responsibility of the controller to carry out a DPIA where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons. The processor may assist the controller in carrying out the DPIA, but the processor does not have to document it in its records of processing activities. Therefore, the correct answer is D. Reference:
GDPR, Article 30(2)
GDPR, Article 35
ICO, Documentation1
ICO, Data protection impact assessments1

Q84. Under what circumstances would the GDPR apply to personal data that exists in physical form, such as information contained in notebooks or hard copy files?

Only where the personal data is produced as a physical output of specific automated processing activities, such as printing, labelling, or stamping.

Only where the personal data is to be subjected to specific computerized processing, such as image scanning or optical character recognition.

Only where the personal data is treated by automated means in some way, such as computerized distribution or filing.

Only where the personal data is handled in a sufficiently structured manner so as to form part of a filing system.

Q85. SCENARIO
Please use the following to answer the next question:
Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA.
Today, it is a multi-billion-dollar candy company operating in every continent. All of the company’s IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father’s company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.
Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company’s online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers’ philosophical beliefs, political opinions and marital status.
If a customer identifies as single, Ben then copies all of that customer’s personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.
Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.
Joe also hires his best friend’s daughter, Alice, who just graduated from law school in the U.S., to be the company’s new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company’s operations in the European Union to the U.S.
Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company’s IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone’s information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.
Ben’s collection of additional data from customers created several potential issues for the company, which would most likely require what?

New corporate governance and code of conduct.

A data protection impact assessment.

A comprehensive data inventory.

Hiring a data protection officer.

Q86. Which sentence BEST summarizes the concepts of “fairness,” “lawfulness” and “transparency”, as expressly required by Article 5 of the GDPR?

Fairness and transparency refer to the communication of key information before collecting data; lawfulness refers to compliance with government regulations.

Fairness refers to limiting the amount of data collected from individuals; lawfulness refers to the approval of company guidelines by the state; transparency solely relates to communication of key information before collecting data.

Fairness refers to the security of personal data; lawfulness and transparency refers to the analysis of ordinances to ensure they are uniformly enforced.

Fairness refers to the collection of data from diverse subjects; lawfulness refers to the need for legal rules to be uniform; transparency refers to giving individuals access to their data.

Q87. Company X has entrusted the processing of their payroll data to Provider Y. Provider Y stores this encrypted data on its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?

The public

Company X

Law enforcement

The supervisory authority

Q88. SCENARIO
Please use the following to answer the next question:
TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company’s outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.’s foundering business.
During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations. TripBliss Inc. can choose any number of data categories – age, income, ethnicity – that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website’s traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website’s effectiveness. Oliver enthusiastically engages Techiva for these services.
Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.’s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva’s system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company’s system of access control must be reconsidered.
With regard to TripBliss Inc.’s use of website cookies, which of the following statements is correct?

Because not all of the cookies are strictly necessary to enable the use of a service requested from TripBliss Inc., consent requirements apply to their use of cookies.

Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers.

Because Techiva will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary.

Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.

According to the ePrivacy Directive (2002/58/EC), the use of cookies or similar devices that store or access information on the user’s device requires the user’s consent, unless the cookie is strictly necessary to enable the use of a service requested by the user. For example, a cookie that remembers the items in a shopping cart does not require consent, but a cookie that tracks the user’s browsing behavior for analytics or advertising purposes does. The consent must be freely given, specific, informed, and unambiguous, and can be obtained through appropriate settings of the browser or other application. The consent must also be separate from other consents, such as the consent to the processing of personal data. The categories of data involved or the recipients of the data do not affect the consent requirement for the use of cookies. The consent must also be obtained before the cookie is placed or accessed, unless the cookie is exempted. Therefore, option A is correct.
Option B is incorrect because explicit consent is not required for the use of cookies, unless the cookie also involves the processing of special categories of personal data under the GDPR. However, in this scenario, there is no indication that the cookies collect or process such data. Therefore, option B is incorrect.
Option C is incorrect because the consent requirement for the use of cookies does not depend on the recipients of the data or the level of aggregation of the data. The consent must be obtained from the user whose device is accessed or stored by the cookie, regardless of who receives the data or how it is processed. Therefore, option C is incorrect.
Option D is incorrect because the consent requirement for the use of cookies does not depend on the potential for location tracking. The consent must be obtained for any cookie that is not strictly necessary to enable the use of a service requested by the user, regardless of the type or purpose of the cookie. Therefore, option D is incorrect.
Reference:
ePrivacy Directive, Article 5(3)
GDPR, Article 4(11), Article 7, Article 9
CIPP/E Study Guide, Chapter 5, Section 5.2.2

Q89. Assuming that the “without undue delay” provision is followed, what is the time limit for complying with a data access request?

Within 40 days of receipt

Within 40 days of receipt, which may be extended by up to 40 additional days

Within one month of receipt, which may be extended by up to an additional month

Within one month of receipt, which may be extended by an additional two months

Q90. What is true if an employee makes an access request to his employer for any personal data held about him?

The employer can automatically decline the request if it contains personal data about a third person.

The employer can decline the request if the information is only held electronically.

The employer must supply all the information held about the employee.

The employer must supply any information held about an employee unless an exemption applies.

IAPP CIPP-E (Certified Information Privacy Professional/Europe) exam is a certification program designed to test an individual’s knowledge on data privacy laws and regulations in the European Union (EU). Certified Information Privacy Professional/Europe (CIPP/E) certification is internationally recognized and is highly valued by employers in the EU and beyond. The CIPP-E exam is administered by the International Association of Privacy Professionals (IAPP), a leading organization in the field of privacy and data protection.

Test Engine to Practice CIPP-E Test Questions: https://www.examcost.com/CIPP-E-practice-exam.html