80 free IAPP CIPP/E practice questions from the CertStash pack of 319, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 80 free here, all 319 in the pack, and each step includes the one before it.
Get all 319 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?
Show answer and explanation
Correct answer: B. The European Commission
Under the GDPR, the European Commission has the exclusive power to adopt decisions on the adequacy of the level of data protection in non-EU countries. This authority is established in Article 45 of the GDPR, which allows the Commission to determine whether a third country provides an adequate level of data protection based on an assessment of the country's legal framework and enforcement mechanisms.
Why the other options are wrong
- A. The European Parliament does not have the power to adopt adequacy decisions; it exercises legislative and oversight functions.
- C. The Article 29 Working Party (now the European Data Protection Board) provides advice and opinions but does not have the formal power to adopt binding adequacy decisions.
- D. The European Council is a political body that sets policy directions but does not adopt individual adequacy decisions regarding data protection levels.
Question 2
What is true of both the General Data Protection Regulation (GDPR) and the Council of Europe Convention 108?
Show answer and explanation
Correct answer: A. Both govern international transfers of personal data
Both the GDPR and the Council of Europe Convention 108 govern international transfers of personal data and establish rules and safeguards for transferring data across borders. This is a core shared principle in both instruments, requiring adequate protections when personal data moves to other jurisdictions.
Why the other options are wrong
- B. Convention 108 does govern manual processing of personal data, but the GDPR applies to both automated and manual processing only when data is part of a filing system.
- C. Convention 108 applies beyond European Union countries to all Council of Europe member states and has been ratified by non-EU countries.
- D. The GDPR requires notification to supervisory authorities for certain activities, but Convention 108 does not universally require such notification as a general principle.
Question 3
Which aspect of the GDPR will likely have the most impact on the consistent implementation of data protection laws throughout the European Union?
Show answer and explanation
Correct answer: B. That it takes the form of a Regulation as opposed to a Directive
The GDPR is a Regulation rather than a Directive, which means it is directly applicable and binding in all EU member states without requiring transposition into national law. This ensures uniform and consistent implementation of data protection rules throughout the European Union, eliminating the variation that occurred when member states transposed Directives differently.
Why the other options are wrong
- A. While the one-stop-shop mechanism is important, it primarily addresses which supervisory authority has jurisdiction, not the consistency of implementation across the EU.
- C. Mandatory breach notification is important for transparency but does not directly drive consistent implementation of all data protection laws across member states.
- D. The data protection officer requirement applies only to specific categories of organizations and does not represent the most broadly impactful aspect for consistent implementation.
Question 4
How is the retention of communications traffic data for law enforcement purposes addressed by European data protection law?
Show answer and explanation
Correct answer: A. The ePrivacy Directive allows individual EU member states to engage in such data retention.
The ePrivacy Directive (2002/58/EC) allows individual EU member states to maintain or adopt legislation permitting the retention of communications traffic data for law enforcement purposes, giving flexibility to member states while setting a framework for such retention. This reflects the balance between security needs and privacy protection at the member state level.
Why the other options are wrong
- B. The ePrivacy Directive does not fully harmonize member states' rules on data retention; it allows member states discretion in establishing national provisions.
- C. The Data Retention Directive was indeed annulled, but this does not make retention permissible; it returned authority to the ePrivacy Directive framework.
- D. The GDPR contains provisions for processing data for law enforcement but does not specifically authorize broad communications traffic data retention in the way the ePrivacy Directive does.
Question 5
What type of data lies beyond the scope of the General Data Protection Regulation?
Show answer and explanation
Correct answer: B. Anonymized
Anonymized data lies beyond the scope of the GDPR because it cannot be attributed to an identified or identifiable natural person. Once data is truly anonymized in a way that prevents identification, it is no longer considered personal data and therefore falls outside the regulatory framework.
Why the other options are wrong
- A. Pseudonymized data remains within the scope of the GDPR because the individual can still be identified through additional information.
- C. Encrypted data is still personal data and remains within the scope of the GDPR; encryption is a security measure, not a basis for exclusion.
- D. Masked data similarly remains within the scope as it can typically be unmasked and does not prevent identification.
Question 6
Under what circumstances would the GDPR apply to personal data that exists in physical form, such as information contained in notebooks or hard copy files?
Show answer and explanation
Correct answer: D. Only where the personal data is handled in a sufficiently structured manner so as to form part of a filing system.
The GDPR applies to personal data in physical form only where it is part of a filing system or intended to be part of a filing system. This means the data must be organized in a structured manner that allows for easy access and retrieval by reference to specific criteria, not merely stored in physical format.
Why the other options are wrong
- A. The GDPR does not limit application of physical data to instances where it is produced as output from automated processing.
- B. The GDPR does not require that physical data be subjected to computerized processing like scanning or OCR to fall within scope.
- C. The GDPR does not require that physical data be handled by automated means; the key criterion is whether it forms part of a structured filing system.
Question 7
Which of the following would most likely NOT be covered by the definition of “personal data” under the GDPR?
Show answer and explanation
Correct answer: C. The unlinked aggregated data used for statistical purposes by an Italian company
Under GDPR Article 4, personal data means information relating to an identified or identifiable natural person. Unlinked aggregated data used for statistical purposes cannot identify or relate to any individual and therefore does not constitute personal data. Once data is truly anonymized or unlinked from any individual, GDPR protections no longer apply.
Why the other options are wrong
- A. A payment card number is directly linked to an identified individual and is personal data.
- B. A social security number, even of a non-EU citizen, constitutes personal data when processed by EU entities.
- D. A candidate identification number used in examination records can identify a specific individual and constitutes personal data.
Question 8
Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3?
Show answer and explanation
Correct answer: D. Personal data of EU residents being processed by a non-EU business that targets EU customers.
Article 3(2) of the GDPR establishes extraterritorial application when a controller or processor based outside the EU processes personal data of EU residents in connection with offering goods or services to those EU residents, or monitoring their behavior. A non-EU business targeting EU customers processes data that falls under GDPR jurisdiction regardless of where the business is located.
Why the other options are wrong
- A. Monitoring by law enforcement is outside GDPR scope; GDPR does not govern law enforcement activities in the same manner.
- B. While this describes international data processing, it lacks the targeting element that triggers Article 3 extraterritorial application.
- C. Monitoring of EU citizens by non-EU law enforcement outside EU territory does not trigger GDPR extraterritorial scope.
Question 9
How does the GDPR now define “processing”?
Show answer and explanation
Correct answer: B. Any operation or set of operations performed on personal data or on sets of personal data.
GDPR Article 4(2) defines processing as any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means. This is an intentionally broad definition that encompasses collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, and deletion, regardless of the technology used.
Why the other options are wrong
- A. This definition is too narrow; processing includes far more than just collecting and recording.
- C. This definition focuses on compatibility with original purpose but misses processing's broader definition.
- D. This definition incorrectly restricts processing to only automated operations; GDPR covers all processing including manual.
Question 10
What is the consequence if a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller?
Show answer and explanation
Correct answer: C. The processor will be considered to be a controller in respect of the processing concerned
Under GDPR Article 28(10), if a processor determines independently the purposes and means of processing, the processor is no longer acting as a processor but becomes a controller in respect of that processing. This reclassification changes the legal obligations and liability structure, making the processor subject to all controller responsibilities.
Why the other options are wrong
- A. Administrative fines apply to controllers' violations, not specifically to this reclassification issue.
- B. While compensation may result from unauthorized processing, the immediate consequence is the change in status.
- D. This reverses the burden inappropriately; the consequence is automatic reclassification, not a requirement to demonstrate harm.
What people say about the full CIPP/E pack 5.0 from 2
Passed my Certified Information Privacy Professional certification exam today with 96% marks. Studied using the exam dumps at CertStash. Highly recommended to all taking this exam.
Passed today in IAPP CIPP-E dump material is still valid but there were 7 to 8 new questions in the exam.
Question 11
Which statement is correct when considering the right to privacy under Article 8 of the European Convention on Human Rights (ECHR)?
Show answer and explanation
Correct answer: B. The right to privacy has to be balanced against other rights under the ECHR
Article 8 of the ECHR protects the right to privacy, but this right is not absolute. Under Article 8(2), interference with privacy is permitted when necessary in a democratic society for legitimate aims such as national security, public safety, or protection of others' rights and freedoms. The right must be balanced against competing rights and societal interests, including freedom of expression under Article 10.
Why the other options are wrong
- A. The right to privacy is not absolute; Article 8(2) explicitly permits certain restrictions.
- C. Freedom of expression does not automatically override privacy rights; both must be balanced case-by-case.
- D. Article 8 protects privacy in personal life, not the right to hold opinions; that is covered by Article 10.
Question 12
A company is located in a country NOT considered by the European Union (EU) to have an adequate level of data protection. Which of the following is an obligation of the company if it imports personal data from another organization in the European Economic Area (EEA) under standard contractual clauses?
