CIPP-E IAPP Exam Questions and Free Practice Test

Question 43

In which of the following situations would an individual most likely to be able to withdraw her consent for processing?

A. When she is leaving her bank and moving to another bank.

B. When she has recently changed jobs and no longer works for the same company.

C. When she disagrees with a diagnosis her doctor has recorded on her records.

D. When she no longer wishes to be sent marketing materials from an organization.

Correct Answer:D

Question 44

A U.S. company’s website sells widgets. Which of the following factors would NOT in itself subject the company to the GDPR?

A. The widgets are offered in EU and priced in euro.

B. The website is in English and French, and is accessible in France.

C. An affiliate office is located in France but the processing is in the U.S.

D. The website places cookies to monitor the EU website user behavior.

Correct Answer:B

Question 45

A grade school is planning to use facial recognition to track student attendance. Which of the following may provide a lawful basis for this processing?

A. The school places a notice near each camera.

B. The school gets explicit consent from the students.

C. Processing is necessary for the legitimate interests pursed by the school.

D. A state law requires facial recognition to verify attendance.

Correct Answer:A

Question 46

What permissions are required for a marketer to send an email marketing message to a consumer in the EU?

A. A prior opt-in consent for consumers unless they are already customers.

B. A pre-checked box stating that the consumer agrees to receive email marketing.

C. A notice that the consumer’s email address will be used for marketing purposes.

D. No prior permission required, but an opt-out requirement on all emails sent to consumers.

Correct Answer:A

Question 47

What was the aim of the European Data Protection Directive 95/46/EC?

A. To harmonize the implementation of the European Convention of Human Rights across all member states.

B. To implement the OECD Guidelines on the Protection of Privacy and trans-border flows of Personal Data.

C. To completely prevent the transfer of personal data out of the European Union.

D. To further reconcile the protection of the fundamental rights of individuals with the free flow of data from one member state to another.

Correct Answer:B

Question 48

SCENARIO
Please use the following to answer the next question:
Zandelay Fashion (‘Zandelay’) is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company’s compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company’s customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay’s business plan and associated processing activities.
What would MOST effectively assist Zandelay in conducting their data protection impact assessment?

A. Information about DPIAs found in Articles 38 through 40 of the GDPR.

B. Data breach documentation that data controllers are required to maintain.

C. Existing DPIA guides published by local supervisory authorities.

D. Records of processing activities that data controllers are required to maintain.

Correct Answer:A

START CIPP-E EXAM