CIPP-E practice questions 101–110

1. Question 101 · 290 in bank

   Under Article 9 of the GDPR, which of the following categories of data is NOT expressly prohibited from data processing?

   • APersonal data revealing ethnic origin.
   • BPersonal data revealing genetic information.
   • CPersonal data revealing financial information.
   • DPersonal data revealing trade union membership.

   Show answer

   Answer: C

   Next question

2. Question 102 · 290 in bank

   When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?

   • AWhen the data has been pseudonymized.
   • BWhen the data is protected by technological safeguards.
   • CWhen the data serves legitimate interest of third parties.
   • DWhen the data subject has failed to use a provided opt-out mechanism.

   Show answer

   Answer: A

   Next question

3. Question 103 · 290 in bank

   In which situation would a data controller most likely be able to justify the processing of the data of a child without parental consent?

   • AWhen the data is to be processed for market research.
   • BWhen providing preventive or counselling services to the child.
   • CWhen providing the child with materials purely for educational use.
   • DWhen a legitimate business interest makes obtaining consent impractical.

   Show answer

   Answer: B

   Next question

4. Question 104 · 290 in bank

   According to the GDPR, when should the processing of photographs be considered processing of special categories of personal data?

   • AWhen processed with the intent to publish information regarding a natural person on publicly accessible media.
   • BWhen processed with the intent to proceed to scientific or historical research projects.
   • CWhen processed with the intent to uniquely identify or authenticate a natural person.
   • DWhen processed with the intent to comply with a law.

   Show answer

   Answer: C

   Next question

5. Question 105 · 290 in bank

   Which GDPR principle would a Spanish employer most likely depend upon to annually send the personal data of its employees to the national tax authority?

   • AThe consent of the employees.
   • BThe legal obligation of the employer.
   • CThe legitimate interest of the public administration.
   • DThe protection of the vital interest of the employees.

   Show answer

   Answer: B

   Next question

6. Question 106 · 290 in bank

   An online company’s privacy practices vary due to the fact that it offers a wide variety of services. How could it best address the concern that explaining them all would make the policies incomprehensible?

   • AUse a layered privacy notice on its website and in its email communications.
   • BIdentify uses of data in a privacy notice mailed to the data subject.
   • CProvide only general information about its processing activities and offer a toll-free number for more information.
   • DPlace a banner on its website stipulating that visitors agree to its privacy policy and terms of use by visiting the site.

   Show answer

   Answer: A

   Next question

7. Question 107 · 290 in bank

   The GDPR requires controllers to supply data subjects with detailed information about the processing of their data. Where a controller obtains data directly from data subjects, which of the following items of information does NOT legally have to be supplied?

   • AThe recipients or categories of recipients.
   • BThe categories of personal data concerned.
   • CThe rights of access, erasure, restriction, and portability.
   • DThe right to lodge a complaint with a supervisory authority.

   Show answer

   Answer: B

   Next question

8. Question 108 · 290 in bank

   According to Article 14 of the GDPR, how long does a controller have to provide a data subject with necessary privacy information, if that subject’s personal data has been obtained from other sources?

   • AAs soon as possible after obtaining the personal data.
   • BAs soon as possible after the first communication with the data subject.
   • CWithin a reasonable period after obtaining the personal data, but no later than one month.
   • DWithin a reasonable period after obtaining the personal data, but no later than eight weeks.

   Show answer

   Answer: C

   Next question

9. Question 109 · 290 in bank

   When would a data subject NOT be able to exercise the right to portability?

   • AWhen the processing is necessary to perform a task in the exercise of authority vested in the controller.
   • BWhen the processing is carried out pursuant to a contract with the data subject.
   • CWhen the data was supplied to the controller by the data subject.
   • DWhen the processing is based on consent.

   Show answer

   Answer: A

   Next question

10. Question 110 · 290 in bank

    In which of the following situations would an individual most likely to be able to withdraw her consent for processing?

    • AWhen she is leaving her bank and moving to another bank.
    • BWhen she has recently changed jobs and no longer works for the same company.
    • CWhen she disagrees with a diagnosis her doctor has recorded on her records.
    • DWhen she no longer wishes to be sent marketing materials from an organization.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-E practice, question 101. 290 questions available.