Best Way To Study For IAPP CIPP-E Exam Brilliant CIPP-E Exam Questions PDF
Updated Verified Pass CIPP-E Exam - Real Questions and Answers
You can read the IAPP CIPP/E Exam certified salary below
The Average Salary of an IAPP CIPP/E Exam in
- Europe - 104162 EURO
- United State - 122,750 USD
- India - 9206648 INR
- England - 94029 POUND
What is IAPP CIPP/E Exam
IAPP has introduced Certified Information Privacy Professionals (CIPP) certificate for privacy professionals. The CIPP is the global standard for privacy professionals who manage, handle, and access data. Security professionals get a deep insight into security considerations in the European context through the European edition of CIPP which is CIPP/E.
CIPP/E is a unique designation, the only one of its kind, according to its creator the International Association of Privacy Professionals (IAPP). As a response to increasing demand for secure data privacy protection in 2014 IAPP was introduced. In all stages and throughout lifecycles these security protocols are a must. Thus the need for authoritative and certified practitioners is growing. The professionals/ candidates feel highly confident after bagging global certifications as they are able to validate there skills and abilities.
CIPP/E Exam is a certification exam that is conducted by IAPP to validates candidate knowledge and identifies technology experts that know how to build data privacy architecture from its foundation in the IT industry.
The Certified Information Privacy Professional (CIPP) helps organizations around the world support compliance and risk mitigation practices, and arms practitioners with the insight needed to add more value to their businesses.
After passing this exam, candidates get a certificate from IAPP that helps them to demonstrate their proficiency in data privacy to their clients and employers.
NEW QUESTION 32
SCENARIO
Please use the following to answer the next question:
Ben is a member of the fitness club STAYFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Ben lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Ben was photographed while working out at a branch of STAYFIT in Frankfurt, Germany. At the time, Ben gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Ben no longer feels comfortable with his photograph being publicly associated with the fitness club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Ben sends a letter to STAYFIT requesting that his image be removed from the website and all promotional materials. Months pass and Ben, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact STAYFIT through alternate channels, he decides to take action against the company.
Ben contacts the U.K. Information Commissioner's Office ('ICO' - the U.K.'s supervisory authority) to lodge a complaint about this matter.
Assuming that multiple STAYFIT branches across several EU countries are acting as separate data controllers, and that each of those branches were responsible for mishandling Ben's request, how may Ben proceed in order to seek compensation?
- A. He will have to sue the STAYFIT's head office in France, where STAYFIT has its main establishment.
- B. He will be able to apply to the European Data Protection Board in order to determine which particular STAYFIT branch is liable for damages, based on the decision that was made by the board.
- C. He will be able to sue any one of the relevant STAYFIT branches, as each one may be held liable for the entire damage.
- D. He will have to sue each STAYFIT branch so that each branch provides proportionate compensation commensurate with its contribution to the damage or distress suffered by Ben.
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION 33
SCENARIO
Please use the following to answer the next question:
Brady is a computer programmer based in New Zealand who has been running his own business for two years. Brady's business provides a low-cost suite of services to customers throughout the European Economic Area (EEA). The services are targeted towards new and aspiring small business owners. Brady's company, called Brady Box, provides web page design services, a Social Networking Service (SNS) and consulting services that help people manage their own online stores.
Unfortunately, Brady has been receiving some complaints. A customer named Anna recently uploaded her plans for a new product onto Brady Box's chat area, which is open to public viewing. Although she realized her mistake two weeks later and removed the document, Anna is holding Brady Box responsible for not noticing the error through regular monitoring of the website. Brady believes he should not be held liable.
Another customer, Felipe, was alarmed to discover that his personal information was transferred to a third- party contractor called Hermes Designs and worries that sensitive information regarding his business plans may be misused. Brady does not believe he violated European privacy rules. He provides a privacy notice to all of his customers explicitly stating that personal data may be transferred to specific third parties in fulfillment of a requested service. Felipe says he read the privacy notice but that it was long and complicated Brady continues to insist that Felipe has no need to be concerned, as he can personally vouch for the integrity of Hermes Designs. In fact, Hermes Designs has taken the initiative to create sample customized banner advertisements for customers like Felipe. Brady is happy to provide a link to the example banner ads, now posted on the Hermes Designs webpage. Hermes Designs plans on following up with direct marketing to these customers.
