[Sep 16, 2022] Today Updated CIPP-E Exam Dumps Actual Questions
CIPP-E exam dumps with real IAPP questions and answers
IAPP CIPP/E Exam Registration
In order to apply for the IAPP CIPP/E Exam, You have to follow these steps
Step 1: Visit the IAPP store Website
Step 2: Search for the CIPP/E Exam and purchase the exam by making payment using credit/debit card.
Step 3: Through Pearson VUE's scheduling platform, you will be able to choose a test center, time and date.
NEW QUESTION 36
Please use the following to answer the next question:
WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of their service, WonderKids will pass all personal data provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person booking the childcare, address and contact details, as well as information about the children to be cared for including name, age, gender and health information. The privacy statement on Wonderkids' website states the following:
"WonderkKids provides the information you disclose to us through this website to your childcare provider for scheduling and health and safety reasons. We may also use your and your child's personal information for our own legitimate business purposes and we employ a third-party website hosting company located in Switzerland to store the dat a. Any data stored on equipment located in Switzerland meets the European Commission provisions for guaranteeing adequate safeguards for you and your child's personal information. We will only share you and your child's personal information with businesses that we see as adding real value to you. By providing us with any personal data, you consent to its transfer to affiliated businesses and to send you promotional offers."
"We may retain you and your child's personal information for no more than 28 days, at which point the data will be depersonalized, unless your personal information is being used for a legitimate business purpose beyond 28 days where it may be retained for up to 2 years."
"We are processing you and your child's personal information with your consent. If you choose not to provide certain information to us, you may not be able to use our services. You have the right to: request access to you and your child's personal information; rectify or erase you or your child's personal information; the right to correction or erasure of you and/or your child's personal information; object to any processing of you and your child's personal information. You also have the right to complain to the supervisory authority about our data processing activities." What direct marketing information can WonderKids send by email without prior consent of the person booking the childcare?
- A. Marketing information for products or services similar to those purchased from WonderKids.
- B. No marketing information at all.
- C. Any marketing information at all.
- D. Marketing information related to other business operations of WonderKids.
Answer: D
NEW QUESTION 37
An organisation receives a request multiple times from a data subject seeking to exercise his rights with respect to his own personal dat a. Under what condition can the organisation charge the data subject for processing the request?
- A. Only if the organisation can demonstrate that the request is clearly excessive or misguided.
- B. Only to the extent this is allowed under the restrictions on data subjects' rights introduced under Art 23 of GDPR.
- C. Only where the administrative costs of taking the action requested exceeds a certain threshold.
- D. Only where the organisation can show that it is reasonable to do so because more than one request was made.
Answer: A
NEW QUESTION 38
Under the GDPR, which essential pieces of information must be provided to data subjects before collecting their personal data?
- A. The name/s of relevant government agencies involved and the steps needed for revising the data.
- B. The authority by which the controller is collecting the data and the third parties to whom the data will be sent.
- C. The identity and contact details of the controller and the reasons the data is being collected.
- D. The contact information of the controller and a description of the retention policy.
Answer: C
Explanation:
Explanation/Reference: https://gdpr-info.eu/art-13-gdpr/
NEW QUESTION 39
SCENARIO
Please use the following to answer the next question:
Javier is a member of the fitness club EVERFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Javier lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Javier was photographed while working out at a branch of EVERFIT in Frankfurt, Germany. At the time, Javier gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Javier no longer feels comfortable with his photograph being publicly associated with the fitness club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Javier sends a letter to EVETFIT requesting that his image be removed from the website and all promotional materials. Months pass and Javier, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact EVETFIT through alternate channels, he decides to take action against the company.
Javier contacts the U.K. Information Commissioner's Office ('ICO' - the U.K.'s supervisory authority) to lodge a complaint about this matter. The ICO, pursuant to Article 56 (3) of the GDPR, informs the CNIL (i.e. the supervisory authority of EVERFIT's main establishment) about this matter. Despite the fact that EVERFIT has an establishment in the U.K., the CNIL decides to handle the case in accordance with Article 60 of the GDPR.
The CNIL liaises with the ICO, as relevant under the cooperation procedure. In light of issues amongst the supervisory authorities to reach a decision, the European Data Protection Board becomes involved and, pursuant to the consistency mechanism, issues a binding decision.
Additionally, Javier sues EVERFIT for the damages caused as a result of its failure to honor his request to have his photograph removed from the brochure and website.
Assuming that multiple EVETFIT branches across several EU countries are acting as separate data controllers, and that each of those branches were responsible for mishandling Javier's request, how may Javier proceed in order to seek compensation?
- A. He will be able to apply to the European Data Protection Board in order to determine which particular EVETFIT branch is liable for damages, based on the decision that was made by the board.
- B. He will have to sue each EVETFIT branch so that each branch provides proportionate compensation commensurate with its contribution to the damage or distress suffered by Javier.
