IAPP Certified Information Privacy Professional/Europe CIPP-E Exam Practice Test

Answer : A

According to Article 32 of the GDPR, the controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing1. The GDPR does not prescribe specific security measures, but rather provides a list of factors to consider when determining the appropriate level of security, such as:

The state of the art and the costs of implementation;

The nature, scope, context and purposes of processing;

The risk of varying likelihood and severity for the rights and freedoms of natural persons.

Therefore, the level of security required by the GDPR is not absolute, but relative to the specific circumstances of each processing activity.The GDPR also encourages the use of codes of conduct and certification mechanisms to demonstrate compliance with the security requirements1.

In the scenario, Natural Insight is a processor who receives customer information from BHealthy, a controller, for the purpose of providing pricing services. Natural Insight has a contractual obligation to implement technical and organisational measures to ensure the security of the data, as well as to comply with the GDPR. Natural Insight's security obligations are not limited to the measures assessed by BHealthy prior to entering into the contract, nor to the level of security that a reasonable data subject would expect. Rather, Natural Insight must take into account the industry practices for protecting customer contact information and purchase history, as well as the potential risks that may arise from the processing, such as data breaches, identity theft, fraud, or discrimination. Natural Insight must also keep up with the state of the art and the costs of implementation, and adjust its security measures accordingly.

4: Art. 32 GDPR Security of processing

Answer : B

ccording to the GDPR, the regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not1.The GDPR also applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union1.

In this scenario, a U.S. company's website sells widgets to customers in the EU and places cookies to monitor their behavior.These factors would subject the company to the GDPR, as they indicate that the company is offering goods or services and monitoring the behavior of data subjects in the Union2.However, the fact that the website is in English and French, and is accessible in France, would not in itself subject the company to the GDPR, as these factors do not necessarily imply an intention to target customers in the Union3.The language and accessibility of the website are not sufficient to establish a relevant and sufficient degree of stability and continuity of the company's activities in the Union3. Therefore, the correct answer is B.

Art. 3 GDPR -- Territorial scope

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

What does territorial scope mean under the GDPR?

I hope this helps you understand the GDPR and territorial scope better. If you have any other questions, please feel free to ask me.

Answer : C

The right of access is one of the fundamental rights of data subjects under the GDPR. It allows data subjects to obtain from the controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and certain information about the processing. The controller must provide a copy of the personal data undergoing processing to the data subject, unless the data subject requests otherwise. The right of access is not absolute and may be subject to limitations, restrictions or exceptions, in accordance with the GDPR and the national laws of the member states.

The EDPB has issued draft guidelines on the right of access, which provide more detailed guidance on how to handle data subject access requests and what are the possible grounds for refusing to provide a copy of the personal data. According to the draft guidelines, the controller can refuse to provide a copy of the personal data in the following situations:

If the data subject access request was sent to an employee that is not involved in the processing of such requests. In this case, the controller must inform the data subject of the appropriate contact point for submitting the request and must not consider the request as received until it reaches the designated person or unit. This does not mean that the controller can ignore or delay the request, but rather that the controller must ensure that the request is forwarded to the responsible person or unit as soon as possible.

If there is such a large amount of data that the controller cannot identify the data subject of the request. In this case, the controller can ask the data subject to provide additional information to enable the identification of the data subject, such as a unique identifier, a reference number, a specific time period, a location or a context of the processing. The controller must not ask for more information than is necessary and must not use the information for any other purpose than verifying the identity of the data subject.

If the personal data was processed in the past but is no longer at the controller's disposal at the time of the request. In this case, the controller must inform the data subject that the personal data are no longer available and explain the reasons why the personal data have been erased, anonymised, archived or otherwise disposed of. The controller must also provide the data subject with any relevant information about the retention period, the archiving policy, the anonymisation process or the disposal method of the personal data.

The controller cannot refuse to provide a copy of the personal data in the following situation:

If the controller is unable to use end-to-end encrypted emails for responding to such requests. In this case, the controller must still provide a copy of the personal data to the data subject, but must ensure that the communication is secure and that the personal data are protected from unauthorised or unlawful access, disclosure, alteration or destruction. The controller can use alternative means of communication, such as secure online platforms, password-protected files, encrypted devices or postal mail, depending on the preferences and circumstances of the data subject. The controller must also inform the data subject of the risks involved in the chosen communication method and obtain the data subject's consent before sending the personal data.

GDPR, Articles 12, 13, 14, 15, 23 and 34.

EDPB Guidelines 01/2022 on data subject rights - Right of access Version 2, pages 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 and 16.

