CIPP-E practice questions 131–140

1. Question 131 · 290 in bank

   Which of the following is one of the supervisory authority’s investigative powers?

   • ATo notify the controller or the processor of an alleged infringement of the GDPR.
   • BTo require that controllers or processors adopt approved data protection certification mechanisms.
   • CTo determine whether a controller or processor has the right to a judicial remedy concerning a compensation decision made against them.
   • DTo require data controllers to provide them with written notification of all new processing activities.

   Show answer

   Answer: A

   Next question

2. Question 132 · 290 in bank

   Many businesses print their employees’ photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?

   • ABecause use of biometric data to confirm the unique identification of data subjects benefits from an exemption.
   • BBecause photographs qualify as biometric data only when they undergo a “specific technical processing”.
   • CBecause employees are deemed to have given their explicit consent when they agree to be photographed by their employer.
   • DBecause photographic ID is a physical security measure which is “necessary for reasons of substantial public interest”.

   Show answer

   Answer: B

   Next question

3. Question 133 · 290 in bank

   A worker in a European Union (EU) member state has ceased his employment with a company. What should the employer most likely do in regard to the worker’s personal data?

   • ADestroy sensitive information and store the rest per applicable data protection rules.
   • BStore all of the data in case the departing worker makes a subject access request.
   • CSecurely store the data that is required to be kept under local law.
   • DProvide the employee the reasons for retaining the data.

   Show answer

   Answer: C

   Next question

4. Question 134 · 290 in bank

   Which of the following is NOT a role of works councils?

   • ADetermining the monetary fines to be levied against employers for data breach violations of employee data.
   • BDetermining whether to approve or reject certain decisions of the employer that affect employees.
   • CDetermining whether employees’ personal data can be processed or not.
   • DDetermining what changes will affect employee working conditions.

   Show answer

   Answer: A

   Next question

5. Question 135 · 290 in bank

   Under the Data Protection Law Enforcement Directive of the EU, a government can carry out covert investigations involving personal data, as long it is set forth by law and constitutes a measure that is both necessary and what?

   • APrudent.
   • BImportant.
   • CProportionate.
   • DDPA-approved.

   Show answer

   Answer: C

   Next question

6. Question 136 · 290 in bank

   Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?

   • AData subjects must be sufficiently informed of the purposes for which their personal data is processed.
   • BProcessing of special categories of personal data on a large scale requires appointing a DPO.
   • CPersonal data of data subjects must always be accurate and kept up to date.
   • DData controllers must be in control of the data they hold at all times.

   Show answer

   Answer: D

   Next question

7. Question 137 · 290 in bank

   A company in France suffers a robbery over the weekend owing to a faulty alarm system. When it is determined that the break-in involves the loss of a substantial amount of data, the company decides on a CCTV system to monitor for future incidents. Company technicians install cameras in the entrance of the building, hallways and offices. Footage is recorded continuously, and is monitored by the home office in the United States. What is the most realistic step the company could take to address their security concerns and comply with the personal data processing principles set out in Article 5 of the GDPR?

   • ASeek informed consent from company employees.
   • BHave cameras recording during work hours only.
   • CRetain captured footage for no more than 30 days.
   • DRestrict camera placement to building entrances only.

   Show answer

   Answer: D

   Next question

8. Question 138 · 290 in bank

   Which of the following is an example of direct marketing that would be subject to European data protection laws?

   • AAn updated privacy notice sent to an individual’s personal email address.
   • BA charity fundraising event notice sent to an individual at her business address.
   • CA service outage notification provided to an individual by recorded telephone message.
   • DA revision of contract terms conveyed to an individual by SMS from a marketing organization.

   Show answer

   Answer: B

   Next question

9. Question 139 · 290 in bank

   Article 9 of the GDPR lists exceptions to the general prohibition against processing biometric data. Which of the following is NOT one of these exceptions?

   • AThe processing is done by a non-profit organization and the results are disclosed outside the organization.
   • BThe processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.
   • CThe processing is necessary for the establishment, exercise or defense of legal claims when courts are acting in a judicial capacity.
   • DThe processing is explicitly consented to by the data subject and he or she is allowed by Union or Member State law to lift the prohibition.

   Show answer

   Answer: A

   Next question

10. Question 140 · 290 in bank

    Which marketing-related activity is least likely to be covered by the provisions of Privacy and Electronic Communications Regulations (Directive 2002/58/EC)?

    • AAdvertisements passively displayed on a website.
    • BThe use of cookies to collect data about an individual.
    • CA text message to individuals from a company offering concert tickets for sale.
    • DAn email from a retail outlet promoting a sale to one of their previous customer.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-E practice, question 131. 290 questions available.