IAPP CIPP-E Exam Questions Instant Access

Question 1

Which of the following is an accurate statement regarding the "one-stop-shop" mechanism of the GDPR?

AIt can result in several lead supervisory authorities in the EU assuming competence over the same data processing activities of an organization.

BIt applies only to direct enforcement of data protection supervisory authorities (e.g.. finding a breach), but not to initiating or engaging m court proceedings

CIt gives competence to the lead supervisory authority to address privacy issues derived from processes carried out by public authorities established in different countries.

DIt allows supervisory authorities concerned (other than the lead supervisory authority) to act against organizations m exceptional cases even if they do not have any type of establishment in the Member State of the respective authority.

Answer : D

The ''one-stop-shop'' mechanism of the GDPR is a system of co-operation and consistency procedures that aims to ensure that the data protection regulation is enforced uniformly across all member states and calls on the data protection authorities (DPAs) across member states to co-operate with each other and the Commission to ensure consistent application of the GDPR1.The ''one-stop-shop'' mechanism applies to organisations that conduct cross-border data processing, which means that they process personal data in the context of the activities of their establishments in more than one member state, or that they target or monitor data subjects in more than one member state1.Under the ''one-stop-shop'' mechanism, such organisations will have to deal primarily with the DPA of the member state where they have their main establishment or their single establishment in the EU, which will act as their lead supervisory authority for all matters related to their cross-border data processing1.The lead supervisory authority will co-ordinate with other concerned supervisory authorities, which are the DPAs of the member states where the data subjects are affected by the data processing1.The lead supervisory authority will have the competence to adopt binding decisions regarding measures to ensure compliance with the GDPR, such as imposing administrative fines or ordering the suspension of data flows1.However, the ''one-stop-shop'' mechanism does not prevent the concerned supervisory authorities from acting against organisations in exceptional cases, even if they do not have any type of establishment in the member state of the respective authority1.These exceptional cases include the following situations2:

When a complaint is lodged with a supervisory authority, the subject matter relates only to an establishment in its member state or substantially affects data subjects only in its member state;

When a supervisory authority is addressing a possible infringement related to the offering of goods or services to data subjects in its member state or to the monitoring of their behaviour in its member state;

When a supervisory authority adopts provisional measures intended to produce legal effects in its own member state;

When an urgent need to act arises in order to protect the rights and freedoms of data subjects. In these cases, the concerned supervisory authority will inform the lead supervisory authority and the other concerned supervisory authorities, and will try to reach a consensus on the action to be taken2.If no consensus is reached, the consistency mechanism will apply, which involves the intervention of the European Data Protection Board (EDPB) to issue a binding decision on the matter2. Therefore, option D is the correct answer.Reference:Art. 60 GDPR -- Cooperation between the lead supervisory authority and the other supervisory authorities concerned,Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Question 2

SCENARIO

Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a few months ago. Although no one was hurt, Louis has been plagued by texts and calls from a company called Accidentable offering to help him recover compensation for personal injury. Louis has heard about insurance companies selling customers' data to third parties, and he's convinced that Accidentable must have gotten his information from Bedrock Insurance.

Louis has also been receiving an increased amount of marketing information from Bedrock, trying to sell him their full range of their insurance policies.

Perturbed by this, Louis has started looking at price comparison sites on the internet and has been shocked to find that other insurers offer much cheaper rates than Bedrock, even though he has been a loyal customer for many years. When his Bedrock policy comes up for renewal, he decides to switch to Zantrum Insurance.

In order to activate his new insurance policy, Louis needs to supply Zantrum with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask Bedrock to transfer his information directly to Zantrum. He also takes this opportunity to ask Bedrock to stop using his personal data for marketing purposes.

Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Louis it cannot transfer his data directly to Zantrum as this is not technically feasible. Bedrock also explains that Louis's contract included a provision whereby Louis agreed that his data could be used for marketing purposes; according to Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which was filled with legal jargon and very confusing.

In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He writes to Accidentable to ask for the name of the organization that supplied his details to them. He warns Accidentable that he plans to complain to the data protection authority, because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.

Accidentable's response letter confirms Louis's suspicions. Accidentable is Bedrock Insurance's wholly owned subsidiary, and they received information about Louis's accident from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis that there has been no breach of the GDPR, as Louis's contract included, a provision in which he agreed to share his information with Bedrock's affiliates for business purposes.

Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them insisting that all his information be erased from their computer system.

Based on the GDPR's position on the use of personal data for direct marketing purposes, which of the following is true about Louis's rights as a data subject?

ALouis does not have the right to object to the use of his data because he previously consented to it.

BLouis has the right to object at any time to the use of his data and Bedrock must honor his request to cease use.

CLouis has the right to object to the use of his data, unless his data is required by Bedrock for the purpose
of exercising a legal claim.

DLouis does not have the right to object to the use of his data if Bedrock can demonstrate compelling legitimate grounds for the processing.

Answer : B

Louis has the right to object at any time to the use of his data and Bedrock must honor his request to cease use.

The GDPR states that ''where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing'' and that ''where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.''3

This right applies regardless of whether the data subject has previously consented to the use of his or her data, or whether the data are required for a legal claim or a legitimate interest.The data subject must be informed of this right clearly and separately from any other information at the time of the first communication with him or her, and must be provided with an easy way to exercise it.2

Therefore, Louis can object to the use of his data by Bedrock and Accidentable for direct marketing purposes, and they must stop processing his data for such purposes as soon as they receive his objection.Louis can also withdraw his consent for any other processing of his data that he has previously agreed to, such as sharing his data with Bedrock's affiliates.4

Question 3

According to the Personal Data Protection Commission's (PDPC) "Guide to basic data anonymization techniques," recently adopted by the Spanish

Data Protection Agency, which of the following is NOT a valid basic anonymization technique?