Show answer and explanation
Correct answer: D. Ensure that local laws do not impede the company from meeting its contractual obligations.
When a company outside the EEA imports personal data using standard contractual clauses, it must ensure that local laws in its country do not impede compliance with the contractual obligations. This is a key safeguard under GDPR Article 44 and related provisions, as the clauses provide contractual guarantees that must be enforceable and not undermined by conflicting local legislation.
Why the other options are wrong
- A. Submitting contracts to government authorities is not a GDPR obligation for standard contractual clauses.
- B. Notice and consent from data subjects are separate data processing requirements, not specific obligations tied to contractual clauses for transfers.
- C. The 30-day response requirement is not mandated by GDPR for contractual clause arrangements; supervisory authority requests follow standard procedural timelines.
Question 13
Which of the following would require designating a data protection officer?
Show answer and explanation
Correct answer: D. The core activities of the controller or processor consist of processing operations that require systematic monitoring of data subjects on a large scale.
Under GDPR Article 37, a DPO must be designated when the core activities of the controller or processor consist of processing operations that require systematic monitoring of data subjects on a large scale. This criterion focuses on the nature and scope of processing activities. Options A, B, and C describe other conditions that may trigger DPO requirements in some circumstances, but only option D represents a mandatory requirement that automatically triggers the obligation across all organizations meeting this threshold, regardless of sector or organizational size.
Why the other options are wrong
- A. Employing 250 or more persons is one trigger for DPO designation, but it is not the only mandatory requirement; organizations with fewer employees may also be required to designate a DPO based on processing activities.
- B. Processing for providing goods or services to individuals in the EU does not automatically require a DPO unless other conditions are met.
- C. Processing financial information or information relating to children requires a DPO only if the core activities consist of processing operations that meet the systematic monitoring threshold.
Question 14
Which of the following countries will continue to enjoy adequacy status under the GDPR, pending any future European Commission decision to the contrary?
Show answer and explanation
Correct answer: D. Switzerland
Switzerland has an adequacy decision under the GDPR and will retain this status pending any future European Commission decision to change it. Norway is also EEA-aligned but Switzerland maintains formal adequacy status. Greece and Australia do not have adequacy status, Greece is an EU member already covered by GDPR, and Australia has not been granted adequacy.
Why the other options are wrong
- A. Greece is an EU member state subject directly to GDPR, not covered by adequacy decisions.
- B. Norway is EEA-aligned but does not hold formal adequacy status in the same manner as Switzerland.
- C. Australia has not been granted adequacy status by the European Commission.
Question 15
Article 29 Working Party has emphasized that the GDPR forbids “forum shopping”, which occurs when companies do what?
Show answer and explanation
Correct answer: B. Designate their main establishment in member state with the most flexible practices.
Forum shopping in the GDPR context refers to companies strategically selecting their main establishment in EU member states with the most lenient data protection practices to gain regulatory advantages. Article 29 Working Party emphasized that GDPR forbids this practice to ensure uniform protection standards across the EU and prevent regulatory arbitrage.
Why the other options are wrong
- A. Data protection officers are appointed by controllers and processors, not chosen by companies to favor their interests, and this does not constitute forum shopping.
- C. Simultaneous appeals to multiple EU institutions is a legal procedural matter unrelated to the concept of forum shopping regarding establishment location.
- D. Selecting processors based on cost rather than privacy quality relates to processor selection standards, not the geographic forum shopping the Working Party addressed.
Question 16
Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?
Show answer and explanation
Correct answer: C. Demonstrate that the profiling is for the purposes of direct marketing.
When a data subject objects to profiling under Article 21, the controller must demonstrate compelling legitimate grounds to continue processing. According to WP 29 guidelines, this requires weighing interests, considering impact on the data subject's rights and freedoms, and assessing the importance to the controller's objectives. However, the mere fact that profiling is for direct marketing purposes is not sufficient to demonstrate compelling legitimate grounds; in fact, direct marketing is often treated as a basis for objection rather than justification for continuing profiling.
Why the other options are wrong
- A. Weighing controller interests against the data subject's objection is required to demonstrate legitimate grounds.
- B. Considering impact on the data subject's rights and freedoms is a required element of the analysis.
- D. Demonstrating the profiling's importance to the controller's particular objective is a required factor.
Question 17
Under the GDPR, which of the following is true in regard to adequacy decisions involving cross-border transfers?
Show answer and explanation
Correct answer: B. The European Commission can adopt, repeal or amend an existing adequacy decision.
The European Commission has the power to adopt, repeal, or amend adequacy decisions under GDPR Article 45. This reflects the Commission's authority to evaluate third countries' data protection standards and adjust adequacy status as circumstances change or new information emerges.
Why the other options are wrong
- A. Adequacy decisions apply to entire third countries or territories, not individual companies.
- C. EU member states cannot accept or reject adequacy decisions; these are Commission decisions binding across the EU.
- D. While data protection standards must be adequate, third countries are not required to implement GDPR itself, only to meet the substantive standard of adequate protection.
Question 18
Article 9 of the GDPR lists exceptions to the general prohibition against processing biometric data. Which of the following is NOT one of these exceptions?
Show answer and explanation
Correct answer: A. The processing is done by a non-profit organization and the results are disclosed outside the organization.
Article 9(2) of the GDPR lists exceptions to the prohibition on processing special categories of personal data including biometric data. One exception requires that a non-profit organization process the data and results are disclosed within the organization, not disclosed outside it. The option stating that results are disclosed outside the organization does not match the actual exception, which requires internal disclosure only. The other options accurately reflect legitimate exceptions under Article 9(2).
Why the other options are wrong
- B. Processing necessary to protect vital interests of an incapable data subject is a legitimate exception under Article 9(2)(c) of the GDPR.
- C. Processing necessary for the establishment, exercise or defense of legal claims in judicial capacity is a legitimate exception under Article 9(2)(f) of the GDPR.
- D. Explicit consent with permission by Union or Member State law to lift the prohibition is a legitimate exception under Article 9(2)(a) of the GDPR.
Question 19
Under Article 9 of the GDPR, which of the following categories of data is NOT expressly prohibited from data processing?
Show answer and explanation
Correct answer: C. Personal data revealing financial information.
Article 9 of the GDPR explicitly prohibits processing of special categories of personal data including ethnic origin, genetic data, and trade union membership. Financial information is not expressly listed as a special category under Article 9, though it may be protected under other GDPR provisions or sector-specific regulations.
Why the other options are wrong
- A. Ethnic origin is explicitly mentioned in Article 9(1) as a prohibited special category.
- B. Genetic data is expressly prohibited under Article 9(1) as a special category of personal data.
- D. Trade union membership is explicitly listed in Article 9(1) as a prohibited special category.
Question 20
Under what circumstances might the “soft opt-in” rule apply in relation to direct marketing?
Show answer and explanation
Correct answer: B. When an individual’s details are obtained from their inquiries about buying a product.
The soft opt-in rule applies when an individual's contact details are obtained from their own inquiries or interactions relating to purchasing a product or service. Under this exception, an organization can send marketing communications for similar products or services without prior consent, provided they offer an easy opt-out mechanism. This recognizes an existing business relationship and legitimate interest. The rule applies specifically when customers have voluntarily provided their details in a purchase context, not from consent, bought lists, or unsubscribe mechanisms alone.
Why the other options are wrong
- A. The soft opt-in specifically permits marketing without prior explicit consent in limited circumstances.
- C. Marketing lists purchased from third parties do not qualify for the soft opt-in exception, which requires details from the individual's own purchase inquiries.
- D. The ability to unsubscribe is a requirement accompanying soft opt-in, but is not the circumstance that triggers its application.
Question 21
When may browser settings be relied upon for the lawful application of cookies?
Show answer and explanation
Correct answer: B. When users are aware of the ability to adjust their settings.
Browser settings can be relied upon for lawful cookie application when users are aware of the ability to adjust their settings. This awareness allows users to make informed choices about cookie acceptance. However, mere awareness is insufficient on its own, users must receive clear information about cookies being set and the ability to refuse them. The requirement is that users have both awareness of their ability to control settings and are informed about the cookies, creating a basis for informed consent through browser configuration.
Why the other options are wrong
- A. Rejecting strictly necessary cookies through browser settings is not valid; these cookies are exempt from consent requirements because they are essential for service functionality.
- C. While users must be provided information about cookies, this alone is not sufficient to rely on browser settings without also ensuring they are aware of their ability to adjust those settings.
- D. It is not possible or necessary to make browser choices completely impossible to bypass; regulations require opt-in consent mechanisms, not technical impossibility of refusal.
Question 22
A well-known video production company, based in Spain but specializing in documentaries filmed worldwide, has just finished recording several hours of footage featuring senior citizens in the streets of Madrid. Under what condition would the company NOT be required to obtain the consent of everyone whose image they use for their documentary?
Show answer and explanation
Correct answer: A. If obtaining consent is deemed to involve disproportionate effort.
