Authentic IAPP CIPP-E Exam Dumps PDF - 2023 Updated
Get Prepared for Your CIPP-E Exam With Actual 252 Questions
The CIPP-E certification exam is ideal for professionals who work with personal data in Europe or who have responsibilities for data protection compliance. CIPP-E exam covers a wide range of topics, including the legal and regulatory framework for data protection in Europe, data protection principles and practices, privacy program management, and data breach management. Certified Information Privacy Professional/Europe (CIPP/E) certification is intended to equip professionals with the knowledge and skills necessary to develop and implement effective data protection strategies in their organizations.
The CIPP-E certification is offered by the International Association of Privacy Professionals (IAPP), a leading organization dedicated to promoting privacy practices and standards around the world. The IAPP offers a comprehensive study program for the CIPP-E exam, including online training, study guides, and practice exams. With the CIPP-E certification, professionals can demonstrate their expertise in European data protection laws and regulations, which can lead to new career opportunities and higher salaries.
NEW QUESTION # 69
According to Article 14 of the GDPR, how long does a controller have to provide a data subject with necessary privacy information, if that subject's personal data has been obtained from other sources?
- A. Within a reasonable period after obtaining the personal data, but no later than eight weeks.
- B. Within a reasonable period after obtaining the personal data, but no later than one month.
- C. As soon as possible after the first communication with the data subject.
- D. As soon as possible after obtaining the personal data.
Answer: B
Explanation:
Reference https://dataprivacymanager.net/gdpr-exemptions-from-the-obligation-to-provide-information-to-the- individual-data-subject/
NEW QUESTION # 70
Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?
- A. The Article 29 Working Party
- B. The European Commission
- C. The European Parliament
- D. The European Council
Answer: B
Explanation:
Reference https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/ adequacy-decisions_en
NEW QUESTION # 71
SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester's Alumni portal. Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna's tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Before Anna determines whether Frank's performance database is permissible, what additional information does she need?
- A. More information about the extent of the information loss.
- B. More information about Frank's data protection training.
- C. More information about what students have been told and how the research will be used.
- D. More information about the algorithm Frank used to mask student numbers.
Answer: C
NEW QUESTION # 72
A mobile device application that uses cookies will be subject to the consent requirement of which of the following?
- A. The EU Cybersecurity Directive
- B. The E-Commerce Directive
- C. The ePrivacy Directive
- D. The Data Retention Directive
Answer: C
Explanation:
Explanation/Reference: https://www.iubenda.com/en/help/5525-cookies-gdpr-requirements
NEW QUESTION # 73
SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location.
During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization.
The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
To comply with the GDPR, what should Building Block have done as a first step before implementing the SecurityScan measure?
- A. Consulted with the Information Security team to weigh security measures against possible server impacts.
- B. Consulted with the relevant data protection authority about potential privacy violations.
- C. Assessed potential privacy risks by conducting a data protection impact assessment.
- D. Distributed a more comprehensive notice to employees and received their express consent.
Answer: D
NEW QUESTION # 74
When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?
- A. When the data has been pseudonymized.
- B. When the data subject has failed to use a provided opt-out mechanism.
- C. When the data serves legitimate interest of third parties.
- D. When the data is protected by technological safeguards.
Answer: C
Explanation:
Section: (none)
Explanation
NEW QUESTION # 75
What must a data controller do in order to make personal data pseudonymous?
- A. Separately hold any information that would allow linking the data to the data subject.
- B. Remove all indirect data identifiers and dispose of them securely.
- C. Encrypt the data in order to prevent any unauthorized access or modification.
- D. Use the data only in aggregated form for research purposes.
Answer: A
NEW QUESTION # 76
Which of the following was the first legally binding international instrument in the area of data protection?
- A. General Data Protection Regulation.
- B. Convention 108.
- C. Universal Declaration of Human Rights.
- D. EU Directive on Privacy and Electronic Communications.
Answer: B
Explanation:
Reference https://www.coe.int/en/web/data-protection/convention108/background
NEW QUESTION # 77
Which of the following would NOT be relevant when determining if a processing activity would be considered profiling?
- A. If the processing involves data that is considered personal data
- B. If the processing is to be performed by a third-party vendor
- C. If the processing is used to predict the behavior of data subjects
- D. If the processing of the data is done through automated means
Answer: C
NEW QUESTION # 78
Which of the following demonstrates compliance with the accountability principle found in Article 5, Section 2 of the GDPR?
- A. Anonymizing special categories of data.
- B. Getting consent from the data subject for a cross border data transfer.
- C. Conducting regular audits of the data protection program.
- D. Encrypting data in transit and at rest using strong encryption algorithms.
Answer: C
NEW QUESTION # 79
Please use the following to answer the next question:
ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorage Why was Jackie correct in not completing a transfer impact assessment for HRYourWay?
- A. ProStorage can rely on its Binding Corporate Rules
- B. HRYourWay was ultimately not selected
- C. ProStorage will obtain consent for all transfers.
- D. HRYourWay is not located in a third country.
Answer: C
NEW QUESTION # 80
An unforeseen power outage results in company Z's lack of access to customer data for six hours. According to article 32 of the GDPR, this is considered a breach. Based on the WP 29's February, 2018 guidance, company Z should do which of the following?
- A. Document the loss of availability to demonstrate accountability
- B. Notify the supervisory authority about the loss of availability
- C. Notify affected individuals that their data was unavailable for a period of time.
