[2023] Use Real IAPP Dumps - 100% Free CIPP-E Exam Dumps
Realistic CIPP-E Dumps Latest IAPP Practice Tests Dumps
NEW QUESTION # 35
SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
In which of the following situations would ABC Hotel Chain and XYZ Travel Agency NOT have to honor Mike's data access request?
- A. The request is to obtain access and correct inaccurate personal data in his profile.
- B. The request is to obtain access and information about the purpose of processing his personal data.
- C. The request is to obtain access and erasure of his personal data while keeping his rewards membership.
- D. The request is to obtain access and the categories of recipients who have received his personal data to process his rewards membership.
Answer: C
NEW QUESTION # 36
Please use the following to answer the next question:
ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorage What transfer mechanism should Jackie recommend for using InstaHR?
- A. Standard contractual clauses
- B. Explicit consent of employees.
- C. Adequacy
- D. Binding corporate rules.
Answer: B
NEW QUESTION # 37
With respect to international transfers of personal data, the European Data Protection Board (EDPB) confirmed that derogations may be relied upon under what condition?
- A. Only if the Data Protection Impact Assessment (DPIA) shows low risk.
- B. When it has been determined that adequate protection can be performed.
- C. Only as a last resort and when interpreted restrictively.
- D. If the data controller has received preapproval from a Data Protection Authority (DPA), after submitting the appropriate documents.
Answer: B
NEW QUESTION # 38
SCENARIO
Please use the following to answer the next question:
BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information - name, location, and prior purchase history - with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.
Prior to sharing its customer list, BHealthy conducted a review of Natural Insight's security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy's data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight's machine learning algorithms.
In which case would Natural Insight's use of BHealthy's data for improvement of its algorithms be considered data processor activity?
- A. If Natural Insight uses BHealthy's data for improving price point predictions only for BHealthy.
- B. If Natural Insight agrees to be fully liable for its use of BHealthy's customer information in its product improvement activities.
- C. If Natural Insight receives express contractual instructions from BHealthy to use its data for improving its algorithms.
- D. If Natural Insight satisfies the transparency requirement by notifying BHealthy's customers of its plans to use their information for its product improvement activities.
Answer: A
NEW QUESTION # 39
SCENARIO
Please use the following to answer the next question:
ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorage Why is the additional measure recommended by Jackie sufficient foe using UpFinance?
- A. UpFinance implements sufficient data protection measures
- B. UpFinance is in a highly regulated financial industry
- C. UpFinance is an established 7-year-old business.
- D. UpFinance is based in a country without surveillance laws.
Answer: D
NEW QUESTION # 40
Which statement is correct when considering the right to privacy under Article 8 of the European Convention on Human Rights (ECHR)?
- A. The right to privacy has to be balanced against other rights under the ECHR
- B. The right to freedom of expression under Article 10 of the ECHR will always override the right to privacy
- C. The right to privacy protects the right to hold opinions and to receive and impart ideas without interference
- D. The right to privacy is an absolute right
Answer: A
NEW QUESTION # 41
A U.S. company's website sells widgets. Which of the following factors would NOT in itself subject the company to the GDPR?
- A. The website is in English and French, and is accessible in France.
- B. The website places cookies to monitor the EU website user behavior.
- C. The widgets are offered in EU and priced in euro.
- D. An affiliate office is located in France but the processing is in the U.S.
Answer: C
NEW QUESTION # 42
How does the GDPR now define "processing"?
- A. Any operation or set of operations performed on personal data or on sets of personal data.
- B. Any use or disclosure of personal data compatible with the purpose for which the data was collected.
- C. Any operation or set of operations performed by automated means on personal data or on sets of personal data.
- D. Any act involving the collecting and recording of personal data.
Answer: D
Explanation:
Explanation/Reference: https://gdpr-info.eu/issues/processing/
NEW QUESTION # 43
Which of the following countries will continue to enjoy adequacy status under the GDPR, pending any future European Commission decision to the contrary?
- A. Switzerland
- B. Norway
- C. Greece
- D. Australia
Answer: A
NEW QUESTION # 44
Which judicial body makes decisions on actions taken by individuals wishing to enforce their rights under EU law?