Under GDPR Article 6 and recital 47, consent may not be required when obtaining it would involve disproportionate effort relative to the number of data subjects. For a documentary filmed in public spaces with many incidental participants, tracking down every person for consent could be impractical. Article 85 also allows member states to provide exemptions for journalism and documentary purposes when proportionality concerns exist. Option D incorrectly suggests legitimate interest alone exempts from consent requirements for image processing.
Why the other options are wrong
- B. GDPR consent requirements are not made voluntary by local legislation; Article 6 establishes the legal basis hierarchy uniformly.
- C. Age of data subjects does not eliminate consent requirements under GDPR.
- D. Legitimate interest does not automatically exempt controllers from obtaining consent for processing personal images; Article 6(1)(a) requires explicit consent for this sensitive processing.
Question 23
In the event of a data breach, which type of information are data controllers NOT required to provide to either the supervisory authorities or the data subjects?
Show answer and explanation
Correct answer: C. The type of security safeguards used to protect the data.
When notifying data subjects and supervisory authorities of a personal data breach under Article 33-34 of the GDPR, controllers must communicate the likely consequences of the breach, measures taken to address it, and contact details of the Data Protection Officer or point of contact. However, controllers are not required to disclose the specific technical security safeguards used to protect data, as this information could compromise security by revealing defensive mechanisms to potential attackers.
Why the other options are wrong
- A. Controllers must communicate the predicted or likely consequences of the breach to both authorities and subjects.
- B. Controllers must describe the measures being taken or proposed to address the breach and mitigate harm.
- D. Controllers must provide contact details of the Data Protection Officer or responsible contact person in breach notifications.
Question 24
After leaving the EU under the terms of Brexit, the United Kingdom will seek an adequacy determination. What is the reason for this?
Show answer and explanation
Correct answer: C. The UK is now a third country because it’s no longer subject to the GDPR.
Following Brexit, the United Kingdom became a third country no longer bound by EU law or the GDPR. An adequacy determination is necessary for data transfers from the EU to the UK to proceed lawfully, as the GDPR requires appropriate safeguards when personal data is transferred to countries outside the EU/EEA. Without an adequacy decision from the European Commission, transfers would require alternative mechanisms such as Standard Contractual Clauses.
Why the other options are wrong
- A. The Insurance Commissioner has no role in determining GDPR adequacy requirements.
- B. While adequacy decisions may be affected by status changes, they do not automatically lapse; rather, the UK's new status as a third country requires a fresh determination.
- D. Trustworthiness assessments are based on legal frameworks and data protection standards, not political judgment about a country's character.
Question 25
In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?
Show answer and explanation
Correct answer: B. Where the DPIA identifies high risks to individuals’ rights and freedoms that the controller can take steps to reduce.
According to Article 36 of the GDPR, a controller must consult the supervisory authority prior to processing when a Data Protection Impact Assessment indicates high risks to the rights and freedoms of data subjects that the controller intends to address through mitigation measures. This consultation occurs when residual risks remain significant after applying technical and organizational measures. The other scenarios, international transfers, sensitive data collection, or business insurance needs, do not automatically trigger mandatory supervisory authority consultation under DPIA provisions.
Why the other options are wrong
- A. International transfers may require transfer mechanism safeguards but do not automatically trigger mandatory DPIA consultation.
- C. Collecting sensitive data of EU citizens requires careful processing but does not inherently require supervisory consultation post-DPIA.
- D. Business insurance interests are not a basis for mandatory supervisory authority consultation under GDPR Article 36.
Question 26
In which of the following situations would an individual most likely to be able to withdraw her consent for processing?
Show answer and explanation
Correct answer: D. When she no longer wishes to be sent marketing materials from an organization.
An individual can most readily withdraw consent for marketing materials because this processing is typically based on explicit consent without other legal justifications. Marketing consent is voluntary and withdrawal can be straightforward. In contrast, scenarios A and B involve ongoing legal relationships (banking, employment) with multiple processing bases, and scenario C involves medical records subject to legal obligations, making withdrawal more complicated.
Why the other options are wrong
- A. Changing banks does not automatically enable consent withdrawal; the bank may have other legal bases for processing related to the banking relationship itself.
- B. Leaving a company does not automatically permit consent withdrawal for employment-related processing that may continue under other legal bases.
- C. Medical records are subject to legal and professional obligations that typically override simple consent withdrawal.
Question 27
Which sentence best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?
Show answer and explanation
Correct answer: B. All employees are subject to the rules in their entirety, regardless of where the work is taking place.
Binding Corporate Rules establish internal policies that apply uniformly across an international organization to ensure consistent data protection standards. A key characteristic of BCRs is that all employees, regardless of their location or the jurisdiction where they work, are bound by the same set of privacy rules. This creates a unified compliance framework across the entire multinational organization. Ad hoc agreements are not required for each transfer, employees do not follow local jurisdiction regulations in addition to BCRs, and certification does not exempt employees from legal enforcement.
Why the other options are wrong
- A. BCRs eliminate the need for ad hoc contractual agreements for each data export between affiliated entities.
- C. BCRs provide uniform rules across all jurisdictions; employees do not follow different local regulations in addition to BCRs.
- D. Employees subject to BCRs are not exempt from legal enforcement; BCRs do not eliminate legal liability.
Question 28
WP29’s “Guidelines on Personal data breach notification under Regulation 2016/679’’ provides examples of ways to communicate data breaches transparently. Which of the following was listed as a method that would NOT be effective for communicating a breach to data subjects?
Show answer and explanation
Correct answer: C. A notice on a corporate blog
WP29's guidelines on breach notification emphasize that communication must be effective and reach data subjects reliably. A notice on a corporate blog is not an effective method because it relies on data subjects actively visiting the website to discover the notification, rather than proactively delivering information to them. Postal notifications, direct electronic messages, and prominent print advertisements all actively reach or directly inform data subjects, whereas a blog notice is passive and may be easily missed.
Why the other options are wrong
- A. Postal notification is an effective method that actively delivers breach information to data subjects at their registered addresses.
- B. Direct electronic messages are among the most effective methods for communicating breaches to data subjects.
- D. Prominent print media advertisements actively disseminate breach information to large audiences.
Question 29
According to the GDPR, when should the processing of photographs be considered processing of special categories of personal data?
Show answer and explanation
Correct answer: C. When processed with the intent to uniquely identify or authenticate a natural person.
Photographs become special categories of personal data when processed specifically to uniquely identify or authenticate a natural person, as this constitutes biometric data processing. This is when photographs move from ordinary personal data to the heightened protection level of special categories under Article 9.
Why the other options are wrong
- A. Publishing photographs on public media does not automatically classify them as special categories unless used for identification or authentication.
- B. Scientific or historical research projects do not independently convert photographs into special categories of personal data.
- D. Compliance with law does not determine whether photographs are special categories; the processing purpose and method do.
Question 30
As a result of the European Court of Justice’s ruling in the case of Google v. Spain, search engines outside the EEA are also likely to be subject to the Regulation’s right to be forgotten. This holds true if the activities of an EU subsidiary and its U.S. parent are what?
Show answer and explanation
Correct answer: D. Inextricably linked in their businesses.
In Google v. Spain, the ECJ established that the right to be forgotten can apply to search engines outside the EEA when the EU subsidiary and non-EEA parent company are inextricably linked in their business operations. This 'inextricable linkage' doctrine means that control and integrated business activities establish sufficient connection to GDPR jurisdiction.
Why the other options are wrong
- A. Supervision by the same Data Protection Officer is not the determining factor for extraterritorial application of the right to be forgotten.
- B. Privacy Shield (now Schrems II standard contractual clauses) relates to data transfer mechanisms, not the jurisdictional reach of the right to be forgotten.
- C. Standard contractual clauses govern lawful transfer of data but are not the basis for extending portability rights extraterritorially in the Google v. Spain context.
Question 31
In 2016’s Guidance, the United Kingdom’s Information Commissioner’s Office (ICO) reaffirmed the importance of using a “layered notice” to provide data subjects with what?
Show answer and explanation
Correct answer: A. A privacy notice containing brief information whilst offering access to further detail.
The ICO's 2016 Guidance on layered notices describes a tiered approach to transparency where data subjects receive concise key information upfront with links or references to fuller details available separately. This approach balances the need to provide complete transparency (Article 13/14 requirements) while avoiding information overload at the point of collection or interaction.
Why the other options are wrong
- B. Cookie opt-out consequences are a specific privacy matter, not the primary purpose of layered notice guidance.
- C. Security measures explanation is part of privacy notices but not the specific purpose of layering structures.
- D. Layered notices facilitate information provision, not structured consent collection.
Question 32
Under the GDPR, which essential pieces of information must be provided to data subjects before collecting their personal data?
Show answer and explanation
Correct answer: C. The identity and contact details of the controller and the reasons the data is being collected.