Answer : D

The ''one-stop-shop'' mechanism of the GDPR is a system of co-operation and consistency procedures that aims to ensure that the data protection regulation is enforced uniformly across all member states and calls on the data protection authorities (DPAs) across member states to co-operate with each other and the Commission to ensure consistent application of the GDPR1.The ''one-stop-shop'' mechanism applies to organisations that conduct cross-border data processing, which means that they process personal data in the context of the activities of their establishments in more than one member state, or that they target or monitor data subjects in more than one member state1.Under the ''one-stop-shop'' mechanism, such organisations will have to deal primarily with the DPA of the member state where they have their main establishment or their single establishment in the EU, which will act as their lead supervisory authority for all matters related to their cross-border data processing1.The lead supervisory authority will co-ordinate with other concerned supervisory authorities, which are the DPAs of the member states where the data subjects are affected by the data processing1.The lead supervisory authority will have the competence to adopt binding decisions regarding measures to ensure compliance with the GDPR, such as imposing administrative fines or ordering the suspension of data flows1.However, the ''one-stop-shop'' mechanism does not prevent the concerned supervisory authorities from acting against organisations in exceptional cases, even if they do not have any type of establishment in the member state of the respective authority1.These exceptional cases include the following situations2:

When a complaint is lodged with a supervisory authority, the subject matter relates only to an establishment in its member state or substantially affects data subjects only in its member state;

When a supervisory authority is addressing a possible infringement related to the offering of goods or services to data subjects in its member state or to the monitoring of their behaviour in its member state;

When a supervisory authority adopts provisional measures intended to produce legal effects in its own member state;

When an urgent need to act arises in order to protect the rights and freedoms of data subjects. In these cases, the concerned supervisory authority will inform the lead supervisory authority and the other concerned supervisory authorities, and will try to reach a consensus on the action to be taken2.If no consensus is reached, the consistency mechanism will apply, which involves the intervention of the European Data Protection Board (EDPB) to issue a binding decision on the matter2. Therefore, option D is the correct answer.Reference:Art. 60 GDPR -- Cooperation between the lead supervisory authority and the other supervisory authorities concerned,Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Answer : D

The European model for data protection is best described as comprehensive, because it covers all sectors and types of data processing, and applies to any organization that targets or collects data related to people in the EU. The GDPR is the main legal instrument of this model, and it establishes a set of principles, rights, and obligations for data protection, as well as a harmonized framework for enforcement and cooperation among EU member states and data protection authorities. The GDPR also aims to ensure consistency with other EU laws and policies, such as the ePrivacy Directive, the Charter of Fundamental Rights, and the European Data Strategy. The European model for data protection is based on the recognition of data protection as a fundamental right and a public interest, and it reflects the EU's values and objectives of promoting human dignity, democracy, and the rule of law.Reference:

Data protection in the EU, section ''Legislation''

What is GDPR, the EU's new data protection law?, section ''What is the GDPR?''

European Data Protection, Third Edition, page 1, section ''Introduction''

European Data Protection: Law and Practice, page 1, section ''Introduction''

Answer : C

The GDPR applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the EU, regardless of whether the processing takes place in the EU or not.The GDPR also applies to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities are related to the offering of goods or services to such data subjects in the EU or the monitoring of their behaviour as far as their behaviour takes place within the EU1.Therefore, after leaving the EU under the terms of Brexit, the UK became a third country for the purposes of the GDPR, meaning that personal data transfers from the EU to the UK are subject to the rules on international data transfers under Chapter V of the GDPR2.In order to ensure the continuity and stability of data flows between the EU and the UK, the UK sought an adequacy decision from the European Commission, which is a formal recognition that a third country provides an equivalent level of data protection to that of the EU3.On 28 June 2021, the European Commission adopted two adequacy decisions in respect of the UK: one for transfers under the GDPR and the other for transfers under the Law Enforcement Directive (LED)4.These decisions allow personal data to flow freely from the EU to the UK without any further safeguard being necessary, and are expected to last until 27 June 2025, unless they are amended, suspended or repealed earlier5.Reference:

GDPR, Article 3

GDPR, Chapter V

Data protection adequacy for non-EU countries, section ''Adequacy decisions''

UK government welcomes the European Commission's draft data adequacy decisions

Adequacy, section ''What does the EU GDPR adequacy decision say?''

Answer : D

According to the GDPR, consent is one of the six lawful bases for processing personal data. Consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Consent can be withdrawn at any time, and the withdrawal of consent must be as easy as giving it. Therefore, an individual can withdraw her consent for processing when she no longer wishes to be sent marketing materials from an organization, as this is a clear indication of her wishes and does not affect the lawfulness of the processing based on consent before its withdrawal. The other situations are not related to consent, but to other lawful bases such as contract, legitimate interest or legal obligation.Reference:Free CIPP/E Study Guide, page 9;CIPP/E Certification, page 3; GDPR, Article 4(11), Article 6(1)(a), Article 7(3).