[Dec 15, 2021] Pass IAPP CIPP-E Exam Info and Free Practice Test
CIPP-E Exam Dumps PDF Updated Dump from Test4Cram Guaranteed Success
Certification Path
- The CIPP/E Certification is one of the major certifications organized by IAPP mainly focussing on the area of data privacy.
- There is no prerequisite for this exam but those professionals who having keen to work in the stream of data privacy and want to learn about how to keep your data records safely then CIPP/E is the right option for them.
Career Prospects
Obtaining the CIPP/E certification demonstrates your profound expertise in the European privacy laws and regulations, as well as your understanding of the legal requirements established for the transfer of sensitive personal data to and from the EU jurisdiction. Having this certificate under your belt opens the door to extensive career opportunities. Some of the job roles that you can apply for after getting certified include:
- Associate General Counsel
- Privacy Officer
- Human Resource Officer
- Legal Counsel
- General Counsel
- Chief Privacy Officer
- Compliance Officer
- Data Protection Lawyer
- Corporate Counsel
- Records Manager
Moreover, obtaining the CIPP/E certification is highly beneficial in financial terms. According to PayScale.com, the average income of the certified professionals amounts to $128,394 per annum. Your exact remuneration will depend on multiple factors, such as your location, the type of the organization you work for, your specific job title, among others.
CIPP/E is one of three privacy and data protection certificates offered within the IAPP certification program. Most professionals who have already earned it usually want to proceed with the advanced-level options, namely Certified Information Privacy Manager (CIPM) as well as Certified Information Privacy Technologist (CIPT).
NEW QUESTION 105
Which change was introduced by the 2009 amendments to the e-Privacy Directive 2002/58/EC?
- A. A mandatory notification for personal data breaches applicable to electronic communication providers.
- B. A voluntary notification for personal data breaches applicable to electronic communication providers.
- C. A mandatory notification for personal data breaches applicable to all data controllers.
- D. A voluntary notification for personal data breaches applicable to all data controllers.
Answer: A
NEW QUESTION 106
SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester's Alumni portal. Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna's data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna's training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna's tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Before Anna determines whether Frank's performance database is permissible, what additional information does she need?
- A. More information about the algorithm Frank used to mask student numbers.
- B. More information about the extent of the information loss.
- C. More information about what students have been told and how the research will be used.
- D. More information about Frank's data protection training.
Answer: C
NEW QUESTION 107
In 2016's Guidance, the United Kingdom's Information Commissioner's Office (ICO) reaffirmed the importance of using a "layered notice" to provide data subjects with what?
- A. An explanation of the security measures used when personal data is transferred to a third party.
- B. An efficient means of providing written consent in member states where they are required to do so.
- C. A privacy notice containing brief information whilst offering access to further detail.
- D. A privacy notice explaining the consequences for opting out of the use of cookies on a website.
Answer: A
NEW QUESTION 108
The European Parliament jointly exercises legislative and budgetary functions with which of the following?
- A. The European Commission.
- B. The European Data Protection Board.
- C. The Council of the European Union.
- D. The Article 29 Working Party.
Answer: C
NEW QUESTION 109
According to the GDPR, what is the main task of a Data Protection Officer (DPO)?
- A. To monitor compliance with other local or European data protection provisions.
- B. To create and maintain records of processing activities.
- C. To create procedures for notification of personal data breaches to competent supervisory authorities.
- D. To conduct Privacy Impact Assessments on behalf of the controller or processor.
Answer: D
NEW QUESTION 110
What is a reason the European Court of Justice declared the Data Retention Directive invalid in 2014?
- A. The requirements specified that data must be held within the EU.
- B. The requirements affected individuals without exception.
- C. The requirements had limitations on how national authorities could use data.
- D. The requirements were financially burdensome to EU businesses.
Answer: C
Explanation:
Reference:
%20the%20Grand,proportionality%20in%20forging%20the%20Directive.
NEW QUESTION 111
Which of the following is NOT considered a fair processing practice in relation to the transparency principle?
- A. Providing a "just-in-time" contextual pop-up privacy notice, in an online application from field.
- B. Providing a QR code linking to more detailed privacy notice, in a CCTV sign.
- C. Providing a hyperlink to the organization's home page, in a hard copy application form.
- D. Providing a multi-layered privacy notice, in a website environment.
Answer: D
NEW QUESTION 112
SCENARIO
Please use the following to answer the next question:
T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies.
T-Craze also opened various office locations throughout Europe to help expand its business. While Germany Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T- Craze, though with much less success.
The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze.
What is the best option for the lead regulator when responding to the Spanish supervisory authority's notice that it plans to take action regarding Sofia's complaint?
- A. Reject, because GDPR does not allow other supervisory authorities to take action if there is a lead authority.
- B. Accept, because GDPR permits non-lead authorities to take action for such complaints.
- C. Reject, because Right Target's processing was conducted throughout Europe.
- D. Accept, because it did not receive any complaints.
Answer: A
NEW QUESTION 113
To receive a preliminary interpretation on provisions of the GDPR, a national court will refer its case to which of the following?
- A. The European Data Protection Board.
- B. The European Data Protection Supervisor.