Article 13 GDPR specifies essential information that must be provided before collecting personal data, with the identity and contact details of the controller being the foundational requirement, along with the purposes of processing. These two pieces form the core transparency foundation that data subjects need to understand who is collecting their data and why.
Why the other options are wrong
- A. While third-party recipients are important, they are not listed as essential pre-collection information; reasons for collection are more fundamental.
- B. Government agency involvement is not a universal pre-collection requirement, and data revision steps are not standard pre-collection information.
- D. Contact information and retention policy alone omit the critical purposes-of-processing requirement.
Question 33
What must a data controller do in order to make personal data pseudonymous?
Show answer and explanation
Correct answer: A. Separately hold any information that would allow linking the data to the data subject.
Pseudonymization under the GDPR is defined as processing personal data in such a manner that it can no longer be attributed to a data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures. The data controller must separately maintain and protect any information that would allow re-identification, ensuring that the pseudonymized data and identifying information are kept apart.
Why the other options are wrong
- B. Encryption alone does not constitute pseudonymization; encrypted data can still be decrypted by the holder of the key.
- C. Pseudonymization requires maintaining separate identifying information, not disposing of it.
- D. Aggregated data for research is a different concept from pseudonymization and does not describe the pseudonymization process itself.
Question 34
What should a controller do after a data subject opts out of a direct marketing activity?
Show answer and explanation
Correct answer: C. Refrain from processing personal data relating to the data subject for the relevant type of communication.
When a data subject opts out of direct marketing, the controller must refrain from processing their personal data for that particular type of communication without undue delay. This respects the data subject's right to object to processing for direct marketing purposes. The controller must honor the opt-out request and stop all related marketing communications. This is distinct from deleting all data, which is not required, and notifying third parties, which is not a primary obligation, the focus is on the controller's own cessation of that processing activity.
Why the other options are wrong
- A. GDPR does not require deletion of all personal data upon opt-out from marketing; data may be retained for other lawful purposes.
- B. While providing information is good practice, the primary obligation is to refrain from processing, not to inform about actions.
- D. The controller is not primarily obligated to notify third-party recipients about an individual's opt-out unless there is a specific data processing agreement requiring it.
Question 35
When would a data subject NOT be able to exercise the right to portability?
Show answer and explanation
Correct answer: A. When the processing is necessary to perform a task in the exercise of authority vested in the controller.
Article 20 of the GDPR establishes the right to data portability, but this right does not apply when processing is necessary to perform a task in the exercise of authority vested in the controller (such as public authorities exercising official functions). Portability rights do apply to processing based on contract, consent, and data supplied by the subject.
Why the other options are wrong
- B. Processing pursuant to a contract is explicitly one of the bases where portability rights apply under Article 20.
- C. Data supplied by the data subject is subject to portability rights; the source does not eliminate the right.
- D. Consent-based processing is one of the primary bases where portability rights are exercisable.
Question 36
Which EU institution is vested with the competence to propose new data protection legislation on its own initiative?
Show answer and explanation
Correct answer: C. The European Commission
Under the EU institutional framework, the European Commission holds the exclusive right to propose new legislation on its own initiative. This is known as the Commission's monopoly on legislative initiative. While the European Parliament can request the Commission to propose legislation and the Council represents member states, only the Commission can formally initiate legislation.
Why the other options are wrong
- A. The European Council sets political direction but does not have the power to propose legislation.
- B. The European Parliament can request proposals and amend proposed legislation but cannot independently propose new laws.
- D. The Council of the European Union negotiates and adopts legislation but does not have the power to initiate it.
Question 37
Which of the following is one of the supervisory authority’s investigative powers?
Show answer and explanation
Correct answer: A. To notify the controller or the processor of an alleged infringement of the GDPR.
Article 58 of GDPR explicitly lists the investigative powers of supervisory authorities, which include the power to notify controllers or processors of alleged infringements of the GDPR. This notification is a formal investigative step enabling the authority to alert entities of potential violations and request information or corrective actions. Requiring adoption of certification mechanisms, determining judicial remedies, and demanding notification of all new processing activities are not listed investigative powers under Article 58.
Why the other options are wrong
- B. Authorities may recommend certification but cannot require its adoption as an investigative power.
- C. Supervisory authorities do not determine judicial remedies; that is a function of courts.
- D. Authorities cannot require blanket notification of all new processing activities; notification requirements are limited to specific high-risk activities.
Question 38
Which area of privacy is a lead supervisory authority’s (LSA) MAIN concern?
Show answer and explanation
Correct answer: C. Cross-border processing
The lead supervisory authority's primary responsibility under GDPR's One-Stop-Shop mechanism is to coordinate and manage cross-border processing activities where a controller has establishments or significant processing in multiple member states. This ensures consistent application of GDPR rules across borders.
Why the other options are wrong
- A. Data subject rights are handled by any relevant supervisory authority, not exclusively the lead authority.
- B. Data access disputes are individual matters handled by the competent authority for that data subject.
- D. Special categories of data require general privacy compliance measures, not specifically the LSA's main concern.
Question 39
What permissions are required for a marketer to send an email marketing message to a consumer in the EU?
Show answer and explanation
Correct answer: A. A prior opt-in consent for consumers unless they are already customers.
Under EU law, prior opt-in consent is required for email marketing to consumers unless they are already existing customers. This aligns with the ePrivacy Directive's requirement for prior consent before sending unsolicited direct marketing communications. Existing customers may qualify under a soft opt-in exception, but in all other cases, affirmative opt-in consent is mandatory. Pre-checked boxes, mere notices, and opt-out-only approaches do not satisfy the strict consent requirements under EU regulations.
Why the other options are wrong
- B. Pre-checked boxes do not constitute valid consent under GDPR principles, which require affirmative, unambiguous action by the data subject.
- C. A notice alone without obtaining affirmative consent does not meet the regulatory requirements for email marketing.
- D. Opt-out-only approaches are not compliant with EU law; prior opt-in consent is required except in limited circumstances.
Question 40
What must be included in a written agreement between the controller and processor in relation to processing conducted on the controller’s behalf?
Show answer and explanation
Correct answer: D. An obligation on the processor to assist the controller in complying with the controller’s obligations to notify the supervisory authority about personal data breaches.
Article 28(3) of the GDPR requires the written agreement between controller and processor to include an obligation on the processor to assist the controller in complying with the controller's obligations regarding personal data breach notification to supervisory authorities. This reflects the processor's supporting role in the controller's breach management obligations.
Why the other options are wrong
- A. While processors must report breaches, the 72-hour notification requirement applies to the controller reporting to the authority, not the processor's internal reporting deadline to the controller.
- B. The obligation to report to supervisory authorities rests with the controller, not both parties equally; the processor assists the controller in this obligation.
- C. GDPR does not require automatic termination of processor-controller agreements based on a breach; breach handling and remediation are addressed instead.
Question 41
Which of the following entities would most likely be exempt from complying with the GDPR?
Show answer and explanation
Correct answer: D. A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.
The GDPR applies extraterritorially to any organization processing personal data of EU residents, regardless of where the organization is located. A North American company servicing customers in South Africa using a European cloud storage system would likely not be collecting personal data of EU residents, and therefore would not fall under GDPR's territorial scope. By contrast, options A, B, and C all involve organizations either collecting data from EU customers or being established in an EU member state, triggering GDPR compliance obligations.
Why the other options are wrong
- A. A South American company regularly collecting European customers' data falls under GDPR as it targets EU residents.
- B. An EU-headquartered company falls under GDPR regardless of where data is stored due to establishment in the Union.
- C. A Chinese company with a satellite office in an EU member state falls under GDPR due to establishment in the EU and servicing European customers.
Question 42
Which type of personal data does the GDPR define as a “special category” of personal data?
Show answer and explanation
Correct answer: B. Trade-union membership.
The GDPR defines special categories of personal data under Article 9 to include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes, and data concerning health or sex life. Trade union membership is explicitly listed as a special category requiring enhanced protection, whereas educational history, CCTV footage (general), and financial information do not receive this heightened classification.
Why the other options are wrong
- A. Educational history is not classified as a special category under GDPR Article 9.
- C. CCTV footage is not automatically a special category; it depends on what it reveals about individuals.
- D. Financial information is not designated as a special category under the GDPR.
Question 43
A mobile device application that uses cookies will be subject to the consent requirement of which of the following?
Show answer and explanation
Correct answer: A. The ePrivacy Directive
The ePrivacy Directive explicitly requires prior consent before storing or accessing information on users' devices via cookies, with limited exceptions. Any mobile application using cookies must comply with this consent requirement. The ePrivacy Directive is the specific regulatory instrument that governs electronic communications and privacy in electronic networks, including cookie usage. The other directives address different regulatory areas and do not contain specific cookie consent requirements.
Why the other options are wrong
- B. The E-Commerce Directive addresses online commerce and digital services but does not specifically regulate cookie consent.
- C. The Data Retention Directive concerns retention periods for communications data, not cookie consent requirements.