- C. He will be able to sue any one of the relevant EVETFIT branches, as each one may be held liable for the entire damage.
- D. He will have to sue the EVETFIT's head office in France, where EVETFIT has its main establishment.
Answer: D
NEW QUESTION 40
There are three domains of security covered by Article 32 of the GDPR that apply to both the controller and the processor. These include all of the following EXCEPT?
- A. Remedial security.
- B. Preventative security.
- C. Incident detection and response.
- D. Consent management and withdrawal.
Answer: D
NEW QUESTION 41
SCENARIO
Please use the following to answer the next question:
Jason, a long-time customer of ABC insurance, was involved in a minor car accident a few months ago.
Although no one was hurt, Jason has been plagued by texts and calls from a company called Erbium Insurance offering to help him recover compensation for personal injury. Jason has heard about insurance companies selling customers' data to third parties, and he's convinced that Erbium must have gotten his information from ABC.
Jason has also been receiving an increased amount of marketing information from ABC, trying to sell him their full range of their insurance policies.
Perturbed by this, Jason has started looking at price comparison sites on the Internet and has been shocked to find that other insurers offer much cheaper rates than ABC, even though he has been a loyal customer for many years. When his ABC policy comes up for renewal, he decides to switch to Xentron Insurance.
In order to activate his new insurance policy, Jason needs to supply Xentron with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask ABC to transfer his information directly to Xentron. He also takes this opportunity to ask ABC to stop using his personal data for marketing purposes.
ABC supplies Jason with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Jason it cannot transfer his data directly to Xentron at this is not technically feasible. ABC also explains that Jason's contract included a provision whereby Jason agreed that his data could be used for marketing purposes; according to ABC, it is too late for Jason to change his mind about this. It angers Jason when he recalls the wording of the contract, which was filled with legal jargon and very confusing.
In the meantime, Jason is still receiving unwanted calls from Erbium Insurance. He writes to Erbium to ask for the name of the organization that supplied his details to them. He warns Erbium that he plans to complain to the data protection authority because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.
Erbium's response letter confirms Jason's suspicions. Erbium is ABC's wholly owned subsidiary, and they received information about Jason's accident from ABC shortly after Jason submitted his accident claim.
Erbium assures Jason that there has been no breach of the GDPR, as Jason's contract included a provision in which he agreed to share his information with ABC's affiliates for business purposes.
Jason is disgusted by the way in which he has been treated by ABC, and writes to them insisting that all his information be erased from their computer system.
After Jason has exercised his right to restrict the use of his data, under what conditions would Erbium have grounds for refusing to comply?
- A. If Erbium also uses the data to conduct public health research.
- B. If Erbium is entitled to use of the data as an affiliate of ABC.
- C. If the accuracy of the data is not an aspect that Jason is disputing.
- D. If the data becomes necessary to defend Erbium's legal rights.
Answer: B
NEW QUESTION 42
A well-known video production company, based in Spain but specializing in documentaries filmed worldwide, has just finished recording several hours of footage featuring senior citizens in the streets of Madrid. Under what condition would the company NOT be required to obtain the consent of everyone whose image they use for their documentary?
- A. If the company's status as a documentary provider allows it to claim legitimate interest.
- B. If obtaining consent is deemed to involve disproportionate effort.
- C. If obtaining consent is deemed voluntary by local legislation.
- D. If the company limits the footage to data subjects solely of legal age.
Answer: C
Explanation:
Explanation
NEW QUESTION 43
Which of the following is NOT an explicit right granted to data subjects under the GDPR?
- A. The right to opt-out of the sale of their personal data to third parties.
- B. The right to request access to the personal data a controller holds about them.
- C. The right to request restriction of processing of personal data, under certain scenarios.
- D. The right to request the deletion of data a controller holds about them.
Answer: B
NEW QUESTION 44
What obligation does a data controller or processor have after appointing a data protection officer?
- A. To ensure that the data protection officer receives sufficient instructions regarding the exercise of his or her defined tasks.
- B. To ensure that the data protection officer acts as the sole point of contact for individuals' questions about their personal data.
- C. To submit for approval to the data protection officer a code of conduct to govern organizational practices and demonstrate compliance with data protection principles.
- D. To provide resources necessary to carry out the defined tasks of the data protection officer and to maintain his or her expert knowledge.
Answer: C
NEW QUESTION 45
Many businesses print their employees' photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?
- A. Because photographs qualify as biometric data only when they undergo a "specific technical processing".
- B. Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer.
- C. Because photographic ID is a physical security measure which is "necessary for reasons of substantial public interest".
- D. Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption.
Answer: A
Explanation:
Reference https://ess.csa.canon.com/rs/206-CLL-191/images/IAPP-Top-10-Operational-Impacts-of- GDPR.pdf?TC=DM&CN=CSA_OMNIA_Partners&CS=CSA&CR=T1_Gov%20GenNonProfit (11)
NEW QUESTION 46
Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3?
