Free Sales Ending Soon – 100% Valid CIPP-E Exam Dumps with 208 Questions [Q123-Q146]

Rate this post

Free Sales Ending Soon – 100% Valid CIPP-E Exam Dumps with 208 Questions

Verified CIPP-E dumps Q&As on your Certified Information Privacy Professional Exam Questions Certain Success!

You can read the IAPP CIPP/E Exam certified salary below

The Average Salary of an IAPP CIPP/E Exam in

Europe – 104162 EURO
India – 9206648 INR
England – 94029 POUND
United State – 122,750 USD

NEW QUESTION 123
A grade school is planning to use facial recognition to track student attendance. Which of the following may provide a lawful basis for this processing?

The school places a notice near each camera.

The school gets explicit consent from the students.

Processing is necessary for the legitimate interests pursed by the school.

A state law requires facial recognition to verify attendance.

NEW QUESTION 124
SCENARIO
Please use the following to answer the next question:
Javier is a member of the fitness club EVERFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Javier lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Javier was photographed while working out at a branch of EVERFIT in Frankfurt, Germany. At the time, Javier gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club’s U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Javier no longer feels comfortable with his photograph being publicly associated with the fitness club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Javier sends a letter to EVETFIT requesting that his image be removed from the website and all promotional materials. Months pass and Javier, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact EVETFIT through alternate channels, he decides to take action against the company.
Javier contacts the U.K. Information Commissioner’s Office (‘ICO’ – the U.K.’s supervisory authority) to lodge a complaint about this matter. The ICO, pursuant to Article 56 (3) of the GDPR, informs the CNIL (i.e. the supervisory authority of EVERFIT’s main establishment) about this matter. Despite the fact that EVERFIT has an establishment in the U.K., the CNIL decides to handle the case in accordance with Article 60 of the GDPR.
The CNIL liaises with the ICO, as relevant under the cooperation procedure. In light of issues amongst the supervisory authorities to reach a decision, the European Data Protection Board becomes involved and, pursuant to the consistency mechanism, issues a binding decision.
Additionally, Javier sues EVERFIT for the damages caused as a result of its failure to honor his request to have his photograph removed from the brochure and website.
Assuming that multiple EVETFIT branches across several EU countries are acting as separate data controllers, and that each of those branches were responsible for mishandling Javier’s request, how may Javier proceed in order to seek compensation?

He will have to sue the EVETFIT’s head office in France, where EVETFIT has its main establishment.

He will be able to sue any one of the relevant EVETFIT branches, as each one may be held liable for the entire damage.

He will have to sue each EVETFIT branch so that each branch provides proportionate compensation commensurate with its contribution to the damage or distress suffered by Javier.

He will be able to apply to the European Data Protection Board in order to determine which particular EVETFIT branch is liable for damages, based on the decision that was made by the board.

NEW QUESTION 125
Which GDPR principle would a Spanish employer most likely depend upon to annually send the personal data of its employees to the national tax authority?

The consent of the employees.

The legal obligation of the employer.

The legitimate interest of the public administration.

The protection of the vital interest of the employees.

NEW QUESTION 126
Which statement is correct when considering the right to privacy under Article 8 of the European Convention on Human Rights (ECHR)?

The right to privacy is an absolute right

The right to privacy has to be balanced against other rights under the ECHR

The right to freedom of expression under Article 10 of the ECHR will always override the right to privacy

The right to privacy protects the right to hold opinions and to receive and impart ideas without interference

NEW QUESTION 127
In addition to the European Commission, who can adopt standard contractual clauses, assuming that all required conditions are met?

Approved data controllers.

The Council of the European Union.

National data protection authorities.

The European Data Protection Supervisor.

NEW QUESTION 128
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company’s revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children’s questions on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well. The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure’s integrated speakers, making it appear as though that the toy is actually responding to the child’s question. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures’ abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character’s abilities remain intact.
To ensure GDPR compliance, what should be the company’s position on the issue of consent?

The child, as the user of the action figure, can provide consent himself, as long as no information is shared for marketing purposes.

Written authorization attesting to the responsible use of children’s data would need to be obtained from the supervisory authority.

Consent for data collection is implied through the parent’s purchase of the action figure for the child.

Parental consent for a child’s use of the action figures would have to be obtained before any data could be collected.

NEW QUESTION 129
The GDPR requires controllers to supply data subjects with detailed information about the processing of their dat a. Where a controller obtains data directly from data subjects, which of the following items of information does NOT legally have to be supplied?

The recipients or categories of recipients.

The categories of personal data concerned.

The rights of access, erasure, restriction, and portability.

The right to lodge a complaint with a supervisory authority.

NEW QUESTION 130
For which of the following operations would an employer most likely be justified in requesting the data subject’s consent?

Posting an employee’s bicycle race photo on the company’s social media.

Processing an employee’s health certificate in order to provide sick leave.

Operating a CCTV system on company premises.

Assessing a potential employee’s job application.

NEW QUESTION 131
Which marketing-related activity is least likely to be covered by the provisions of Privacy and Electronic Communications Regulations (Directive 2002/58/EC)?

Advertisements passively displayed on a website.

The use of cookies to collect data about an individual.

A text message to individuals from a company offering concert tickets for sale.

An email from a retail outlet promoting a sale to one of their previous customer.

NEW QUESTION 132
According to the GDPR, how is pseudonymous personal data defined?

Data that can no longer be attributed to a specific data subject without the use of additional information kept separately.

