CIPP/E Exam-with 100% verified solutions 2024-2025, Exams of Advanced Education

Download CIPP/E Exam-with 100% verified solutions 2024-2025 and more Exams Advanced Education in PDF only on Docsity! CIPP/E Exam-with 100% verified solutions 2024-2025 Outliers work on their website to company x, employee of Company X steals the data -delete it - tells boss. Q: What is company x legally obliged to do? A: NotifyOutliers Outliers work on their website to company x, employee of Company X steals the data -delete it - tells boss. Q: What does Outliers then need to do? A: Nothingas data was deleted Outliers work on their website to company x, employee of Company X steals the data -delete it - tells boss. Q: Follows on with Cookies question? A: Consentto opt-in to cookies Privacy notice for new Health App collecting sensitive data. Q: What is the problem with the draft? A: Them form is asking for health information from the outset, which is not legal Privacy notice for new Health App collecting sensitive data Q: Potential problem with collecting children data? A: Need to demonstrate steps to gain parental consent Anna is lawyer foruniversity tasked with Student Records. Frank is a professor. Four types of data:Student Data - personal infoEmployee Data - personal infoAlumni Data - personal infoDepartment of Education Data:demographic data - no personal identifiers (used to see how first year students progress, etc.)Frank wants to build a database to process data and see how first year students in his class progressed. Frank builds algorithm to process data without identifiers. All university systems are encrypted. Takes data to his home laptop which is not encrypted. Loses laptop Q: Which types of data does Anna NOT have to include in her record of processing activities? Department of Education Records Q: What should the Anna/DPO checkto confirm he can process those data? More information about the algorithm he has developed Q: He losses the data, what should happen next? Should they inform the students? Yes because potential high risk since data was not encrypted Case study on guy gets photo taken at a gym in Germany -consents to them using it for marketing -Gym HQ in France -Gyms all over EU -He lives in UK -Submits request to ICO in UK -ICO refers to CNIL (this is the SA in France) Q: In effort of Cooperation (the lead SA, CNIL, gets their judgement) what should the they do now? Draft a draft decision and submit to supporting SAs for their opinion. What does he have to do for lawsuit? (each location is a controller!) Answer: Go to each gym branch... Question on what he should do if he wants tosue Sue ANY relevant branch as each can be liable for entire damage Processing data to gather advert behaviors (irish clothing company)Markets to men, women, and children. Wants to do some big time profiling. Q: What would be the biggest thing to require a DPIA A: Doing Profiling to gather purchasing and other behaviour on customers. Q: When does a company not have to comply with right to portability? Processed on basis of consent and/or contract Q: What did the convention and the directive have in common but unable to accomplish Enforcement Q: Who can propose new laws in EU? / Who can propose legislation in EU? EU commission Q: Who approves adequate countries? EU Commission -has the ability to update, grant and remove the adequacy status of a country. Q: Why was data retention directive invalidated in 2014? It impacts everyone without exception (their privacy rights) Q: What wasthe goal of the original EU DP Directive 95/46? - To further reconcile the protection of fundamental rights with free flow of data from one-member state to another Q: What best defines GDPR ? - Comprehensive Q: What do GDPR and Convention108 have in common? - International Data Transfers Q: Question regarding right to privacy: - Must be balanced with other rights and freedoms Q: What is out of scope / not covered in the GDPR? - Anonymous Pseudonymisation- which is NOT true? - Is a procedure by which ALL identifying fields are removed Q: What is true about Pseudonymisation? - Gives controllers a bit more leeway on if/how they can process data besides purpose of initial collection and processing. Q: Employee requesting information from employer? - They have to comply unless there's an exemption Q: Why consent is not the best legal basis for employees? - imbalance of power - employee will feel pressured to give consent. Q: The processor has now made a decision on purpose of processing? - The processor is now deemed as the controller Q: What is REQUIRED for a company to market to EU consumer via email? (bit of a trick question)? - Prior opt-in Consent or previous customer purchase Q: Special category? - Trade Union Q: Member states have ability to enact local laws for what? - Age of child consent Q: When would consent NOT be needed from a child? - Providing counseling services Q: When does data subject have right to object? Tier 2 o Violation of technical organization measures(think smaller, day-to-day tasks that might be violated) Q: How long does one DPA have to reply to another DPA on a cooperation request? - 1 month What info needs to be provided to a Data Subject if their data collected indirectly? - Source of the data *If the data for DS is collected via indirect means what is the controller's primary obligation? Inform the Data Subject about it. ****Safeguard under 'Article 42'? - keyword is "NEW" to GDPR - Certifications What is Forum Shopping? - Choosing to place your Headquarters or Main Establishment in a State with more relaxed Privacy laws Lead SA questions? Investigative powers. They have the right to access data for investigational purposes. INVESTIGATE POWERS they can collect and if they can leverage penalties after controller has been convicted in court of law Company X contracts company Y to process. Company Y has a breach, what is its first priority? - Inform company X immediately What will an employer do with employee data once they are terminated? - They will keep data legally required to keep ****CCTV - what would you NOT need to do first? - Create a retention policy Question regarding in which scenario would GDPR apply - US citizen residing in EU purchases off of US website. Would apply because EU resident. ***Processor has data on USBdrive that is breached, but then deleted - why no notification needed to data subject? · Because it was deleted and low risk of harm toindividuals ****What's needed for processor to engage sub processor - Written confirmation from controller and assurance that processor is up to technical and organization measures ****BCR rules required byemployees employees must follow all rules of the BCR nomatter where they work What did ePrivacy make happen in 2009? - Mandatory Data Breach notification from Electronic Comms Providers What would concern e-Privacy? - Calling Prospective Customers to tell them about a new product What can an org do to make data Pseudonymous? Hold info with a direct link to personal data separately what pseudonymization is useful for Gives controllers more leeway on if/how they can process data besides purpose of initial collection and processing "main tasks or purpose ofthe DPO". Ensure compliance with local and EUData Protection Law