CIPP-E practice questions 181–190

1. Question 181 · 290 in bank

   A data controller appoints a data protection officer. Which of the following conditions would NOT result in an infringement of Articles 37 to 39 of the GDPR?

   • AIf the data protection officer lacks ISO 27001 auditor certification.
   • BIf the data protection officer is provided by the data processor.
   • CIf the data protection officer also manages the marketing budget.
   • DIf the data protection officer receives instructions from the data controller.

   Show answer

   Answer: A

   Next question

2. Question 182 · 290 in bank

   Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC). Why is the Directive no longer part of EU law?

   • AThe Directive was superseded by the EU Directive on Privacy and Electronic Communications.
   • BThe Directive was superseded by the General Data Protection Regulation.
   • CThe Directive was annulled by the Court of Justice of the European Union.
   • DThe Directive was annulled by the European Court of Human Rights.

   Show answer

   Answer: C

   Next question

3. Question 183 · 290 in bank

   Which of the following is the weakest lawful basis for processing employee personal data?

   • AProcessing based on fulfilling an employment contract.
   • BProcessing based on employee consent.
   • CProcessing based on legitimate interests.
   • DProcessing based on legal obligation.

   Show answer

   Answer: B

   Next question

4. Question 184 · 290 in bank

   An organization receives a request multiple times from a data subject seeking to exercise his rights with respect to his own personal data. Under what condition can the organization charge the data subject a fee for processing the request?

   • AOnly where the organization can show that it is reasonable to do so because more than one request was made.
   • BOnly to the extent this is allowed under the restrictions on data subjects’ rights introduced under Art 23 of GDPR.
   • COnly where the administrative costs of taking the action requested exceeds a certain threshold.
   • DOnly if the organization can demonstrate that the request is clearly excessive or misguided.

   Show answer

   Answer: D

   Next question

5. Question 185 · 290 in bank

   To receive a preliminary interpretation on provisions of the GDPR, a national court will refer its case to which of the following?

   • AThe Court of Justice of the European Union.
   • BThe European Data Protection Supervisor.
   • CThe European Court of Human Rights.
   • DThe European Data Protection Board.

   Show answer

   Answer: A

   Next question

6. Question 186 · 290 in bank

   A grade school is planning to use facial recognition to track student attendance. Which of the following may provide a lawful basis for this processing?

   • AThe school places a notice near each camera.
   • BThe school gets explicit consent from the students.
   • CProcessing is necessary for the legitimate interests pursed by the school.
   • DA state law requires facial recognition to verify attendance.

   Show answer

   Answer: D

   Next question

7. Question 187 · 290 in bank

   SCENARIO - Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data. Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain’s locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member. Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights. What is the time period in which Mike should receive a response to his request?

   • ANot more than one month of receipt of Mike’s request.
   • BNot more than two months after verifying Mike’s identity.
   • CWhen all the information about Mike has been collected.
   • DNot more than thirty days after submission of Mike’s request.

   Show answer

   Answer: A

   Next question

8. Question 188 · 290 in bank

   SCENARIO - Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data. Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain’s locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member. Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights. What are ABC Hotel Chain and XYZ Travel Agency’s roles in this relationship?

   • AABC Hotel Chain is the controller and XYZ Travel Agency is the processor.
   • BXYZ Travel Agency is the controller and ABC Hotel Chain is the processor.
   • CABC Hotel Chain and XYZ Travel Agency are independent controllers.
   • DABC Hotel Chain and XYZ Travel Agency are joint controllers.

   Show answer

   Answer: D

   Next question

9. Question 189 · 290 in bank

   SCENARIO - Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data. Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain’s locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member. Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights. In which of the following situations would ABC Hotel Chain and XYZ Travel Agency NOT have to honor Mike’s data access request?

   • AThe request is to obtain access and correct inaccurate personal data in his profile.
   • BThe request is to obtain access and information about the purpose of processing his personal data.
   • CThe request is to obtain access and erasure of his personal data while keeping his rewards membership.
   • DThe request is to obtain access and the categories of recipients who have received his personal data to process his rewards membership.

   Show answer

   Answer: C

   Next question

10. Question 190 · 290 in bank

    Which of the following Convention 108+ principles, as amended in 2018, is NOT consistent with a principle found in the GDPR?

    • AThe obligation of companies to declare data breaches.
    • BThe requirement to demonstrate compliance to a supervisory authority.
    • CThe lawfulness of the bulk collection of personal data by the government.
    • DThe necessity of establishing a specific legal basis for processing personal data.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-E practice, question 181. 290 questions available.