- D. The EU Cybersecurity Directive focuses on network and information security, not cookie consent mechanisms.
Question 44
SCENARIO Please use the following to answer the next question: Zandelay Fashion (‘Zandelay’) is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company’s compliance with the General Data Protection Regulation (GDPR) and other privacy legislation. The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers. In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company’s customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures. Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme. Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay’s business plan and associated processing activities. What must Zandelay provide to the supervisory authority during the prior consultation?
Show answer and explanation
Correct answer: B. An explanation of the purposes and means of the intended processing.
Under GDPR Article 36, when a controller is required to undertake prior consultation with a supervisory authority, the controller must provide information about the purposes and means of the intended processing, along with the necessity and proportionality assessments and risk mitigation measures. This allows the supervisory authority to evaluate whether the processing poses high risks to data subject rights. Option A regarding complexity is not explicitly required. Option C regarding explicit consent records is not a mandatory consultation requirement. Option D regarding professional qualifications is not required for prior consultation.
Why the other options are wrong
- A. While complexity may be discussed, an evaluation of complexity is not explicitly required to be provided during prior consultation.
- C. Consent records are not required to be submitted during prior consultation; the consultation focuses on assessing risks of the intended processing.
- D. Certificates of Martin's professional qualifications are not required for prior consultation; the focus is on the processing activities and their risks.
Question 45
What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?
Show answer and explanation
Correct answer: B. CJEU can force national governments to implement and honor EU law, while the ECHR cannot.
A key functional difference is that the CJEU can enforce EU law compliance and compel national governments to implement and honor EU legislation through mechanisms such as infringement procedures and preliminary rulings. While the ECHR can declare violations of human rights, its enforcement mechanisms are more limited in terms of direct power over national government implementation of specific legislation.
Why the other options are wrong
- A. The CJEU also has jurisdiction over privacy as a fundamental right under the Charter of Fundamental Rights and the GDPR.
- C. The ECHR does hear appeals on human rights issues from national courts through individual petitions; the CJEU's role is different but not uniquely broader in this respect.
- D. The CJEU's ability to compel implementation through EU law enforcement is actually stronger than the ECHR's capacity in this regard.
Question 46
Under Article 58 of the GDPR, which of the following describes a power of supervisory authorities in European Union (EU) member states?
Show answer and explanation
Correct answer: B. The right to access data for investigative purposes.
Article 58 of the GDPR grants supervisory authorities the right to access personal data and information held by controllers and processors for investigative purposes. This power is essential to enable DPAs to fulfill their enforcement and monitoring responsibilities under the regulation.
Why the other options are wrong
- A. Supervisory authorities exercise regulatory and investigative powers, not legislative authority to enact laws.
- C. DPAs are independent authorities that cannot act at the discretion of elected officials; they must follow GDPR requirements.
- D. Supervisory authorities issue administrative decisions and fines themselves; they do not select penalties based on court convictions.
Question 47
A worker in a European Union (EU) member state has ceased his employment with a company. What should the employer most likely do in regard to the worker’s personal data?
Show answer and explanation
Correct answer: C. Securely store the data that is required to be kept under local law.
Upon termination of employment, an employer must retain an employee's personal data only where required by applicable data protection and employment laws. This includes data needed for legal obligations such as tax records, pension contributions, and dispute resolution. The employer should securely store only the data that must be kept under local legal requirements and delete or anonymize the rest. This approach balances the employer's legitimate legal obligations with the GDPR principle of storage limitation.
Why the other options are wrong
- A. While destroying unnecessary sensitive information is good practice, this option fails to account for the mandatory legal retention requirements that employers must observe.
- B. Storing all data indefinitely violates the storage limitation principle of the GDPR and creates unnecessary privacy risks; data should be retained only where required.
- D. The employer is not required to provide reasons for retention to the departing employee; instead, they must comply with applicable legal retention requirements.
Question 48
In which situation would a data controller most likely be able to justify the processing of the data of a child without parental consent?
Show answer and explanation
Correct answer: B. When providing preventive or counselling services to the child.
Under GDPR, processing a child's data without parental consent is most justified when providing preventive or counselling services directly to the child. These services are recognized exceptions where the child's welfare takes precedence and parental consent requirements may be waived to protect the child's interests.
Why the other options are wrong
- A. Market research does not constitute a justified exception to parental consent requirements for children's data.
- C. Educational materials alone do not provide a legal basis to bypass parental consent for processing children's personal data.
- D. Legitimate business interests cannot override the requirement for parental consent when processing children's data under GDPR.
Question 49
In which of the following cases would an organization MOST LIKELY be required to follow both ePrivacy and data protection rules?
Show answer and explanation
Correct answer: B. When calling a potential customer to notify her of an upcoming product sale.
Calling a potential customer to notify them of an upcoming product sale involves electronic direct marketing via telephone, which falls under ePrivacy rules (specifically the ePrivacy Directive requirements for prior consent for unsolicited marketing calls), while also processing personal data, thereby triggering data protection rules. This dual obligation occurs because both the communication method and the data handling are regulated. The other options involve either untargeted advertising, transactional communication, or paid search results, none of which trigger the same dual regulatory requirements.
Why the other options are wrong
- A. Untargeted pop-ups on websites are typically not considered direct marketing and do not require ePrivacy consent in the same way.
- C. Emails announcing order status to existing customers fall under transactional communication exemptions and do not require the same ePrivacy consent.
- D. Paid search prominence is commercial advertising placement and does not involve direct marketing communication that triggers ePrivacy consent rules.
Question 50
A German data subject was the victim of an embarrassing prank 20 years ago. A newspaper website published an article about the prank at the time, and the article is still available on the newspaper’s website. Unfortunately, the prank is the top search result when a user searches on the victim’s name. The data subject requests that SearchCo delist this result. SearchCo agrees, and instructs its technology team to avoid scanning or indexing the article. What else must SearchCo do?
Show answer and explanation
Correct answer: C. Identify other controllers who are processing the same information and inform them of the delisting request.
When a search engine delists results based on a right to be forgotten request, it must identify other controllers (such as the original content creator) who are processing the same personal information and inform them of the delisting request. This ensures transparency and allows other processors to understand why their content is no longer being indexed in searches.
Why the other options are wrong
- A. While notification to the newspaper may be good practice, it is not a mandatory GDPR obligation for the search engine in a delisting context.
- B. Delisting (removing from search results) is the appropriate remedy; full erasure of the URL would be an excessive obligation on the search engine, which is not the original publisher.
- D. Deindexing need only occur for searches on the data subject's name or identifying information; preventing indexing for all possible search terms is not required.
Question 51
A U.S.-based online shop uses sophisticated software to track the browsing behavior of its European customers and predict future purchases. It also shares this information with third parties. Under the GDPR, what is the online shop’s PRIMARY obligation while engaging in this kind of profiling?
Show answer and explanation
Correct answer: A. It must solicit informed consent through a notice on its website
Under GDPR, profiling that involves tracking behavior and sharing data with third parties constitutes processing of personal data that typically requires explicit informed consent. The primary obligation is to obtain this consent through transparent notice mechanisms like website notifications. While supervisory authority authorization, business relationship documentation, and security measures are important considerations, the fundamental prerequisite for lawful profiling is obtaining informed consent from data subjects.
Why the other options are wrong
- B. Supervisory authority authorization is not the primary mechanism for lawful profiling; consent from data subjects is.
- C. A prior business relationship is not a legal basis that eliminates the need for consent in profiling scenarios.
- D. Security safeguards are necessary but address data protection, not the initial lawfulness of the profiling activity itself.
Question 52
SCENARIO Please use the following to answer the next question: Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees’ computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees’ computers. Since these measures would potentially impact employees, Building Block’s Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches. After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees’ computers activity and their location. During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased. Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company’s computers, and from working remotely without authorization. What would be the MOST APPROPRIATE way for Building Block to handle the situation with the employee from Italy?
Show answer and explanation
Correct answer: C. Since the employee was not informed that the security measures would be used for other purposes such as monitoring, the company could face difficulties in applying any disciplinary measures to this employee.
Under GDPR, employers must have a lawful basis for processing employee personal data, including monitoring. Article 6 requires a valid legal ground, and Article 13/14 mandate transparency about data processing purposes. Although Building Block issued a general notice about security initiatives, it did not explicitly inform employees that SecurityScan would be used for ongoing monitoring of computer activity and location, purposes beyond the stated goal of identifying unsupported software. The company only disclosed the purpose narrowly (vulnerability scanning) but then used the tool for broader surveillance purposes without specific informed consent or clear notice of this secondary use. Consequently, any disciplinary action based on data collected for undisclosed monitoring purposes would face legal challenges under GDPR, as the data collection itself lacked proper lawful basis and transparency.
Why the other options are wrong
- A. GDPR does apply to this situation because the processing affects EU residents (Italian and German employees) and occurs within EU territory, making extraterritorial GDPR application mandatory regardless of the company's US headquarters.
