CIPP-E practice questions 201–210

1. Question 201 · 290 in bank

   According to Article 84 of the GDPR, the rules on penalties applicable to infringements shall be laid down by?

   • AThe local Data Protection Supervisory Authorities.
   • BThe European Data Protection Board.
   • CThe EU Commission.
   • DThe Member States.

   Show answer

   Answer: D

   Next question

2. Question 202 · 290 in bank

   A company plans to transfer employee health information between two of its entities in France. To maintain the security of the processing, what would be the most important security measure to apply to the health data transmission?

   • AInform the data subject of the security measures in place.
   • BEnsure that the receiving entity has signed a data processing agreement.
   • CEncrypt the transferred data in transit and at rest.
   • DConduct a data protection impact assessment.

   Show answer

   Answer: C

   Next question

3. Question 203 · 290 in bank

   If a company chooses to ground an international data transfer on the contractual route, which of the following is NOT a valid set of standard contractual clauses?

   • ADecision 2001/497/EC (EU controller to non-EU or EEA controller).
   • BDecision 2004/915/EC (EU controller to non-EU or EEA controller).
   • CDecision 2007/72/EC (EU processor to non-EU or EEA controller).
   • DDecision 2010/87/EU (Non-EU or EEA processor from EU controller).

   Show answer

   Answer: C

   Next question

4. Question 204 · 290 in bank

   Article 58 of the GDPR describes the power of supervisory authorities. Which of the following is NOT among those granted?

   • ALegislative powers.
   • BCorrective powers.
   • CInvestigatory powers.
   • DAuthorization and advisory powers.

   Show answer

   Answer: A

   Next question

5. Question 205 · 290 in bank

   According to the European Data Protection Board, which of the following concepts or practices does NOT follow from the principles relating to the processing of personal data under EU data protection law?

   • AData ownership allocation.
   • BAccess control management.
   • CFrequent pseudonymization key rotation.
   • DError propagation avoidance along the processing chain.

   Show answer

   Answer: A

   Next question

6. Question 206 · 290 in bank

   Which statement provides an accurate description of a directive?

   • AA directive specifies certain results that must be achieved, but each member state is free to decide how to turn it into a national law.
   • BA directive has binding legal force throughout every member state and enters into force on a set date in all the member states.
   • CA directive is a legal act relating to specific cases and directed towards member states, companies or private individuals.
   • DA directive is a legal act that applies automatically and uniformly to all EU countries as soon as it enters into force.

   Show answer

   Answer: A

   Next question

7. Question 207 · 290 in bank

   Which aspect of processing does the GDPR allow processors to determine for themselves?

   • AThe question of whether the controller needs to be informed about the substitution of another processor carrying out specific processing activities on behalf of the controller.
   • BTheir own purposes for the processing, if such purposes are compatible with those for which the personal data were initially collected.
   • CThe parameters of their marketing campaigns using personal data relating to the controller's customers.
   • DTheir own type of hardware or software and the specific security measures for the processing.

   Show answer

   Answer: D

   Next question

8. Question 208 · 290 in bank

   Two companies, Gellcoat and Freifish, make plans to launch a co-branded product, the prototype of which is called Gellifish 5337. The companies want to organize an event to introduce the new product, so they decide to share data from their client databases and come up with a list of people to invite. They agree on the content of the invitations and together build an app to gather feedback at the event. In this scenario, Gellcoat and Freifish are considered to be?

   • AJoint controllers with respect to the personal data related to the event and separate controllers for their other purposes.
   • BJoint controllers for all purposes because they have merged their databases and their data is now jointly owned.
   • CSeparate controllers because joint controllership requires a written designation in a contract.
   • DSeparate controllers and processors since they are each providing services to the other.

   Show answer

   Answer: A

   Next question

9. Question 209 · 290 in bank

   According to guidance from the European Data Protection Board, in which of the following cases would a controller established outside of the EU not be subject to the GDPR?

   • AIf the controller monitors the behavior of persons on the territory of the Republic of Switzerland.
   • BIf the controller has a fully-owned branch office in the EU overseeing all its European operations, including marketing and advertising.
   • CIf the controller has its some of its offices and servers based in the EU without having a legal branch or subsidiary in any EU Member State.
   • DIf the controller uses the services of an EU-based processor without offering goods or services to persons on EU territory or monitoring their behavior.

   Show answer

   Answer: A

   Next question

10. Question 210 · 290 in bank

    SCENARIO - Please use the following to answer the next question: CreditPlaya, SA is an established Spanish online insurance company whose exclusive activity is providing health insurance for legal residents of Spain, regardless of their nationality. CreditPlaya autonomously manages its own website, through which a potential customer, engaging in a free pre-contractual activity, enters his or her full name, e-mail address, tax identification number (to verify residence in Spain), age, profession, and the full names of any other adult members of his or her family. With this data, CreditPlaya immediately sends an email granting or denying eligibility for a health insurance policy. In the case of eligibility, the email also contains the eventual cost of the policy and two PDF documents – one with the contractual Terms and Conditions, and the other with the privacy notice as required by Article 13 of the GDPR. The CreditPlaya Information Tracking System (ITS) is very efficient, with a low rate of unpaid insurance policies. The ITS is automatically fed by the information provided by every applicant, whose data is then used to refine insurance policy rates. To ensure their back-up procedures, in January 2021 CreditPlaya started sending weekly copies of the whole database with all the applicants' personal data to an independent company in Uruguay. The information was sent through state-of-the-art encrypting tools, but once in Uruguay was stored without any encryption method. In March 2022, the entire data base stored on the Uruguay's company servers was encrypted by malicious ransomware. There was no evidence that the data was accessed by unauthorized persons, much less altered or exfiltrated. Despite the incident, CreditPlaya found that they could rely on the locally based Spanish back-up information and carry on its activity without interrupting its operations. The incident caused the termination of the professional relationship between the two companies. According to the GDPR, current CreditPlaya customers who have expressly accepted the policy Terms and Conditions would NOT be granted which of the following rights?

    • AThe Right To Object.
    • BThe Right to Erasure.
    • CThe Right to Data Portability.
    • DThe Right Not to be Subject to Profiling.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-E practice, question 201. 290 questions available.