Brady was surprised when another customer, Serge, expressed his dismay that a quotation by him is being used within a graphic collage on Brady Box's home webpage. The quotation is attributed to Serge by first and last name. Brady, however, was not worried about any sort of litigation. He wrote back to Serge to let him know that he found the quotation within Brady Box's Social Networking Service (SNS), as Serge himself had posted the quotation. In his response, Brady did offer to remove the quotation as a courtesy.
Despite some customer complaints, Brady's business is flourishing. He even supplements his income through online behavioral advertising (OBA) via a third-party ad network with whom he has set clearly defined roles. Brady is pleased that, although some customers are not explicitly aware of the OBA, the advertisements contain useful products and services.
Based on current trends in European privacy practices, which aspect of Brady Box' Online Behavioral Advertising (OBA) is most likely to be insufficient if the company becomes established in Europe?
- A. The level of security within the website.
- B. The need to have the contents of the advertising approved.
Section: (none)
Explanation - C. The lack of the option to opt in.
- D. The contract with the third-party advertising network.
Answer: C
NEW QUESTION 34
Which of the following is the weakest lawful basis for processing employee personal data?
- A. Processing based on fulfilling an employment contract.
- B. Processing based on employee consent.
- C. Processing based on legitimate interests.
- D. Processing based on legal obligation.
Answer: B
NEW QUESTION 35
SCENARIO
Please use the following to answer the next question:
BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information - name, location, and prior purchase history - with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.
Prior to sharing its customer list, BHealthy conducted a review of Natural Insight's security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy's data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight's machine learning algorithms.
In which case would Natural Insight's use of BHealthy's data for improvement of its algorithms be considered data processor activity?
- A. If Natural Insight agrees to be fully liable for its use of BHealthy's customer information in its product improvement activities.
- B. If Natural Insight uses BHealthy's data for improving price point predictions only for BHealthy.
- C. If Natural Insight receives express contractual instructions from BHealthy to use its data for improving its algorithms.
- D. If Natural Insight satisfies the transparency requirement by notifying BHealthy's customers of its plans to use their information for its product improvement activities.
Answer: B
NEW QUESTION 36
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's questions on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well.
The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's question. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
To ensure GDPR compliance, what should be the company's position on the issue of consent?
- A. Parental consent for a child's use of the action figures would have to be obtained before any data could be collected.
- B. The child, as the user of the action figure, can provide consent himself, as long as no information is shared for marketing purposes.
- C. Written authorization attesting to the responsible use of children's data would need to be obtained from the supervisory authority.
- D. Consent for data collection is implied through the parent's purchase of the action figure for the child.
Answer: A
NEW QUESTION 37
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's questions on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well. The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's question. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
What presents the BIGGEST potential privacy issue with the company's practices?
- A. The information about the data processing involved has not been specified
- B. The NFC portal can read any data stored in the action figures
- C. The RFID tag in the action figures has the potential for misuse because of the toy's evolving capabilities
- D. The cloud service provider is in a country that has not been deemed adequate
Answer: A
NEW QUESTION 38
A mobile device application that uses cookies will be subject to the consent requirement of which of the following?
- A. The E-Commerce Directive
- B. The ePrivacy Directive
- C. The EU Cybersecurity Directive
- D. The Data Retention Directive
Answer: B
NEW QUESTION 39
A company plans to transfer employee health information between two of its entities in France. To maintain the security of the processing, what would be the most important security measure to apply to the health data transmission?
- A. Ensure that the receiving entity has signed a data processing agreement.
- B. Inform the data subject of the security measures in place.
- C. Conduct a data protection impact assessment.
- D. Encrypt the transferred data in transit and at rest.
Answer: B
NEW QUESTION 40
What is the most frequently used mechanism for legitimizing cross-border data transfer?
- A. Approved Code of Conduct.
- B. Standard Contractual Clauses.
- C. Derogations.