- B. While the infringement was serious, GDPR requires that disciplinary measures be based on lawfully processed data; since the monitoring lacked proper notice and lawful basis for its broader surveillance purpose, dismissal cannot be justified on this data.
- D. This option incorrectly suggests that limited disclosure about consequences would cure the fundamental problem, the company failed to disclose the monitoring purposes at all, not merely omitted details about consequences.
Question 53
What was the aim of the European Data Protection Directive 95/46/EC?
Show answer and explanation
Correct answer: D. To further reconcile the protection of the fundamental rights of individuals with the free flow of data from one member state to another.
The Data Protection Directive 95/46/EC aimed to reconcile two important objectives: protecting individuals' fundamental rights to privacy and data protection while enabling the free flow of personal data between EU member states. The directive sought to establish a harmonized level of data protection that would allow data transfers across borders within the EU without compromising individual rights. This balance between protection and free flow was central to the directive's design, facilitating both economic activity and fundamental rights protection within the single market.
Why the other options are wrong
- A. The directive addressed data protection specifically, not the broader implementation of the European Convention of Human Rights.
- B. While influenced by OECD Guidelines, the directive was not primarily intended to implement them.
- C. The directive did not aim to prevent data transfers; it aimed to enable free flow while ensuring adequate protection.
Question 54
A Spanish electricity customer calls her local supplier with questions about the company’s upcoming merger. Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?
Show answer and explanation
Correct answer: D. Verify that the identity of the customer can be proven by other means.
Article 13 GDPR requires controllers to provide information to data subjects, but this obligation is conditional on verifying the requestor's identity. Before providing information about data recipients following a merger, the company must confirm the caller is actually the data subject (or authorized representative) to prevent unauthorized disclosure of personal information. This is a fundamental security safeguard.
Why the other options are wrong
- A. The applicability of pre-GDPR data is not a prerequisite for responding to Article 13 requests about current processing.
- B. The company need not assess whether the customer's purpose aligns with GDPR; individuals have unconditional rights to information about their data under Article 13.
- C. Whether information has previously been sent does not affect the obligation to provide it again upon request.
Question 55
To provide evidence of GDPR compliance, a company performs an internal audit. As a result, it finds a data base, password-protected, listing all the social network followers of the client. Regarding the domain of the controller-processor relationships, how is this situation considered?
Show answer and explanation
Correct answer: B. Non-compliant, because the storage of the data exceeds the tasks contractually authorized by the controller.
A processor storing a database of social network followers beyond what the controller authorized violates the processor's obligations under Article 28. Processors must process personal data only on instructions from the controller and only to the extent necessary for the authorized purposes. Password protection addresses security but does not cure the fundamental non-compliance of unauthorized data storage.
Why the other options are wrong
- A. Password protection alone does not ensure compliance; the core issue is that the processor is storing data beyond the controller's contractual authorization, violating the purpose and scope of processing.
- C. Password protection does not exempt the processor from GDPR obligations; the data remains subject to regulation regardless of technical safeguards.
- D. Storage limitation applies to retention periods for authorized data, not to unauthorized data storage; compliance requires ceasing unauthorized storage, not merely deleting it after audit discovery.
Question 56
Under the GDPR, who would be LEAST likely to be allowed to engage in the collection, use, and disclosure of a data subject’s sensitive medical information without the data subject’s knowledge or consent?
Show answer and explanation
Correct answer: D. A journalist writing an article relating to the medical condition in question, who believes that the publication of such information is in the public interest.
Under GDPR Article 9, processing special category data (including medical information) without consent is generally prohibited, but exceptions exist for healthcare professionals, public authorities protecting public health, judicial proceedings, and other specified purposes. However, journalists are not granted a blanket exemption to process medical data without consent based on perceived public interest. While journalism can rely on public task exceptions in some contexts, the GDPR does not broadly exempt journalists from the prohibition on processing medical data without consent.
Why the other options are wrong
- A. Members of the judiciary have legitimate grounds to process medical data when adjudicating disputes involving health matters.
- B. Public authorities can process medical data without consent when necessary to protect public health.
- C. Health professionals treating the data subject can process medical data without consent when necessary for medical care.
Question 57
In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?
Show answer and explanation
Correct answer: D. A railway operator who plans to evaluate the same video surveillance in all the train stations of his company.
According to WP29 guidance, a single Data Protection Impact Assessment may address multiple processing operations when they share similar characteristics, risks, and mitigation measures. The scenario of a railway operator evaluating video surveillance across all train stations of the company exemplifies this, the same surveillance technology, similar purposes (security and monitoring), identical risks, and comparable safeguards apply consistently across locations. This differs from genetic testing (new technology), relying on another entity's DPIA (insufficient controller ownership), or extending from one data type to another (different processing characteristics).
Why the other options are wrong
- A. Genetic testing represents a substantially different processing operation with distinct risks, requiring its own DPIA.
- B. Controllers cannot rely solely on a provider's DPIA; they must independently assess their own processing operations.
- C. Adding mailing address collection to existing email data collection represents materially different processing requiring separate DPIA assessment.
Question 58
In which scenario is a Controller most likely required to undertake a Data Protection Impact Assessment?
Show answer and explanation
Correct answer: B. When personal data is being collected and combined with other personal data to profile the creditworthiness of individuals.
A Data Protection Impact Assessment is most likely required when personal data collection and combination with other data creates a profiling system that evaluates creditworthiness. This involves automated decision-making and profiling with significant effects on individuals' legal or financial status, which Article 35(3)(a) of the GDPR identifies as a high-risk processing category requiring mandatory DPIA. Email collection for marketing (scenario A) represents lower-risk processing. Having a DPO (scenario C) does not itself trigger DPIA requirements. Transfers outside the EEA (scenario D) may require additional safeguards but do not inherently require DPIA unless other high-risk factors exist.
Why the other options are wrong
- A. Simple email collection for marketing represents standard low-risk processing not typically requiring DPIA.
- C. The requirement to have a Data Protection Officer does not automatically trigger DPIA obligations.
- D. International data transfers alone do not automatically mandate DPIA unless combined with other high-risk processing characteristics.
Question 59
What are the obligations of a processor that engages a sub-processor?
Show answer and explanation
Correct answer: D. The processor must obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor.
Article 28 of the GDPR requires that a processor engaging a sub-processor must obtain prior specific or general written authorization from the controller and ensure the sub-processor complies with data protection obligations equivalent to those binding the processor. The sub-processor must be subject to the same confidentiality and security obligations as the main processor.
Why the other options are wrong
- A. Prior authorization is required, but a preliminary audit is not mandated as a blanket requirement under Article 28.
- B. Annual reporting on sub-processor performance is not a specific GDPR requirement, and consent (rather than authorization) is not the correct term.
- C. While the sub-processor's contractual terms matter, the requirement is not that they be 'fully liable' to the controller, but rather bound by equivalent obligations.
Question 60
According to Article 14 of the GDPR, how long does a controller have to provide a data subject with necessary privacy information, if that subject’s personal data has been obtained from other sources?
Show answer and explanation
Correct answer: C. Within a reasonable period after obtaining the personal data, but no later than one month.
Article 14 of the GDPR requires controllers to provide privacy information to data subjects whose personal data has been obtained from other sources within a reasonable period, but no later than one month after obtaining the personal data. This one-month deadline is a specific requirement that balances the need for timely disclosure against practical implementation constraints.
Why the other options are wrong
- A. While timeliness is important, GDPR does not require information to be provided 'as soon as possible' without a defined timeframe, it specifies a one-month maximum.
- B. The timeline is measured from when the personal data is obtained, not from the first communication with the data subject.
- D. Eight weeks exceeds the one-month maximum deadline specified in Article 14.
Question 61
An employee of company ABCD has just noticed a memory stick containing records of client data, including their names, addresses and full contact details has disappeared. The data on the stick is unencrypted and in clear text. It is uncertain what has happened to the stick at this stage, but it likely was lost during the travel of an employee. What should the company do?
Show answer and explanation
Correct answer: A. Notify as soon as possible the data protection supervisory authority that a data breach may have taken place.
Under GDPR Article 33, a personal data breach must be notified to the supervisory authority without undue delay and in any case not later than 72 hours after becoming aware of it. Since the company has discovered the loss of an unencrypted memory stick containing personal data, this constitutes a reportable breach that should be notified as soon as possible to the data protection authority. Option B's one-month waiting period violates the 72-hour requirement. Option C's disproportionate effort exception does not apply to breach notification obligations. Option D is premature without first assessing the actual risk to data subjects.
Why the other options are wrong
- B. The 72-hour notification requirement cannot be postponed for a month; investigation can occur in parallel with notification.
- C. The disproportionate effort exception under Article 34 applies to data subject notification, not supervisory authority notification under Article 33.
- D. Data subjects should only be notified if there is high risk to their rights and freedoms; immediate notification of all customers is premature before risk assessment.
