2024 Realistic CIPP-E Dumps are Available for Instant Access

Download Exam CIPP-E Practice Test Questions with 100% Verified Answers

Certification Path

• The CIPP/E Certification is one of the major certifications organized by IAPP mainly focussing on the area of data privacy.
• There is no prerequisite for this exam but those professionals who having keen to work in the stream of data privacy and want to learn about how to keep your data records safely then CIPP/E is the right option for them.

 

NEW QUESTION # 87
Please use the following to answer the next question:
Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.
After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient's name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissed Jack's lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of "all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents. In relation to the emails Jack listed six members of the management team whose inboxes the required access.
How should the company respond to Jack's request to be forgotten?

• A. The company should erase all data relating to Jack without undue delay as the right to be forgotten is an absolute right.
• B. The company should claim that the right to be forgotten is not applicable to them, as only a fraction of their global workforce resides in the European Union.
• C. The company should ensure that the information is stored outside of the European Union so that the right to be forgotten under the GDPR does not apply.
• D. The company should not erase the data at this time as it may be required to defend a legal claim of unfair dismissal.

Answer: B

NEW QUESTION # 88
SCENARIO
Please use the following to answer the next question:
TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business.
During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations. TripBliss Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services.
Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered.
After Leon has informed his manager, what is Techiva's legal responsibility as a processor?

• A. They must inform customers who have used the website.
• B. They must report it to the supervisory authority.
• C. They must report it to TripBliss Inc.
• D. They must conduct a full systems audit.

Answer: D

NEW QUESTION # 89
SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
In which of the following situations would ABC Hotel Chain and XYZ Travel Agency NOT have to honor Mike's data access request?

• A. The request is to obtain access and the categories of recipients who have received his personal data to process his rewards membership.
• B. The request is to obtain access and erasure of his personal data while keeping his rewards membership.
• C. The request is to obtain access and correct inaccurate personal data in his profile.
• D. The request is to obtain access and information about the purpose of processing his personal data.

Answer: B

NEW QUESTION # 90
Under Article 9 of the GDPR, which of the following categories of data is NOT expressly prohibited from data processing?

• A. Personal data revealing financial data.
• B. Personal data revealing ethnic origin.
• C. Personal data revealing trade union membership.
• D. Personal data revealing genetic data.

Answer: A

NEW QUESTION # 91
An employee of company ABCD has just noticed a memory stick containing records of client data, including their names, addresses and full contact details has disappeared. The data on the stick is unencrypted and in clear text. It is uncertain what has happened to the stick at this stage, but it likely was lost during the travel of an employee. What should the company do?

• A. Launch an investigation and if nothing is found within one month, notify the data protection supervisory authority.
• B. Notify as soon as possible the data protection supervisory authority that a data breach may have taken place.
• C. Immediately notify all the customers of the company that their information has been accessed by an unauthorized person.
• D. Invoke the "disproportionate effort" exception under Article 33 to postpone notifying data subjects until more information can be gathered.

Answer: B

NEW QUESTION # 92
What was the aim of the European Data Protection Directive 95/46/EC?

• A. To harmonize the implementation of the European Convention of Human Rights across all member states.
• B. To completely prevent the transfer of personal data out of the European Union.
• C. To implement the OECD Guidelines on the Protection of Privacy and trans-border flows of Personal Data.
• D. To further reconcile the protection of the fundamental rights of individuals with the free flow of data from one member state to another.

Answer: C

NEW QUESTION # 93
According to the GDPR, how is pseudonymous personal data defined?

• A. Data that can no longer be attributed to a specific data subject without the use of additional information kept separately.
• B. Data that can no longer be attributed to a specific data subject, with no possibility of re-identifying the data.
• C. Data that has been rendered anonymous in such a manner that the data subject is no longer identifiable.
• D. Data that has been encrypted or is subject to other technical safeguards.

Answer: A

Explanation:
Reference https://www.chino.io/blog/what-is-pseudonymous-data-according-to-the-gdpr/

NEW QUESTION # 94
SCENARIO
Please use the following to answer the next question:
Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a dedicated data center located in Malta |EU).
People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a KYC due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations.
The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and belong a checkbox on a separate page in order to get their account approved on the platform.
The customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if a Which of the following must be a component of the anti-money-laundering data-sharing practice of the platform?

• A. The terms of service shall also enumerate all applicable anti-money laundering few.
• B. Customers snail receive a clear and conspicuous notice about such data sharing before submitting their data during the registration process.
• C. The terms of service shall include the address of the anti-money laundering agency and contacts of the investigators who may access me data.
• D. Customers shall have an opt-out feature to restrict data sharing with law enforcement agencies after the registration.

Answer: C

NEW QUESTION # 95
When assessing the level of risk created by a data breach, which of the following would NOT have to be taken into consideration?

• A. The size of any data processor involved.
• B. The special characteristics of the data controller.
• C. The nature, sensitivity and volume of personal data.
• D. The ease of identification of individuals.