- A. Personal data of EU residents being processed by a non-EU business that targets EU customers.
- B. The behavior of EU citizens outside the EU being monitored by non-EU law enforcement bodies.
- C. Personal data of EU citizens being processed by a controller or processor based outside the EU.
- D. The behavior of suspected terrorists being monitored by EU law enforcement bodies.
Answer: C
NEW QUESTION 47
SCENARIO
Please use the following to answer the next question:
Zandelay Fashion ('Zandelay') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay's business plan and associated processing activities.
What would MOST effectively assist Zandelay in conducting their data protection impact assessment?
- A. Data breach documentation that data controllers are required to maintain.
- B. Records of processing activities that data controllers are required to maintain.
- C. Existing DPIA guides published by local supervisory authorities.
- D. Information about DPIAs found in Articles 38 through 40 of the GDPR.
Answer: D
NEW QUESTION 48
SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
What is the time period in which Mike should receive a response to his request?
- A. Not more than thirty days after submission of Mike's request.
- B. Not more than one month of receipt of Mike's request.
- C. Not more than two months after verifying Mike's identity.
- D. When all the information about Mike has been collected.
Answer: A
NEW QUESTION 49
SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester's Alumni portal. Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna's tasks is to complete the record of processing activities, as required by the GDPR.
After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Anna will find that a risk analysis is NOT necessary in this situation as long as?
- A. The data subjects are no longer current students of Frank's
- B. The data subjects gave their unambiguous consent for the original processing
- C. The algorithms that Frank uses for the processing are technologically sound
- D. The processing will not negatively affect the rights of the data subjects
Answer: B
NEW QUESTION 50
Under what circumstances would the GDPR apply to personal data that exists in physical form, such as information contained in notebooks or hard copy files?
- A. Only where the personal data is handled in a sufficiently structured manner so as to form part of a filing system.
- B. Only where the personal data is treated by automated means in some way, such as computerized distribution or filing.
- C. Only where the personal data is to be subjected to specific computerized processing, such as image scanning or optical character recognition.
- D. Only where the personal data is produced as a physical output of specific automated processing activities, such as printing, labelling, or stamping.
Answer: A
Explanation:
Explanation/Reference: https://www.zimmerslaw.com/english-1/data-protection/
NEW QUESTION 51
Company X has entrusted the processing of their payroll data to Provider Y.
Provider Y stores this encrypted data in its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?
- A. Law enforcement
- B. The public
- C. Company X
- D. The supervisory authority
Answer: A
NEW QUESTION 52
If a multi-national company wanted to conduct background checks on all current and potential employees, including those based in Europe, what key provision would the company have to follow?
- A. Background checks on employees could be performed only under prior notice to all employees.
- B. Background checks are only authorized with prior notice and express consent from all employees including those based in Europe.
- C. Background checks on European employees will stem from data protection and employment law, which can vary between member states.
- D. Background checks may not be allowed on European employees, but the company can create lists based on its legitimate interests, identifying individuals who are ineligible for employment.
Answer: C
NEW QUESTION 53
In which of the following situations would an individual most likely to be able to withdraw her consent for processing?
- A. When she is leaving her bank and moving to another bank.
- B. When she disagrees with a diagnosis her doctor has recorded on her records.
- C. When she no longer wishes to be sent marketing materials from an organization.
- D. When she has recently changed jobs and no longer works for the same company.
Answer: C
NEW QUESTION 54
......
Efficient Study Course
The vendor offers in-depth training for the CIPP-E exam in French, German as well as English, which is ‘Understand the GDPR and Regional European Data Protection Laws’. Both the European Union’s GDPR and some of the European countries' laws on data privacy are classified as the world’s strictest. Thus, the laws come with hefty fines for the poor handling of personal information. This course, in particular, gives the candidate an intensified look into comprehending and implementing, processing, and the management of data collection laws and is ideal for data protection officials in the European and international space. The scope of work for these professionals is under the GDPR and European national compliance contexts. Overall, this training is ideal for specialists getting the CIPP-E certification and covers different domains that are tested in the affiliated exam. They are as follows:
- The different law and regulation bodies.
- An extensive explanation of European regulatory frameworks;
- Different concepts in data protection;
- The GDPR laws as well as the ePrivacy Directive;
Conclusion
The IAPP CIPP-E exam will help a candidate stamp their knowledge of EU-US data protection laws and how well they can apply them in their practice. Data protection officials with this certification have an upper hand in the industry, and can even fit in international work environments. The study course as well as guides are very useful in helping the candidate pass their exams on the first try.
Exam Sure Pass IAPP Certification with CIPP-E exam questions: https://www.validexam.com/CIPP-E-latest-dumps.html
CIPP-E Exam in First Attempt Guaranteed: https://drive.google.com/open?id=1vMKrVU5iMJCMXzCI-VbSpXYN8i4w7Nah