CIPP-E IAPP Exam Questions and Free Practice Test

Question 25

SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an
internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain’s locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
What is the time period in which Mike should receive a response to his request?

A. Not more than one month of receipt of Mike’s request.

B. Not more than two months after verifying Mike’s identity.

C. When all the information about Mike has been collected.

D. Not more than thirty days after submission of Mike’s request.

Correct Answer:D

Question 26

According to Article 84 of the GDPR, the rules on penalties applicable to infringements shall be laid down by?

A. The local Data Protection Supervisory Authorities.

B. The European Data Protection Board.

C. The EU Commission.

D. The Member States.

Correct Answer:D

Question 27

Please use the following to answer the next question:
WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of their service, WonderKids will pass all personal data
provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person booking the childcare, address and contact details, as well as information about the children to be cared for including name, age, gender and health information. The privacy statement on Wonderkids’ website states the following:
“WonderkKids provides the information you disclose to us through this website to your childcare provider for scheduling and health and safety reasons. We may also use your and your child’s personal information for our own legitimate business purposes and we employ a third-party website hosting company located in Switzerland to store the data. Any data stored on equipment located in Switzerland meets the European Commission provisions for guaranteeing adequate safeguards for you and your child’s personal information. We will only share you and your child’s personal information with businesses that we see as adding real value to you. By providing us with any personal data, you consent to its transfer to affiliated businesses and to send you promotional offers.”
“We may retain you and your child’s personal information for no more than 28 days, at which point the data will be depersonalized, unless your personal information is being used for a legitimate business purpose beyond 28 days where it may be retained for up to 2 years.”
“We are processing you and your child’s personal information with your consent. If you choose not to provide certain information to us, you may not be able to use our services. You have the right to: request access to you and your child’s personal information; rectify or erase you or your child’s personal information; the right to correction or erasure of you and/or your child’s personal information; object to any processing of you and your child’s personal information. You also have the right to complain to the supervisory authority about our data processing activities.”
What direct marketing information can WonderKids send by email without prior consent of the person booking the childcare?

A. No marketing information at all.

B. Any marketing information at all.

C. Marketing information related to other business operations of WonderKids.

D. Marketing information for products or services similar to those purchased from WonderKids.

Correct Answer:C

Question 28

Article 9 of the GDPR lists exceptions to the general prohibition against processing biometric data. Which of the following is NOT one of these exceptions?

A. The processing is done by a non-profit organization and the results are disclosed outside the organization.

B. The processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.

C. The processing is necessary for the establishment, exercise or defense of legal claims when courts are acting in a judicial capacity.

D. The processing is explicitly consented to by the data subject and he or she is allowed by Union or Member State law to lift the prohibition.

Correct Answer:A

Question 29

Under Article 30 of the GDPR, controllers are required to keep records of all of the following EXCEPT?

A. Incidents of personal data breaches, whether disclosed or not.

B. Data inventory or data mapping exercises that have been conducted.

C. Categories of recipients to whom the personal data have been disclosed.

D. Retention periods for erasure and deletion of categories of personal data.

Correct Answer:D

Question 30

What are the obligations of a processor that engages a sub-processor?

A. The processor must give the controller prior written notice and perform a preliminary audit of the sub- processor.

B. The processor must obtain the controller’s specific written authorization and provide annual reports on the sub-processor’s performance.

C. The processor must receive a written agreement that the sub-processor will be fully liable to the controller for the performance of its obligations in relation to the personal data concerned.

D. The processor must obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor.

Correct Answer:C

START CIPP-E EXAM