Answer: A

NEW QUESTION # 96
Please use the following to answer the next question:
Javier is a member of the fitness club EVERFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Javier lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Javier was photographed while working out at a branch of EVERFIT in Frankfurt, Germany. At the time, Javier gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Javier no longer feels comfortable with his photograph being publicly associated with the fitness club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Javier sends a letter to EVETFIT requesting that his image be removed from the website and all promotional materials. Months pass and Javier, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact EVETFIT through alternate channels, he decides to take action against the company.
Javier contacts the U.K. Information Commissioner's Office ('ICO' - the U.K.'s supervisory authority) to lodge a complaint about this matter. The ICO, pursuant to Article 56 (3) of the GDPR, informs the CNIL (i.e. the supervisory authority of EVERFIT's main establishment) about this matter. Despite the fact that EVERFIT has an establishment in the U.K., the CNIL decides to handle the case in accordance with Article 60 of the GDPR. The CNIL liaises with the ICO, as relevant under the cooperation procedure. In light of issues amongst the supervisory authorities to reach a decision, the European Data Protection Board becomes involved and, pursuant to the consistency mechanism, issues a binding decision.
Additionally, Javier sues EVERFIT for the damages caused as a result of its failure to honor his request to have his photograph removed from the brochure and website.
Under the cooperation mechanism, what should the lead authority (the CNIL) do after it has formed its view on the matter?

• A. Submit a draft decision directly to the Commission to ensure the effectiveness of the consistency mechanism.
• B. Submit a draft decision to other supervisory authorities for their opinion.
• C. Request that members of the seconding supervisory authority and the host supervisory authority co-draft a decision.
• D. Request that the other supervisory authorities provide the lead authority with a draft decision for its consideration.

Answer: D

NEW QUESTION # 97
SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester's Alumni portal. Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna's tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Which of the University's records does Anna NOT have to include in her record of processing activities?

• A. Staff and alumni records
• B. Frank's performance database
• C. Student records
• D. Department for Education records

Answer: B

NEW QUESTION # 98
MagicClean is a web-based service located in the United States that matches home cleaning services to customers. It otters its services exclusively in the United States It uses a processor located in France to optimize its dat a. Is MagicClean subject to the GDPR?

• A. No, because MagicClean is located m the United States only.
• B. Yes. because MagicClean's data processing agreement with the French processor is an establishment in the EU
• C. No. because MagicClean is not offering services to EU data subjects.
• D. Yes, because MagicClean is processing data in the EU

Answer: B

NEW QUESTION # 99
Which of the following entities would most likely be exempt from complying with the GDPR?

• A. A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.
• B. A Chinese company that has opened a satellite office in a European Union (EU) member state to service European customers.
• C. A company that stores all customer data in Australia and is headquartered in a European Union (EU) member state.
• D. A South American company that regularly collects European customers' personal data.

Answer: A

NEW QUESTION # 100
Which of the following countries will continue to enjoy adequacy status under the GDPR, pending any future European Commission decision to the contrary?

• A. Switzerland
• B. Norway
• C. Greece
• D. Australia

Answer: A

NEW QUESTION # 101
An online company's privacy practices vary due to the fact that it offers a wide variety of services. How could it best address the concern that explaining them all would make the policies incomprehensible?

• A. Use a layered privacy notice on its website and in its email communications.
• B. Place a banner on its website stipulating that visitors agree to its privacy policy and terms of use by visiting the site.
• C. Identify uses of data in a privacy notice mailed to the data subject.
• D. Provide only general information about its processing activities and offer a toll-free number for more information.

Answer: C

Explanation:
Reference https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-bureau- consumer-protection-preliminary-ftc-staff-report-protecting-consumer/101201privacyreport.pdf

NEW QUESTION # 102
In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?

• A. A medical organization that wants to begin genetic testing to support earlier research for which they have performed a DPIA.
• B. A marketing team that wants to collect mailing addresses of customers for whom they already have email addresses.
• C. A data controller who plans to use a new technology product that has already undergone a DPIA by the product's provider.
• D. A railway operator who plans to evaluate the same video surveillance in all the train stations of his company.

Answer: D

NEW QUESTION # 103
Which of the following was the first legally binding international instrument in the area of data protection?

• A. Convention 108.
• B. EU Directive on Privacy and Electronic Communications.
• C. Universal Declaration of Human Rights.
• D. General Data Protection Regulation.

Answer: A

NEW QUESTION # 104
What type of data lies beyond the scope of the General Data Protection Regulation?

• A. Encrypted
• B. Anonymized
• C. Pseudonymized
• D. Masked

Answer: B

Explanation:
Reference https://www.datainspektionen.se/other-lang/in-english/the-general-data-protection-regulation-gdpr/ the-purposes-and-scope-of-the-general-data-protection-regulation/

NEW QUESTION # 105
......

Positive Aspects of Valid Dumps CIPP-E Exam Dumps! : https://www.testsimulate.com/CIPP-E-study-materials.html