CIPP-E practice questions 191–200

1. Question 191 · 290 in bank

   If a data subject puts a complaint before a DPA and receives no information about its progress or outcome, how long does the data subject have to wait before taking action in the courts?

   • A1 month.
   • B3 months.
   • C5 months.
   • D12 months.

   Show answer

   Answer: B

   Next question

2. Question 192 · 290 in bank

   For which of the following operations would an employer most likely be justified in requesting the data subject’s consent?

   • APosting an employee’s bicycle race photo on the company’s social media.
   • BProcessing an employee’s health certificate in order to provide sick leave.
   • COperating a CCTV system on company premises.
   • DAssessing a potential employee’s job application.

   Show answer

   Answer: A

   Next question

3. Question 193 · 290 in bank

   An entity’s website stores text files on EU users’ computer and mobile device browsers. Prior to doing so, the entity is required to provide users with notices containing information and consent under which of the following frameworks?

   • AGeneral Data Protection Regulation 2016/679.
   • BE-Privacy Directive 2002/58/EC.
   • CE-Commerce Directive 2000/31/EC.
   • DData Protection Directive 95/46/EC.

   Show answer

   Answer: B

   Next question

4. Question 194 · 290 in bank

   Which of the following is NOT considered a fair processing practice in relation to the transparency principle?

   • AProviding a multi-layered privacy notice, in a website environment.
   • BProviding a QR code linking to more detailed privacy notice, in a CCTV sign.
   • CProviding a hyperlink to the organization’s home page, in a hard copy application form.
   • DProviding a “just-in-time” contextual pop-up privacy notice, in an online application from field.

   Show answer

   Answer: C

   Next question

5. Question 195 · 290 in bank

   Which of the following was the first to implement national law for data protection in 1973?

   • AFrance
   • BSweden
   • CGermany
   • DUnited Kingdom

   Show answer

   Answer: B

   Next question

6. Question 196 · 290 in bank

   The GDPR forbids the practice of “forum shopping”, which occurs when companies do what?

   • AChoose the data protection officer that is most sympathetic to their business concerns.
   • BDesignate their main establishment in member state with the most flexible practices.
   • CFile appeals of infringement judgments with more than one EU institution simultaneously.
   • DSelect third-party processors on the basis of cost rather than quality of privacy protection.

   Show answer

   Answer: B

   Next question

7. Question 197 · 290 in bank

   What is the most frequently used mechanism for legitimizing cross-border data transfer?

   • AStandard Contractual Clauses.
   • BApproved Code of Conduct.
   • CBinding Corporate Rules.
   • DDerogations.

   Show answer

   Answer: A

   Next question

8. Question 198 · 290 in bank

   If a French controller has a car-sharing app available only in Morocco, Algeria and Tunisia, but the data processing activities are carried out by the appointed processor in Spain, the GDPR will apply to the processing of the personal data so long as?

   • AThe individuals are European citizens or residents.
   • BThe data processing activities are in Spain.
   • CThe data controller is in France.
   • DThe EU individuals are targeted.

   Show answer

   Answer: C

   Next question

9. Question 199 · 290 in bank

   Select the answer below that accurately completes the following: “The right to compensation and liability under the GDPR…

   • A…provides for an exemption from liability if the data controller (or data processor) proves that it is not in any way responsible for the event giving rise to the damage.”
   • B…precludes any subsequent recourse proceedings against other controllers or processors involved in the same processing.”
   • C...can only be exercised against the data controller, even if a data processor was involved in the same processing.”
   • D…is limited to a maximum amount of EUR 20 million per event of damage or loss.”

   Show answer

   Answer: A

   Next question

10. Question 200 · 290 in bank

    Pursuant to Article 4(5) of the GDPR, data is considered “pseudonymized” if?

    • AIt cannot be attributed to a data subject without the use of additional information.
    • BIt cannot be attributed to a person under any circumstances.
    • CIt can only be attributed to a person by the controller.
    • DIt can only be attributed to a person by a third party.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-E practice, question 191. 290 questions available.