- D. Binding Corporate Rules.
Answer: B
NEW QUESTION 41
To receive a preliminary interpretation on provisions of the GDPR, a national court will refer its case to which of the following?
- A. The European Data Protection Board.
- B. The Court of Justice of the European Union.
- C. The European Data Protection Supervisor.
- D. The European Court of Human Rights.
Answer: B
NEW QUESTION 42
According to the GDPR, what is the main task of a Data Protection Officer (DPO)?
- A. To monitor compliance with other local or European data protection provisions.
- B. To create procedures for notification of personal data breaches to competent supervisory authorities.
- C. To create and maintain records of processing activities.
- D. To conduct Privacy Impact Assessments on behalf of the controller or processor.
Answer: D
NEW QUESTION 43
Which of the following does NOT have to be included in the records most processors must maintain in relation to their data processing activities?
- A. Details of transfers of personal data to a third country carried out on behalf of each controller for which the processor is acting.
- B. Categories of processing carried out on behalf of each controller for which the processor is acting.
- C. Details of any data protection impact assessment conducted in relation to any processing activities carried out by the processor on behalf of each controller for which the processor is acting.
- D. Name and contact details of each controller on behalf of which the processor is acting.
Answer: A
NEW QUESTION 44
With the issue of consent, the GDPR allows member states some choice regarding what?
- A. The circumstances in which silence or inactivity may constitute consent
- B. The mechanisms through which consent may be communicated
- C. The timeframe in which data subjects are allowed to withdraw their consent
- D. The age at which children must be required to obtain parental consent
Answer: D
Explanation:
Explanation/Reference: https://gdpr-info.eu/issues/consent/
NEW QUESTION 45
Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC). Why is the Directive no longer part of EU law?
- A. The Directive was superseded by the General Data Protection Regulation.
- B. The Directive was superseded by the EU Directive on Privacy and Electronic Communications.
- C. The Directive was annulled by the European Court of Human Rights.
- D. The Directive was annulled by the Court of Justice of the European Union.
Answer: D
NEW QUESTION 46
An online company's privacy practices vary due to the fact that it offers a wide variety of services. How could it best address the concern that explaining them all would make the policies incomprehensible?
- A. Place a banner on its website stipulating that visitors agree to its privacy policy and terms of use by visiting the site.
- B. Use a layered privacy notice on its website and in its email communications.
- C. Identify uses of data in a privacy notice mailed to the data subject.
- D. Provide only general information about its processing activities and offer a toll-free number for more information.
Answer: C
NEW QUESTION 47
SCENARIO
Please use the following to answer the next question:
BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information - name, location, and prior purchase history - with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.
Prior to sharing its customer list, BHealthy conducted a review of Natural Insight's security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy's data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight's machine learning algorithms.
Under the GDPR, what are Natural Insight's security obligations with respect to the customer information it received from BHealthy?
- A. Absolute security since BHealthy is sharing personal data, including purchase history, with Natural Insight.
- B. The level of security that a reasonable data subject whose data is processed would expect in relation to the data subject's purchase history.
- C. Appropriate security that takes into account the industry practices for protecting customer contact information and purchase history.
- D. Only the security measures assessed by BHealthy prior to entering into the data processing contract.
Answer: C
NEW QUESTION 48
Tanya is the Data Protection Officer for Curtains Inc., a GDPR data controller. She has recommended that the company encrypt all personal data at rest. Which GDPR principle is she following?
- A. Accuracy
- B. Lawfulness, fairness and transparency
- C. Integrity and confidentiality
- D. Storage Limitation
Answer: C
NEW QUESTION 49
Which of the following does NOT have to be included in the records most processors must maintain in relation to their data processing activities?
- A. Details of transfers of personal data to a third country carried out on behalf of each controller for which the processor is acting.
- B. Categories of processing carried out on behalf of each controller for which the processor is acting.
- C. Details of any data protection impact assessment conducted in relation to any processing activities carried out by the processor on behalf of each controller for which the processor is acting.
- D. Name and contact details of each controller on behalf of which the processor is acting.
