[2021] Free CIPP-E Exam Dumps to Pass Exam Easily
CIPP-E Exam Dumps, CIPP-E Practice Test Questions
NEW QUESTION 66
SCENARIO
Please use the following to answer the next question:
TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business.
During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations. TripBliss Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services.
Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered.
With regard to TripBliss Inc.'s use of website cookies, which of the following statements is correct?
- A. Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.
- B. Because Techiva will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary.
- C. Because not all of the cookies are strictly necessary to enable the use of a service requested from TripBliss Inc., consent requirements apply to their use of cookies.
- D. Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers.
Answer: D
NEW QUESTION 67
A company is hesitating between Binding Corporate Rules and Standard Contractual Clauses as a global data transfer solution. Which of the following statements would help the company make an effective decision?
- A. Binding Corporate Rules are especially recommended for small and medium companies.
- B. The company will need the prior authorization of all EU data protection authorities for concluding Standard Contractual Clauses.
- C. The data exporter does not need to be located in the EU for the standard Contractual Clauses.
- D. Binding Corporate Rules provide a global solution for all the entities of a company that are bound by the intra-group agreement.
Answer: D
NEW QUESTION 68
- A. She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required.
Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.
Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company - B. Requesting advice and technical support from Company A's IT team.
- C. Hiring companies whose measures are consistent with recommendations of accrediting bodies.
- D. Avoiding the use of another company's data to improve their own services.
- E. This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.
Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees.
The GDPR requires sufficient guarantees of a company's ability to implement adequate technical and organizational measures. What would be the most realistic way that Company B could have fulfilled this requirement? - F. Vetting companies' measures with the appropriate supervisory authority.
Answer: A,C
Explanation:
Explanation/Reference: https://www.knowyourcompliance.com/gdpr-technical-organisational-measures/
NEW QUESTION 69
SCENARIO
Please use the following to answer the next question:
Liem, an online retailer known for its environmentally friendly shoes, has recently expanded its presence in Europe. Anxious to achieve market dominance, Liem teamed up with another eco friendly company, EcoMick, which sells accessories like belts and bags. Together the companies drew up a series of marketing campaigns designed to highlight the environmental and economic benefits of their products. After months of planning, Liem and EcoMick entered into a data sharing agreement to use the same marketing database, MarketIQ, to send the campaigns to their respective contacts.
Liem and EcoMick also entered into a data processing agreement with MarketIQ, the terms of which included processing personal data only upon Liem and EcoMick's instructions, and making available to them all information necessary to demonstrate compliance with GDPR obligations.
Liem and EcoMick then procured the services of a company called JaphSoft, a marketing optimization firm that uses machine learning to help companies run successful campaigns. Clients provide JaphSoft with the personal data of individuals they would like to be targeted in each campaign. To ensure protection of its clients' data, JaphSoft implements the technical and organizational measures it deems appropriate. JaphSoft works to continually improve its machine learning models by analyzing the data it receives from its clients to determine the most successful components of a successful campaign. JaphSoft then uses such models in providing services to its client-base. Since the models improve only over a period of time as more information is collected, JaphSoft does not have a deletion process for the data it receives from clients. However, to ensure compliance with data privacy rules, JaphSoft pseudonymizes the personal data by removing identifying information from the contact information. JaphSoft's engineers, however, maintain all contact information in the same database as the identifying information.
Under its agreement with Liem and EcoMick, JaphSoft received access to MarketIQ, which included contact information as well as prior purchase history for such contacts, to create campaigns that would result in the most views of the two companies' websites. A prior Liem customer, Ms. Iman, received a marketing campaign from JaphSoft regarding Liem's as well as EcoMick's latest products. While Ms. Iman recalls checking a box to receive information in the future regarding Liem's products, she has never shopped EcoMick, nor provided her personal data to that company.
For what reason would JaphSoft be considered a controller under the GDPR?
- A. It uses personal data to improve its products and services for its client-base through machine learning.
- B. It determines how long to retain the personal data collected.
- C. It has been provided access to personal data in the MarketIQ database.
- D. It makes decisions regarding the technical and organizational measures necessary to protect the personal data.
Answer: D
NEW QUESTION 70
Assuming that the "without undue delay" provision is followed, what is the time limit for complying with a data access request?
- A. Within 40 days of receipt, which may be extended by up to 40 additional days
- B. Within one month of receipt, which may be extended by an additional two months
- C. Within one month of receipt, which may be extended by up to an additional month
- D. Within 40 days of receipt
Answer: C
NEW QUESTION 71
The European Parliament jointly exercises legislative and budgetary functions with which of the following?
- A. The European Data Protection Board.
- B. The European Commission.