ASwapping.

BGeneralization.

CData Adjustment.

DAttribute Suppression.

Answer : C

Data adjustment is not a valid basic anonymization technique according to the PDPC's guide12.Data adjustment refers to the modification of the original data values by adding or subtracting a random amount, or multiplying or dividing by a random factor3.This technique may preserve some statistical properties of the data, but it also introduces errors and inaccuracies that may affect the utility and quality of the data3.Moreover, data adjustment may not sufficiently protect the identity of individuals, as the adjusted data may still be linked or matched with other data sources3. Therefore, data adjustment is not recommended by the PDPC as a basic anonymization technique.

1: GUIDE TO BASIC DATA ANONYMISATION TECHNIQUES Published 25 January 2018 - PDPC2: GUIDE TO BASIC ANONYMISATION - PDPC3: Guide to basic anonymisation and free tool from PDPC

Question 4

What term BEST describes the European model for data protection?

ASectoral

BSelf-regulatory

CMarket-based

DComprehensive

Answer : D

The European model for data protection is best described as comprehensive, because it covers all sectors and types of data processing, and applies to any organization that targets or collects data related to people in the EU. The GDPR is the main legal instrument of this model, and it establishes a set of principles, rights, and obligations for data protection, as well as a harmonized framework for enforcement and cooperation among EU member states and data protection authorities. The GDPR also aims to ensure consistency with other EU laws and policies, such as the ePrivacy Directive, the Charter of Fundamental Rights, and the European Data Strategy. The European model for data protection is based on the recognition of data protection as a fundamental right and a public interest, and it reflects the EU's values and objectives of promoting human dignity, democracy, and the rule of law.Reference:

Data protection in the EU, section ''Legislation''

What is GDPR, the EU's new data protection law?, section ''What is the GDPR?''

European Data Protection, Third Edition, page 1, section ''Introduction''

European Data Protection: Law and Practice, page 1, section ''Introduction''

Question 5

Assuming that the ''without undue delay'' provision is followed, what is the time limit for complying with a data access request?

AWithin 40 days of receipt

BWithin 40 days of receipt, which may be extended by up to 40 additional days

CWithin one month of receipt, which may be extended by up to an additional month

DWithin one month of receipt, which may be extended by an additional two months

Answer : D

:According to the GDPR, data controllers must respond to a data access request (also known as a subject access request or SAR) without undue delay and in any event within one month of receipt of the request. This time limit can be extended by a further two months if the request is complex or if the controller receives a number of requests from the same individual. However, the controller must still inform the individual within one month of receipt of the request and explain why the extension is necessary. The time limit is calculated from the day after the request is received (whether it is a working day or not) until the corresponding calendar date in the next month. If there is no corresponding calendar date, the deadline is the last day of the next month. If the deadline falls on a weekend or public holiday, the response must be provided on the next working day.Reference:

GDPR, Article 12(3)

ICO, Right of access1

ICO, Time limits for responding to data protection rights requests2

Question 6

Company X has entrusted the processing of their payroll data to Provider Y. Provider Y stores this encrypted data on its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?

AThe public

BCompany X

CLaw enforcement

DThe supervisory authority

Answer : B

According to Article 33 of the GDPR, in the case of a personal data breach, the processor (Provider Y) shall notify the controller (Company X) without undue delay after becoming aware of the breach. The processor does not have the obligation to notify the supervisory authority, the public, or law enforcement, unless otherwise required by law. The controller is responsible for notifying the supervisory authority and, where necessary, the data subjects, unless the breach is unlikely to result in a risk to their rights and freedoms.Reference:

Article 33 of the GDPR, which regulates the notification of a personal data breach to the supervisory authority.

[Article 34 of the GDPR], which regulates the communication of a personal data breach to the data subject.

ICO guidance, which explains the roles and responsibilities of controllers and processors in relation to data breach notification.

Question 7

Articles 13 and 14 of the GDPR provide details on the obligation of data controllers to inform data subjects when collecting personal dat

a. However, both articles specify an exemption for situations in which the data subject already has the information.

Which other situation would also exempt the data controller from this obligation under Article 14?

AWhen providing the information would go against a police order.

BWhen providing the information would involve a disproportionate effort

CWhen the personal data was obtained through multiple source in the public domain

DWhen the personal data was obtained 5 years before the entry into force of the GDPR

Answer : B

According to Article 14 of the GDPR, the data controller must provide the data subject with certain information when collecting personal data from a source other than the data subject1.However, there are some exceptions to this obligation, such as when the data subject already has the information, or when the provision of such information proves impossible or would involve a disproportionate effort2.The latter exception may apply, for example, when the personal data are collected from a large number of sources, or when the personal data are processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes3.The data controller must take appropriate measures to protect the data subject's rights and interests, and make the information publicly available2.Reference:1: Art.14 GDPR -- Information to be provided where personal data have not been obtained from the data subject2: Article 14(5)(b) of the GDPR3: Recital 62 of the GDPR.

IAPP Certified Information Privacy Professional/Europe CIPP-E Exam Questions