Question 62
A company in France suffers a robbery over the weekend owing to a faulty alarm system. When it is determined that the break-in involves the loss of a substantial amount of data, the company decides on a CCTV system to monitor for future incidents. Company technicians install cameras in the entrance of the building, hallways and offices. Footage is recorded continuously, and is monitored by the home office in the United States. What is the most realistic step the company could take to address their security concerns and comply with the personal data processing principles set out in Article 5 of the GDPR?
Show answer and explanation
Correct answer: D. Restrict camera placement to building entrances only.
Under Article 5 of the GDPR, personal data processing must follow principles including data minimization and purpose limitation. Installing cameras in offices and hallways captures personal data of employees and visitors far beyond what is necessary to address the stated security concern of robberies at building entrances. Restricting camera placement to building entrances only satisfies the data minimization principle by limiting surveillance to the specific areas relevant to the security threat, while still providing effective security against future break-ins.
Why the other options are wrong
- A. Seeking informed consent does not address the core issue of excessive data collection; the problem is the overly broad surveillance scope itself.
- B. Recording only during work hours still involves unnecessary surveillance of employee movements within offices and hallways, failing to address data minimization.
- C. A 30-day retention period addresses storage limitation but does not solve the fundamental problem of excessive data collection through cameras in offices and hallways.
Question 63
SCENARIO Please use the following to answer the next question: Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees’ computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees’ computers. Since these measures would potentially impact employees, Building Block’s Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches. After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees’ computers activity and their location. During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased. Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company’s computers, and from working remotely without authorization. In addition to notifying employees about the purpose of the monitoring, the potential uses of their data and their privacy rights, what information should Building Block have provided them before implementing the security measures?
Show answer and explanation
Correct answer: B. Information about who employees should contact with any queries.
GDPR Articles 13 and 14 require controllers to provide specific information to data subjects, including the identity of the controller and contact details of the Data Protection Officer or responsible contact person. Before implementing data processing activities, employees must know who to contact with questions about the processing, their rights, or concerns. The scenario states the company notified employees about purpose, potential uses, and privacy rights, but this does not substitute for providing contact information for queries, a distinct and mandatory transparency requirement. Option B addresses this critical gap in the disclosure obligations.
Why the other options are wrong
- A. Employment contract terms are not a GDPR transparency requirement; GDPR applies independent of contractual arrangements and requires statutory notice separate from employment contracts.
- C. GDPR does not require employers to explain how consent affects employment status; moreover, workplace monitoring is typically justified under legitimate interest or legal obligation rather than consent.
- D. GDPR requires transparency about legal bases and controller interests, not promotional claims about company benefit; the company's interests must be balanced against employee rights, not presented as justification for insufficient notice.
Question 64
Many businesses print their employees’ photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?
Show answer and explanation
Correct answer: B. Because photographs qualify as biometric data only when they undergo a “specific technical processing”.
Under the GDPR, biometric data is defined as personal data resulting from specific technical processing intended to identify a person. Ordinary photographs, even if they contain facial images, do not automatically qualify as biometric data unless they have undergone the specific technical processing necessary for identification purposes. Building pass photographs are typically stored and used as visual identification aids rather than as technically processed biometric identifiers, placing them outside the special category restrictions that would otherwise apply to biometric data.
Why the other options are wrong
- A. The GDPR does not provide a blanket exemption for biometric data used for identification purposes; the exemption depends on whether the data qualifies as biometric data in the first place.
- C. While consent can be a lawful basis for processing, explicit consent is not the reason this practice is permitted; the distinction lies in whether the data is classified as biometric data.
- D. Building pass photography is not typically justified under public interest exemptions; the practice is permitted because ordinary photographs do not meet the technical processing definition of biometric data.
Question 65
When hiring a data processor, which action would a data controller NOT be able to depend upon to avoid liability in the event of a security breach?
Show answer and explanation
Correct answer: C. Requiring that the processor directly notifies the appropriate supervisory authority.
Under GDPR Article 32 and 82, controllers cannot fully avoid liability by requiring processors to directly notify supervisory authorities. Controllers retain accountability for ensuring appropriate safeguards and for notifying authorities themselves when breaches occur. While documentation of due diligence, risk assessments, and evidence of selecting a qualified processor all support the controller's demonstration of compliance efforts, requiring the processor to handle supervisory notifications shifts responsibility inappropriately and does not protect the controller from liability.
Why the other options are wrong
- A. Documenting due diligence demonstrates the controller's compliance efforts and supports liability mitigation.
- B. Conducting risk assessments is a key step in selecting an appropriate processor and demonstrates reasonable care.
- D. Maintaining evidence of selecting the best available processor demonstrates reasonable care in processor selection.
Question 66
What is true if an employee makes an access request to his employer for any personal data held about him?
Show answer and explanation
Correct answer: D. The employer must supply any information held about an employee unless an exemption applies.
Under GDPR Article 15, a data subject has the right to obtain confirmation of and access to their personal data held by a controller. However, this right is not absolute, employers may refuse or restrict access when specific exemptions apply, such as protecting third-party rights, legal privilege, or public interest. The employer must supply information unless a valid exemption exists.
Why the other options are wrong
- A. Presence of third-party data does not automatically permit automatic decline; the data must be separated or redacted rather than withheld entirely.
- B. The format of data storage (electronic or paper) does not affect the right of access; both formats are covered equally.
- C. Employers cannot supply 'all information' without limitation; exemptions allow refusal or modification of the response.
Question 67
If a company is planning to use closed-circuit television (CCTV) on its premises and is concerned with GDPR compliance, it should first do all of the following EXCEPT?
Show answer and explanation
Correct answer: A. Notify the appropriate data protection authority.
For CCTV deployment under GDPR, a company should conduct a DPIA (option B), establish data retention policies (option C), and implement technical safeguards (option D). However, notification to the data protection authority is not universally required in all member states, some jurisdictions permit CCTV under lawful processing without prior notification, making A the exception to required actions.
Why the other options are wrong
- B. A data protection impact assessment is required because CCTV involves large-scale systematic monitoring and collection of personal data.
- C. Information retention policies for footage are essential to ensure data minimization and compliance with storage limitation principles.
- D. Safeguards against unauthorized access are mandatory technical and organizational measures required by GDPR Article 32.
Question 68
Which marketing-related activity is least likely to be covered by the provisions of Privacy and Electronic Communications Regulations (Directive 2002/58/EC)?
Show answer and explanation
Correct answer: A. Advertisements passively displayed on a website.
Advertisements passively displayed on a website are not marketing activities in the sense regulated by the Privacy and Electronic Communications Regulations. The PECR specifically targets direct marketing communications such as unsolicited emails, text messages, and calls. Passive website content viewed by users who voluntarily visit falls outside the scope of these regulations because it does not constitute a direct marketing communication sent to an individual.
Why the other options are wrong
- B. Cookie use for data collection is explicitly covered by PECR provisions requiring prior consent before non-essential cookies are placed.
- C. Text messages offering products are direct marketing communications that require prior consent under PECR.
- D. Marketing emails to existing customers are direct marketing communications covered by PECR, which requires either prior consent or an existing relationship with an opt-out right.
Question 69
The GDPR specifies fines that may be levied against data controllers for certain infringements. Which of the following infringements would be subject to the less severe administrative fine of up to 10 million euros (or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year)?
Show answer and explanation
Correct answer: B. Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default.
Failure to implement technical and organizational measures to ensure data protection by design and default (Article 32) is classified under GDPR Article 83(4) as a less severe infringement subject to fines up to 10 million euros or 2% of global turnover. This reflects the foundational importance of protective measures but at a lower tier than the most severe violations.
Why the other options are wrong
- A. Failure to demonstrate valid consent is a higher-tier violation subject to fines up to 20 million euros or 4% of turnover.
- C. Processing data incompatibly with its original purpose relates to core GDPR principles and attracts higher-tier penalties.
- D. Failure to provide data rectification rights is a higher-tier violation subject to more severe administrative fines.
Question 70
When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?
Show answer and explanation
Correct answer: A. When the data has been pseudonymized.
When personal data has been pseudonymized, the GDPR provides greater latitude for processing beyond the original collection purpose because pseudonymized data is not considered personal data in the same way. This reduces the restrictions typically imposed by the purpose limitation principle, allowing more flexible secondary uses.
Why the other options are wrong
- B. Technological safeguards protect data security but do not modify purpose limitation restrictions on processing.
- C. Legitimate interests of third parties do not override the purpose limitation principle or provide additional latitude for reprocessing.
- D. A data subject's failure to use an opt-out mechanism does not create additional latitude; affirmative consent or legitimate legal bases are required.
Question 71
Read the following steps: Discover which employees are accessing cloud services and from which devices and apps Lock down the data in those apps and devices Monitor and analyze the apps and devices for compliance Manage application life cycles Monitor data sharing An organization should perform these steps to do which of the following?
Show answer and explanation
Correct answer: C. Maintain a secure Bring Your Own Device (BYOD) program.