- A. Court of Justice of European Union
- B. Court of Auditors
- C. European Court of Human Rights
- D. European Data Protection Board
Answer: A
Explanation:
Reference https://europa.eu/european-union/about-eu/institutions-bodies/court-justice_en
NEW QUESTION # 45
SCENARIO
Please use the following to answer the next question:
Zandelay Fashion ('Zandelay') is a successful international online clothing retailer that employs approximately
650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures. Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay's business plan and associated processing activities.
What must Zandelay provide to the supervisory authority during the prior consultation?
- A. Certificates that prove Martin's professional qualities and expert knowledge of data protection law.
- B. An evaluation of the complexity of the intended processing.
- C. Records showing that customers have explicitly consented to the intended profiling activities.
- D. An explanation of the purposes and means of the intended processing.
Answer: D
NEW QUESTION # 46
If a company is planning to use closed-circuit television (CCTV) on its premises and is concerned with GDPR compliance, it should first do all of the following EXCEPT?
- A. Perform a data protection impact assessment (DPIA).
- B. Notify the appropriate data protection authority.
- C. Create an information retention policy for those who operate the system.
- D. Ensure that safeguards are in place to prevent unauthorized access to the footage.
Answer: C
NEW QUESTION # 47
When does the European Data Protection Board (EDPB) recommend reevaluating whether a transfer tool is effectively providing a level of personal data protection that is in compliance with the European Union (EU) level?
- A. Every three (3) years.
- B. On an ongoing basis.
- C. After a personal data breach.
- D. Every year.
Answer: B
Explanation:
Reference https://edpb.europa.eu/sites/default/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf
NEW QUESTION # 48
SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location. During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
What would be the MOST APPROPRIATE way for Building Block to handle the situation with the employee from Italy?
- A. Since the employee was not informed that the security measures would be used for other purposes such as monitoring, the company could face difficulties in applying any disciplinary measures to this employee.
- B. Since the employee was the cause of a serious risk for the server performance and their data, the company would be entitled to apply disciplinary measures to this employee, including fair dismissal.
- C. Since the GDPR does not apply to this situation, the company would be entitled to apply any disciplinary measure authorized under Italian labor law.
- D. Since this was a serious infringement, but the employee was not appropriately informed about the consequences the new security measures, the company would be entitled to apply some disciplinary measures, but not dismissal.
Answer: D
NEW QUESTION # 49
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's questions on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well.
The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's question. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
In light of the requirements of Article 32 of the GDPR (related to the Security of Processing), which practice should the company institute?
- A. Encrypt the data in transit over the wireless Bluetooth connection.
- B. Include three-factor authentication before each use by a child in order to ensure the best level of security possible.
- C. Insert contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union.
- D. Include dual-factor authentication before each use by a child in order to ensure a minimum amount of security.
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION # 50
When would a data subject NOT be able to exercise the right to portability?
- A. When the processing is based on consent.
- B. When the data was supplied to the controller by the data subject.
- C. When the processing is necessary to perform a task in the exercise of authority vested in the controller.
- D. When the processing is carried out pursuant to a contract with the data subject.
Answer: C
NEW QUESTION # 51
The European Parliament jointly exercises legislative and budgetary functions with which of the following?
- A. The European Data Protection Board.
- B. The Council of the European Union.
- C. The European Commission.
- D. The Article 29 Working Party.
Answer: B
NEW QUESTION # 52
What is the most frequently used mechanism for legitimizing cross-border data transfer?
- A. Derogations.
- B. Binding Corporate Rules.
- C. Standard Contractual Clauses.
- D. Approved Code of Conduct.
Answer: C
Explanation:
Reference https://www.dataguidance.com/opinion/international-eu-us-cross-border-data-transfers
NEW QUESTION # 53
What is the MAIN reason GDPR Article 4(22) establishes the concept of the "concerned supervisory authority"?
- A. To ensure that the interests of individuals residing outside the lead authority's jurisdiction are represented.
- B. To give corporations a choice about who their supervisory authority will be.
- C. To encourage the consistency of local data processing activity.
- D. To ensure the GDPR covers controllers that do not have an establishment in the EU but have a representative in a member state.
Answer: A
NEW QUESTION # 54
......
CIPP-E Dumps PDF - CIPP-E Real Exam Questions Answers: https://prep4sure.real4dumps.com/CIPP-E-prep4sure-exam.html