Data that can no longer be attributed to a specific data subject, with no possibility of re-identifying the data.

Data that has been rendered anonymous in such a manner that the data subject is no longer identifiable.

Data that has been encrypted or is subject to other technical safeguards.

NEW QUESTION 133
SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees’ computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees’ computers.
Since these measures would potentially impact employees, Building Block’s Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees’ computers activity and their location.
During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company’s computers, and from working remotely without authorization.
In addition to notifying employees about the purpose of the monitoring, the potential uses of their data and their privacy rights, what information should Building Block have provided them before implementing the security measures?

Information about what is specified in the employment contract.

Information about who employees should contact with any queries.

Information about how providing consent could affect them as employees.

Information about how the measures are in the best interests of the company.

NEW QUESTION 134
Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?

The European Parliament

The European Commission

The Article 29 Working Party

The European Council

NEW QUESTION 135
SCENARIO
Please use the following to answer the next question:
Outliers Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Jonathan, suspects that this is partly due to the company’s outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company ZenFiTech, hoping that they can design a new, cutting-edge website for Outliers Inc.’s foundering business.
During negotiations, a ZenFiTech representative describes a plan for gathering more customer information through detailed questionnaires, which could be used to tailor their preferences to specific travel destinations. Outliers Inc. can choose any number of data categories – age, income, ethnicity – that would help them best accomplish their goals. Jonathan loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the questionnaires will require customers to provide explicit consent to having their data collected. The ZenFiTech representative suggests that they also run a program to analyze the new website’s traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the Outliers Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which ZenFiTech will analyze by means of a special program. Outliers Inc. would receive aggregate statistics to help them evaluate the website’s effectiveness. Jonathan enthusiastically engages ZenFiTech for these services.
With regard to Outliers Inc.’s use of website cookies, which of the following statements is correct?

Because not all of the cookies are strictly necessary to enable the use of a service requested from Outliers Inc., consent requirements apply to their use of cookies.

Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers.

Because ZenFiTech will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary.

Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.

NEW QUESTION 136
When assessing the level of risk created by a data breach, which of the following would NOT have to be taken into consideration?

The ease of identification of individuals.

The size of any data processor involved.

The special characteristics of the data controller.

The nature, sensitivity and volume of personal data.

NEW QUESTION 137
Which of the following countries will continue to enjoy adequacy status under the GDPR, pending any future European Commission decision to the contrary?

Greece

Norway

Australia

Switzerland

NEW QUESTION 138
Which of the following is NOT considered a fair processing practice in relation to the transparency principle?

Providing a multi-layered privacy notice, in a website environment.

Providing a QR code linking to more detailed privacy notice, in a CCTV sign.

Providing a hyperlink to the organization’s home page, in a hard copy application form.

Providing a “just-in-time” contextual pop-up privacy notice, in an online application from field.

NEW QUESTION 139
Under what circumstances might the “soft opt-in” rule apply in relation to direct marketing?

When an individual has not consented to the marketing.

When an individual’s details are obtained from their inquiries about buying a product.

Where an individual’s details have been obtained from a bought-in marketing list.

Where an individual is given the ability to unsubscribe from marketing emails sent to him.

NEW QUESTION 140
According to the E-Commerce Directive 2000/31/EC, where is the place of “establishment” for a company providing services via an Internet website confirmed by the GDPR?

Where the technology supporting the website is located

Where the website is accessed

Where the decisions about processing are made

Where the customer’s Internet service provider is located

NEW QUESTION 141
If a multi-national company wanted to conduct background checks on all current and potential employees, including those based in Europe, what key provision would the company have to follow?

Background checks on employees could be performed only under prior notice to all employees.

Background checks are only authorized with prior notice and express consent from all employees including those based in Europe.

Background checks on European employees will stem from data protection and employment law, which can vary between member states.

Background checks may not be allowed on European employees, but the company can create lists based on its legitimate interests, identifying individuals who are ineligible for employment.

NEW QUESTION 142
What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?

ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.

CJEU can force national governments to implement and honor EU law, while the ECHR cannot.

CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.

ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.

NEW QUESTION 143
When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?

When the data has been pseudonymized.

When the data is protected by technological safeguards.

When the data serves legitimate interest of third parties.

When the data subject has failed to use a provided opt-out mechanism.
Section: (none)
Explanation

NEW QUESTION 144
Under what circumstances would the GDPR apply to personal data that exists in physical form, such as information contained in notebooks or hard copy files?

Only where the personal data is produced as a physical output of specific automated processing activities, such as printing, labelling, or stamping.

Only where the personal data is to be subjected to specific computerized processing, such as image scanning or optical character recognition.

Only where the personal data is treated by automated means in some way, such as computerized distribution or filing.

Only where the personal data is handled in a sufficiently structured manner so as to form part of a filing system.

NEW QUESTION 145
Under the GDPR, where personal data is not obtained directly from the data subject, a controller is exempt from directly providing information about processing to the data subject if?

The data subject already has information regarding how his data will be used

The provision of such information to the data subject would be too problematic

Third-party data would be disclosed by providing such information to the data subject

The processing of the data subject’s data is protected by appropriate technical measures

NEW QUESTION 146
Which of the following demonstrates compliance with the accountability principle found in Article 5, Section 2 of the GDPR?

Anonymizing special categories of data.

Conducting regular audits of the data protection program.

Getting consent from the data subject for a cross border data transfer.

Encrypting data in transit and at rest using strong encryption algorithms.