- C. The Article 29 Working Party.
- D. The Council of the European Union.
Answer: D
NEW QUESTION 72
SCENARIO
Please use the following to answer the next question:
Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA.
Today, it is a multi-billion-dollar candy company operating in every continent. All of the company's IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father's company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.
Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company's online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers' philosophical beliefs, political opinions and marital status.
If a customer identifies as single, Ben then copies all of that customer's personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.
Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.
Joe also hires his best friend's daughter, Alice, who just graduated from law school in the U.S., to be the company's new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company's operations in the European Union to the U.S.
Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company's IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone's information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.
In preparing the company for its impending lawsuit, Alice's instruction to the company's IT Department violated Article 5 of the GDPR because the company failed to first do what?
- A. Send out consent forms to all of its employees.
- B. Encrypt the data from all of its employees.
- C. Inform all of its employees about the lawsuit.
- D. Minimize the amount of data collected for the lawsuit.
Answer: D
NEW QUESTION 73
Which of the following countries will continue to enjoy adequacy status under the GDPR, pending any future European Commission decision to the contrary?
- A. Norway
- B. Australia
- C. Switzerland
- D. Greece
Answer: C
NEW QUESTION 74
An unforeseen power outage results in company Z's lack of access to customer data for six hours. According to article 32 of the GDPR, this is considered a breach. Based on the WP 29's February, 2018 guidance, company Z should do which of the following?
- A. Conduct a thorough audit of all security systems
- B. Notify the supervisory authority about the loss of availability
- C. Notify affected individuals that their data was unavailable for a period of time.
- D. Document the loss of availability to demonstrate accountability
Answer: B
NEW QUESTION 75
Article 9 of the GDPR lists exceptions to the general prohibition against processing biometric dat a. Which of the following is NOT one of these exceptions?
- A. The processing is necessary for the establishment, exercise or defense of legal claims when courts are acting in a judicial capacity.
- B. The processing is done by a non-profit organization and the results are disclosed outside the organization.
- C. The processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.
- D. The processing is explicitly consented to by the data subject and he or she is allowed by Union or Member State law to lift the prohibition.
Answer: B
NEW QUESTION 76
According to the GDPR, how is pseudonymous personal data defined?
- A. Data that has been encrypted or is subject to other technical safeguards.
- B. Data that can no longer be attributed to a specific data subject without the use of additional information kept separately.
- C. Data that can no longer be attributed to a specific data subject, with no possibility of re-identifying the data.
- D. Data that has been rendered anonymous in such a manner that the data subject is no longer identifiable.
Answer: B
NEW QUESTION 77
When would a data subject NOT be able to exercise the right to portability?
- A. When the processing is carried out pursuant to a contract with the data subject.
- B. When the processing is based on consent.
- C. When the processing is necessary to perform a task in the exercise of authority vested in the controller.
- D. When the data was supplied to the controller by the data subject.
Answer: C
NEW QUESTION 78
Under what circumstances might the "soft opt-in" rule apply in relation to direct marketing?
- A. When an individual has not consented to the marketing.
- B. Where an individual's details have been obtained from a bought-in marketing list.
- C. Where an individual is given the ability to unsubscribe from marketing emails sent to him.
- D. When an individual's details are obtained from their inquiries about buying a product.
Answer: C
NEW QUESTION 79
What is the key difference between the European Council and the Council of the European Union?
- A. The European Council is comprised of the heads of each EU member state.
- B. The Council of the European Union is helmed by a president.
- C. The Council of the European Union has a degree of legislative power.
- D. The European Council focuses primarily on issues involving human rights.
Answer: A
Explanation:
Section: (none)
Explanation
NEW QUESTION 80
How is the GDPR's position on consent MOST likely to affect future app design and implementation?
- A. App developers' responsibilities as data controllers will increase.
- B. Users will see fewer advertisements when using apps.
- C. Users will be given granular types of consent for particular types of processing.
- D. App developers will expand the amount of data necessary to collect for an app's functionality.
Answer: C
NEW QUESTION 81
Which of the following was the first to implement national law for data protection in 1973?
- A. Sweden
- B. Germany
- C. United Kingdom
- D. France
Answer: A
NEW QUESTION 82
......
How much IAPP CIPP/E Exam Cost
- The price of the IAPP CIPP/E Exam is $550.
CIPP-E Exam Dumps, CIPP-E Practice Test Questions: https://www.lead1pass.com/IAPP/CIPP-E-practice-exam-dumps.html
Free CIPP-E Study Guides Exam Questions & Answer: https://drive.google.com/open?id=1zOj0NAuLewAz_t2PN-UBEIw5aAPPr5Yu