Answer: A
Explanation:
Explanation/Reference: https://gdpr-info.eu/art-30-gdpr/
NEW QUESTION 50
SCENARIO
Please use the following to answer the next question:
T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies.
T-Craze also opened various office locations throughout Europe to help expand its business. While Germany continued to host T-Craze's headquarters and main product-design office, its French affiliate became responsible for all marketing and sales activities. The French affiliate recently procured the services of Right Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T- Craze, though with much less success.
The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze.
Which of the following is T-Craze's lead supervisory authority?
- A. Germany, because that is where T-Craze is headquartered.
- B. T-Craze may choose its lead supervisory authority where any of its affiliates are based, because it has presence in several European countries.
- C. Spain, because that is T-Craze's primary market based on its marketing campaigns.
- D. France, because that is where T-Craze conducts processing of personal information.
Answer: C
NEW QUESTION 51
Which type of personal data does the GDPR define as a "special category" of personal data?
- A. Educational history.
- B. Trade-union membership.
- C. Closed Circuit Television (CCTV) footage.
- D. Financial information.
Answer: B
NEW QUESTION 52
Select the answer below that accurately completes the following:
"The right to compensation and liability under the GDPR...
- A. ...precludes any subsequent recourse proceedings against other controllers or processors involved in the same processing."
- B. ...can only be exercised against the data controller, even if a data processor was involved in the same processing."
- C. ...is limited to a maximum amount of EUR 20 million per event of damage or loss."
- D. ...provides for an exemption from liability if the data controller (or data processor) proves that it is not in any way responsible for the event giving rise to the damage."
Answer: A
NEW QUESTION 53
SCENARIO
Please use the following to answer the next question:
Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA analysis. The company is headquartered in Montreal, and all of its employees are located there. The company offers its services to Canadians only: Its website is in English and French, it accepts only Canadian currency, and it blocks internet traffic from outside of Canada (although this solution doesn't prevent all non-Canadian traffic). It also declines to process orders that request the DNA report to be sent outside of Canada, and returns orders that show a non-Canadian return address.
Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU, and the company is exploring a number of plans to expand its customer base.
The first plan, collegially called We-Track-U, will use an app to collect information about its current Canadian customer base. The expansion will allow its Canadian customers to use the app while traveling abroad. He suggests that the company use this app to gather location information. If the plan shows promise, Bob proposes to use push notifications and text messages to encourage existing customers to pre-register for an EU version of the service. Bob calls this work plan, We-Text-U. Once the company has gathered enough pre- registrations, it will develop EU-specific content and services.
Another plan is called Customer for Life. The idea is to offer additional services through the company's app, like storage and sharing of DNA information with other applications and medical providers. The company's contract says that it can keep customer DNA indefinitely, and use it to offer new services and market them to customers. It also says that customers agree not to withdraw direct marketing consent. Paul, the marketing director, suggests that the company should fully exploit these provisions, and that it can work around customers' attempts to withdraw consent because the contract invalidates them.
The final plan is to develop a brand presence in the EU. The company has already begun this process. It is in the process of purchasing the naming rights for a building in Germany, which would come with a few offices that Who-R-U executives can use while traveling internationally. The office doesn't include any technology or infrastructure; rather, it's simply a room with a desk and some chairs.
On a recent trip concerning the naming-rights deal, Bob's laptop is stolen. The laptop held unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of Canad a. The reports include customer name, birthdate, ethnicity, racial background, names of relatives, gender, and occasionally health information.
The Customer for Life plan may conflict with which GDPR provision?
- A. Article 16, which provides data subjects with a rights to rectification.
- B. Article 7, which requires consent to be as easy to withdraw as it is to give.
- C. Article 6, which requires processing to be lawful.
- D. Article 20, which gives data subjects a right to data portability.
Answer: B
NEW QUESTION 54
......
Updated PDF (New 2022) Actual IAPP CIPP-E Exam Questions: https://www.actual4test.com/CIPP-E_examcollection.html
Dumps Moneyack Guarantee - CIPP-E Dumps Approved Dumps: https://drive.google.com/open?id=1YhkNFmwAw1HLJ10cFxspKntIfYW2uydI