Use CIPP-E Exam Dumps (2021 PDF Dumps) To Have Reliable CIPP-E Test Engine
CIPP-E PDF Recently Updated Questions Dumps to Improve Exam Score
You can read the IAPP CIPP/E Exam certified salary below
The Average Salary of an IAPP CIPP/E Exam in
- England - 94029 POUND
- United State - 122,750 USD
- Europe - 104162 EURO
- India - 9206648 INR
IAPP CIPP-E Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
NEW QUESTION 10
Under Article 30 of the GDPR, controllers are required to keep records of all of the following EXCEPT?
- A. Retention periods for erasure and deletion of categories of personal data.
Section: (none)
Explanation - B. Categories of recipients to whom the personal data have been disclosed.
- C. Data inventory or data mapping exercises that have been conducted.
- D. Incidents of personal data breaches, whether disclosed or not.
Answer: A
NEW QUESTION 11
Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?
- A. Carry out an exercise that weighs the interests of the controller and the basis for the data subject's objection.
- B. Demonstrate that the profiling is for the purposes of direct marketing.
- C. Consider the impact of the profiling on the data subject's interest, rights and freedoms.
- D. Consider the importance of the profiling to their particular objective.
Answer: B
Explanation:
Explanation/Reference: https://gdpr-info.eu/art-21-gdpr/
NEW QUESTION 12
Many businesses print their employees' photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?
- A. Because photographic ID is a physical security measure which is "necessary for reasons of substantial public interest".
- B. Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer.
- C. Because photographs qualify as biometric data only when they undergo a "specific technical processing".
- D. Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption.
Answer: C
Explanation:
Reference https://ess.csa.canon.com/rs/206-CLL-191/images/IAPP-Top-10-Operational-Impacts-of- GDPR.pdf?TC=DM&CN=CSA_OMNIA_Partners&CS=CSA&CR=T1_Gov%20GenNonProfit (11)
NEW QUESTION 13
Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article
3?
- A. Personal data of EU residents being processed by a non-EU business that targets EU customers.
- B. Personal data of EU citizens being processed by a controller or processor based outside the EU.
- C. The behavior of suspected terrorists being monitored by EU law enforcement bodies.
- D. The behavior of EU citizens outside the EU being monitored by non-EU law enforcement bodies.
Answer: B
Explanation:
Explanation/Reference: https://hsfnotes.com/data/2019/12/02/edpb-adopts-final-guidelines-on-gdpr-extra-territoriality/
NEW QUESTION 14
In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?
- A. Where the DPIA identifies high risks to individuals' rights and freedoms that the controller can take steps to reduce.
- B. Where the DPIA identifies that personal data needs to be transferred to other countries outside of the EEA.
- C. Where the DPIA identifies that the processing being proposed collects the sensitive data of EU citizens.
- D. Where the DPIA identifies risks that will require insurance for protecting its business interests.
Answer: A
NEW QUESTION 15
What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?
- A. ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.
- B. ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.
- C. CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.
- D. CJEU can force national governments to implement and honor EU law, while the ECHR cannot.
Answer: D
NEW QUESTION 16
Assuming that the "without undue delay" provision is followed, what is the time limit for complying with a data access request?
- A. Within 40 days of receipt, which may be extended by up to 40 additional days
- B. Within one month of receipt, which may be extended by an additional two months
- C. Within one month of receipt, which may be extended by up to an additional month
- D. Within 40 days of receipt
Answer: C
NEW QUESTION 17
Which sentence BEST summarizes the concepts of "fairness," "lawfulness" and "transparency", as expressly required by Article 5 of the GDPR?
- A. Fairness refers to the security of personal data; lawfulness and transparency refers to the analysis of ordinances to ensure they are uniformly enforced.
- B. Fairness refers to limiting the amount of data collected from individuals; lawfulness refers to the approval of company guidelines by the state; transparency solely relates to communication of key information before collecting data.
- C. Fairness refers to the collection of data from diverse subjects; lawfulness refers to the need for legal rules to be uniform; transparency refers to giving individuals access to their data.