The steps described, discovering device and app access, locking down data, monitoring compliance, managing application lifecycles, and monitoring data sharing, are core components of a secure Bring Your Own Device (BYOD) program. This framework addresses the specific security and privacy challenges that arise when employees use personal devices for work.
Why the other options are wrong
- A. Privacy by Design is a principle applied throughout system development, not a sequential process of discovery and monitoring.
- B. Employee monitoring for compliance is narrower in scope than the comprehensive device and data management described.
- D. Cloud vendor compliance would focus on vendor contracts and audit rights, not monitoring employee device and app usage.
Question 72
A company is hesitating between Binding Corporate Rules and Standard Contractual Clauses as a global data transfer solution. Which of the following statements would help the company make an effective decision?
Show answer and explanation
Correct answer: C. Binding Corporate Rules provide a global solution for all the entities of a company that are bound by the intra-group agreement.
Binding Corporate Rules provide a global solution for all entities of a company bound by the intra-group agreement, making them effective for multinational organizations transferring data across multiple countries. This is a key advantage of BCRs: they create a single overarching framework for transfers across all group entities.
Why the other options are wrong
- A. Binding Corporate Rules are typically recommended for larger multinational corporations with complex intra-group structures, not small and medium companies.
- B. Standard Contractual Clauses generally require the data exporter to be established in the EU or an adequacy-equivalent jurisdiction.
- D. Prior authorization from all EU data protection authorities is not required for Standard Contractual Clauses; they are adopted at the EU level.
Question 73
SCENARIO Please use the following to answer the next question: T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies. T-Craze also opened various office locations throughout Europe to help expand its business. While Germany continued to host T-Craze’s headquarters and main product-design office, its French affiliate became responsible for all marketing and sales activities. The French affiliate recently procured the services of Right Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T-Craze, though with much less success. The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze. Why does the Spanish supervisory authority notify the French supervisory authority when it opens an investigation into T-Craze based on Sofia’s complaint?
Show answer and explanation
Correct answer: B. The French affiliate procured the services of Right Target.
Under GDPR Article 56, when a supervisory authority receives a complaint involving a controller with a main establishment in another member state, it must notify the lead supervisory authority. The notification requirement is triggered because the French affiliate (which T-Craze designated to procure Right Target's services for marketing) is the entity responsible for the processing activities that are the subject of Sofia's complaint. The French affiliate's direct involvement in procuring the processor makes the French supervisory authority the lead authority that must be notified.
Why the other options are wrong
- A. Having a French affiliate alone does not automatically require notification if the affiliate is not involved in the processing.
- C. While the French affiliate conducts marketing and sales, the key factor is that it procured the processor Right Target for the specific processing activity in question.
- D. Notification of the lead supervisory authority is mandatory under GDPR, not a courtesy.
Question 74
Why is advisable to avoid consent as a legal basis for an employer to process employee data?
Show answer and explanation
Correct answer: B. Consent may not be valid if the employee feels compelled to provide it.
Consent is problematic as a legal basis for employer processing because of the inherent power imbalance between employer and employee. An employee may feel compelled or pressured to consent to processing conditions due to employment dependency, making such consent not freely given and therefore invalid under GDPR Article 7.
Why the other options are wrong
- A. Data protection officer approval is not a prerequisite for processing; the DPO has an advisory role.
- C. While difficulty obtaining consent from all employees is practical, the fundamental legal issue is validity, not logistical challenge.
- D. Data protection laws absolutely apply to employee data processing; GDPR explicitly covers employment relationships.
Question 75
Which of the following does NOT have to be included in the records most processors must maintain in relation to their data processing activities?
Show answer and explanation
Correct answer: D. Details of any data protection impact assessment conducted in relation to any processing activities carried out by the processor on behalf of each controller for which the processor is acting.
Under GDPR Article 30(2), processors must maintain records of processing activities that include the name and contact details of controllers, categories of processing, and details of transfers to third countries. However, data protection impact assessments (DPIAs) are the responsibility of controllers, not processors. While a processor may assist a controller with a DPIA, details of DPIAs conducted are not a required component of the processor's own record-keeping obligations under Article 30(2).
Why the other options are wrong
- A. Name and contact details of each controller are explicitly required by Article 30(2)(a).
- B. Categories of processing carried out on behalf of each controller are explicitly required by Article 30(2)(b).
- C. Details of transfers to third countries are explicitly required by Article 30(2)(c).
Question 76
Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?
Show answer and explanation
Correct answer: D. Data controllers must be in control of the data they hold at all times.
BYOD programs present the most significant challenge regarding controller responsibility because organizations lose direct control over the devices and systems where personal data is processed. Employees' personal devices may lack adequate security measures, may be shared, may not comply with organizational policies, and may be subject to loss or theft. This fundamentally compromises the controller's ability to ensure compliance with data protection obligations and safeguard personal data, making it the most substantial compliance challenge compared to the other requirements.
Why the other options are wrong
- A. Informing data subjects of processing purposes is a standard transparency requirement that applies regardless of BYOD; it does not present unique challenges specific to BYOD programs.
- B. Appointing a DPO for large-scale special category data processing is a requirement based on processing scale and data type, not specifically complicated by BYOD environments.
- C. Maintaining accuracy of personal data is a general data quality requirement that applies across all processing contexts and is not uniquely challenging in BYOD settings.
Question 77
Which mechanism, new to the GDPR, now allows for the possibility of personal data transfers to third countries under Article 42?
Show answer and explanation
Correct answer: A. Approved certifications.
Article 42 of the GDPR introduces approved certifications as a new mechanism for enabling data transfers to third countries. This certification mechanism was introduced as a novel tool in the GDPR to supplement existing transfer mechanisms. Binding corporate rules, standard contractual clauses, and law enforcement requests are not mechanisms under Article 42. While standard contractual clauses existed prior to GDPR, approved certifications represent a distinctly new mechanism that GDPR established for international transfers.
Why the other options are wrong
- B. Binding corporate rules are not a mechanism under Article 42 and are not new to GDPR.
- C. Law enforcement requests are not a transfer mechanism under Article 42.
- D. Standard contractual clauses existed before GDPR and are not new to the regulation.
Question 78
Tanya is the Data Protection Officer for Curtains Inc., a GDPR data controller. She has recommended that the company encrypt all personal data at rest. Which GDPR principle is she following?
Show answer and explanation
Correct answer: C. Integrity and confidentiality
Article 5(1)(f) of the GDPR requires that personal data be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing. Encryption of data at rest is a primary technical measure for maintaining integrity and confidentiality by preventing unauthorized access and ensuring the data cannot be read if compromised. This directly implements the integrity and confidentiality principle.
Why the other options are wrong
- A. Accuracy concerns data correctness and relevance, not the security measures like encryption that protect data.
- B. Storage limitation refers to how long data is retained, not the security methods used to protect it during storage.
- D. Lawfulness, fairness, and transparency concern the basis and communication of processing, not the technical security measures protecting data.
Question 79
SCENARIO Please use the following to answer the next question: T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies. T-Craze also opened various office locations throughout Europe to help expand its business. While Germany continued to host T-Craze’s headquarters and main product-design office, its French affiliate became responsible for all marketing and sales activities. The French affiliate recently procured the services of Right Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T-Craze, though with much less success. The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze. Which of the following is T-Craze’s lead supervisory authority?
Show answer and explanation
Correct answer: B. France, because that is where T-Craze conducts processing of personal information.
Under the GDPR, the main establishment is normally the place of central administration, unless decisions on the purposes and means of the processing are taken in another establishment that can implement them. The French affiliate is responsible for all marketing and sales and engaged Right Target, so for this marketing processing France is the main establishment and its authority leads.
Why the other options are wrong
- A. Headquarters only determines the lead authority when decisions about the specific processing are made there, and here marketing decisions are made in France.
- C. The size of a market or the number of complaints does not decide the lead supervisory authority.
- D. Controllers cannot freely choose their lead authority; it follows the main establishment for the processing.
Question 80
What term BEST describes the European model for data protection?
Show answer and explanation
Correct answer: D. Comprehensive
The European model for data protection is comprehensive, meaning it applies across all sectors and types of organizations through overarching laws like the GDPR and related directives. This contrasts with sectoral approaches (like the United States model) where different industries have different rules. Europe's approach is characterized by broad, unified principles and regulations that apply comprehensively to all data processing activities and all organizations that handle personal data. This comprehensive framework establishes universal standards for privacy rights and data protection obligations.
Why the other options are wrong
- A. Sectoral describes the U.S. model, which has different rules for different industries; Europe uses a comprehensive approach.
- B. Self-regulatory models rely on industry self-governance; Europe mandates legal compliance through government-enforced regulations.
- C. Market-based models rely on market forces and consumer choice; Europe uses legal mandates and regulatory enforcement.
That was 80 of 319.
The full IAPP CIPP/E pack has all 319 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 148 free as one PDF by email. Get the Half Pack →