- D. Conduct a thorough audit of all security systems
Answer: B
NEW QUESTION # 81
According to the GDPR, how is pseudonymous personal data defined?
- A. Data that has been rendered anonymous in such a manner that the data subject is no longer identifiable.
- B. Data that can no longer be attributed to a specific data subject without the use of additional information kept separately.
- C. Data that can no longer be attributed to a specific data subject, with no possibility of re-identifying the data.
- D. Data that has been encrypted or is subject to other technical safeguards.
Answer: B
NEW QUESTION # 82
A Spanish electricity customer calls her local supplier with Questions: about the company's upcoming merger. Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?
- A. Verify that the request is applicable to the data collected before the GDPR entered into force.
- B. Verify that the purpose of the request from the customer is in line with the GDPR.
- C. Verify that the personal data has not already been sent to the customer.
- D. Verify that the identity of the customer can be proven by other means.
Answer: A
Explanation:
Reference https://fpf.org/wp-content/uploads/2018/11/GDPR_CCPA_Comparison-Guide.pdf
NEW QUESTION # 83
SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
What are ABC Hotel Chain and XYZ Travel Agency's roles in this relationship?
- A. ABC Hotel Chain and XYZ Travel Agency are joint controllers.
- B. XYZ Travel Agency is the controller and ABC Hotel Chain is the processor.
- C. ABC Hotel Chain and XYZ Travel Agency are independent controllers.
- D. ABC Hotel Chain is the controller and XYZ Travel Agency is the processor.
Answer: D
NEW QUESTION # 84
SCENARIO
Please use the following to answer the next question:
Brady is a computer programmer based in New Zealand who has been running his own business for two years. Brady's business provides a low-cost suite of services to customers throughout the European Economic Area (EEA). The services are targeted towards new and aspiring small business owners. Brady's company, called Brady Box, provides web page design services, a Social Networking Service (SNS) and consulting services that help people manage their own online stores.
Unfortunately, Brady has been receiving some complaints. A customer named Anna recently uploaded her plans for a new product onto Brady Box's chat area, which is open to public viewing. Although she realized her mistake two weeks later and removed the document, Anna is holding Brady Box responsible for not noticing the error through regular monitoring of the website. Brady believes he should not be held liable.
Another customer, Felipe, was alarmed to discover that his personal information was transferred to a third- party contractor called Hermes Designs and worries that sensitive information regarding his business plans may be misused. Brady does not believe he violated European privacy rules. He provides a privacy notice to all of his customers explicitly stating that personal data may be transferred to specific third parties in fulfillment of a requested service. Felipe says he read the privacy notice but that it was long and complicated Brady continues to insist that Felipe has no need to be concerned, as he can personally vouch for the integrity of Hermes Designs. In fact, Hermes Designs has taken the initiative to create sample customized banner advertisements for customers like Felipe. Brady is happy to provide a link to the example banner ads, now posted on the Hermes Designs webpage. Hermes Designs plans on following up with direct marketing to these customers.
Brady was surprised when another customer, Serge, expressed his dismay that a quotation by him is being used within a graphic collage on Brady Box's home webpage. The quotation is attributed to Serge by first and last name. Brady, however, was not worried about any sort of litigation. He wrote back to Serge to let him know that he found the quotation within Brady Box's Social Networking Service (SNS), as Serge himself had posted the quotation. In his response, Brady did offer to remove the quotation as a courtesy.
Despite some customer complaints, Brady's business is flourishing. He even supplements his income through online behavioral advertising (OBA) via a third-party ad network with whom he has set clearly defined roles. Brady is pleased that, although some customers are not explicitly aware of the OBA, the advertisements contain useful products and services.
Based on current trends in European privacy practices, which aspect of Brady Box' Online Behavioral Advertising (OBA) is most likely to be insufficient if the company becomes established in Europe?
- A. The need to have the contents of the advertising approved.
- B. The lack of the option to opt in.
- C. The level of security within the website.
- D. The contract with the third-party advertising network.
Answer: B
Explanation:
Section: (none)
NEW QUESTION # 85
What is a reason the European Court of Justice declared the Data Retention Directive invalid in 2014?
- A. The requirements were financially burdensome to EU businesses.
- B. The requirements specified that data must be held within the EU.
- C. The requirements had limitations on how national authorities could use data.
- D. The requirements affected individuals without exception.
Answer: C
Explanation:
Reference:
%20the%20Grand,proportionality%20in%20forging%20the%20Directive.
NEW QUESTION # 86
What was the aim of the European Data Protection Directive 95/46/EC?
- A. To further reconcile the protection of the fundamental rights of individuals with the free flow of data from one member state to another.
- B. To implement the OECD Guidelines on the Protection of Privacy and trans-border flows of Personal Data.
- C. To harmonize the implementation of the European Convention of Human Rights across all member states.
- D. To completely prevent the transfer of personal data out of the European Union.
Answer: B
NEW QUESTION # 87
......
Accurate & Verified New CIPP-E Answers As Experienced in the Actual Test!: https://www.vceengine.com/CIPP-E-vce-test-engine.html
Valid CIPP-E Test Answers Full-length Practice Certification Exams: https://drive.google.com/open?id=1GpawwhqEBbmQ64XT3XbtYehRIUUvmzYQ