- D. Fairness and transparency refer to the communication of key information before collecting data; lawfulness refers to compliance with government regulations.
Answer: D
Explanation:
Explanation
NEW QUESTION 18
SCENARIO
Please use the following to answer the next question:
Outliers Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Jonathan, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company ZenFiTech, hoping that they can design a new, cutting-edge website for Outliers Inc.'s foundering business.
During negotiations, a ZenFiTech representative describes a plan for gathering more customer information through detailed questionnaires, which could be used to tailor their preferences to specific travel destinations. Outliers Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Jonathan loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the questionnaires will require customers to provide explicit consent to having their data collected. The ZenFiTech representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the Outliers Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which ZenFiTech will analyze by means of a special program. Outliers Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Jonathan enthusiastically engages ZenFiTech for these services.
With regard to Outliers Inc.'s use of website cookies, which of the following statements is correct?
- A. Because ZenFiTech will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary.
- B. Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.
- C. Because not all of the cookies are strictly necessary to enable the use of a service requested from Outliers Inc., consent requirements apply to their use of cookies.
- D. Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers.
Answer: D
NEW QUESTION 19
According to Article 84 of the GDPR, the rules on penalties applicable to infringements shall be laid down by?
- A. The European Data Protection Board.
- B. The Member States.
- C. The EU Commission.
- D. The local Data Protection Supervisory Authorities.
Answer: B
NEW QUESTION 20
A data controller appoints a data protection officer. Which of the following conditions would NOT result in an infringement of Articles 37 to 39 of the GDPR?
- A. If the data protection officer is provided by the data processor.
- B. If the data protection officer also manages the marketing budget.
- C. If the data protection officer receives instructions from the data controller.
- D. If the data protection officer lacks ISO 27001 auditor certification.
Answer: C
NEW QUESTION 21
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's questions on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well. The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's question. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
In light of the requirements of Article 32 of the GDPR (related to the Security of Processing), which practice should the company institute?
- A. Include three-factor authentication before each use by a child in order to ensure the best level of security possible.
- B. Include dual-factor authentication before each use by a child in order to ensure a minimum amount of security.
- C. Insert contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union.
- D. Encrypt the data in transit over the wireless Bluetooth connection.
Answer: D
NEW QUESTION 22
What was the aim of the European Data Protection Directive 95/46/EC?
- A. To completely prevent the transfer of personal data out of the European Union.
- B. To implement the OECD Guidelines on the Protection of Privacy and trans-border flows of Personal Data.
- C. To harmonize the implementation of the European Convention of Human Rights across all member states.
- D. To further reconcile the protection of the fundamental rights of individuals with the free flow of data from one member state to another.
Answer: B
NEW QUESTION 23
Company X has entrusted the processing of their payroll data to Provider Y.
Provider Y stores this encrypted data on its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?
- A. Company X
- B. Law enforcement
- C. The public
- D. The supervisory authority
Answer: B
NEW QUESTION 24
How does the GDPR now define "processing"?
- A. Any use or disclosure of personal data compatible with the purpose for which the data was collected.
- B. Any act involving the collecting and recording of personal data.
- C. Any operation or set of operations performed on personal data or on sets of personal data.
- D. Any operation or set of operations performed by automated means on personal data or on sets of personal data.
Answer: B
Explanation:
Explanation/Reference: https://gdpr-info.eu/issues/processing/
NEW QUESTION 25
Which of the following is NOT considered a fair processing practice in relation to the transparency principle?
- A. Providing a "just-in-time" contextual pop-up privacy notice, in an online application from field.
- B. Providing a QR code linking to more detailed privacy notice, in a CCTV sign.
- C. Providing a hyperlink to the organization's home page, in a hard copy application form.
- D. Providing a multi-layered privacy notice, in a website environment.
Answer: D
NEW QUESTION 26
......
CIPP-E Dumps Full Questions with Free PDF Questions to Pass: https://www.validexam.com/CIPP-E-latest-dumps.html
Free Certified Information Privacy Professional CIPP-E Official Cert Guide PDF Download: https://drive.google.com/open?id=1mfsQm4KjD518LkMBoyp0k8WH7rMxvRe-