- C. The Court of Justice of the European Union.
- D. The European Court of Human Rights.
Answer: C
NEW QUESTION 114
If a French controller has a car-sharing app available only in Morocco, Algeria and Tunisia, but the data processing activities are carried out by the appointed processor in Spain, the GDPR will apply to the processing of the personal data so long as?
- A. The individuals are European citizens or residents.
- B. The data processing activities are in Spain.
- C. The EU individuals are targeted.
- D. The data controller is in France.
Answer: C
NEW QUESTION 115
SCENARIO
Please use the following to answer the next question:
Ben is a member of the fitness club STAYFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Ben lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Ben was photographed while working out at a branch of STAYFIT in Frankfurt, Germany. At the time, Ben gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Ben no longer feels comfortable with his photograph being publicly associated with the fitness club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Ben sends a letter to STAYFIT requesting that his image be removed from the website and all promotional materials. Months pass and Ben, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact STAYFIT through alternate channels, he decides to take action against the company.
Ben contacts the U.K. Information Commissioner's Office ('ICO' - the U.K.'s supervisory authority) to lodge a complaint about this matter.
Under the cooperation mechanism, what should the lead authority (the CNIL) do after it has formed its view on the matter?
- A. Request that the other supervisory authorities provide the lead authority with a draft decision for its consideration.
- B. Submit a draft decision directly to the Commission to ensure the effectiveness of the consistency mechanism.
- C. Request that members of the seconding supervisory authority and the host supervisory authority co-draft a decision.
- D. Submit a draft decision to other supervisory authorities for their opinion.
Answer: A
NEW QUESTION 116
SCENARIO
Please use the following to answer the next question:
WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of their service, WonderKids will pass all personal data provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person booking the childcare, address and contact details, as well as information about the children to be cared for including name, age, gender and health information. The privacy statement on Wonderkids' website states the following:
"WonderkKids provides the information you disclose to us through this website to your childcare provider for scheduling and health and safety reasons. We may also use your and your child's personal information for our own legitimate business purposes and we employ a third-party website hosting company located in Switzerland to store the dat a. Any data stored on equipment located in Switzerland meets the European Commission provisions for guaranteeing adequate safeguards for you and your child's personal information. We will only share you and your child's personal information with businesses that we see as adding real value to you. By providing us with any personal data, you consent to its transfer to affiliated businesses and to send you promotional offers."
"We may retain you and your child's personal information for no more than 28 days, at which point the data will be depersonalized, unless your personal information is being used for a legitimate business purpose beyond 28 days where it may be retained for up to 2 years."
"We are processing you and your child's personal information with your consent. If you choose not to provide certain information to us, you may not be able to use our services. You have the right to: request access to you and your child's personal information; rectify or erase you or your child's personal information; the right to correction or erasure of you and/or your child's personal information; object to any processing of you and your child's personal information. You also have the right to complain to the supervisory authority about our data processing activities." What must the contract between WonderKids and the hosting service provider contain?
- A. Audit rights for the data subjects.
- B. A non-disclosure agreement.
- C. The requirement to implement technical and organizational measures to protect the data.
- D. Controller-to-controller model contract clauses.
Answer: C
NEW QUESTION 117
Which sentence BEST summarizes the concepts of "fairness," "lawfulness" and "transparency", as expressly required by Article 5 of the GDPR?
- A. Fairness refers to the security of personal data; lawfulness and transparency refers to the analysis of ordinances to ensure they are uniformly enforced.
- B. Fairness refers to limiting the amount of data collected from individuals; lawfulness refers to the approval of company guidelines by the state; transparency solely relates to communication of key information before collecting data.
- C. Fairness refers to the collection of data from diverse subjects; lawfulness refers to the need for legal rules to be uniform; transparency refers to giving individuals access to their data.
- D. Fairness and transparency refer to the communication of key information before collecting data; lawfulness refers to compliance with government regulations.
Answer: D
NEW QUESTION 118
SCENARIO
Please use the following to answer the next question:
Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B.
Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.
Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees:
* Name
* Address
* Date of Birth
* Payroll number
* National Insurance number
* Sick pay entitlement
* Maternity/paternity pay entitlement
* Holiday entitlement
* Pension and benefits contributions
* Trade union contributions
Jenny is the compliance officer at Company A.
She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required.
Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.
Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B.
This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.
Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees.
The GDPR requires sufficient guarantees of a company's ability to implement adequate technical and organizational measures. What would be the most realistic way that Company B could have fulfilled this requirement?
- A. Avoiding the use of another company's data to improve their own services.
- B. Requesting advice and technical support from Company A's IT team.
- C. Vetting companies' measures with the appropriate supervisory authority.
- D. Hiring companies whose measures are consistent with recommendations of accrediting bodies.
Answer: D
NEW QUESTION 119
A U.S.-based online shop uses sophisticated software to track the browsing behavior of its European customers and predict future purchases. It also shares this information with third parties. Under the GDPR, what is the online shop's PRIMARY obligation while engaging in this kind of profiling?
- A. It must solicit informed consent through a notice on its website
- B. It must be able to demonstrate a prior business relationship with the customers
- C. It must prove that it uses sufficient security safeguards to protect customer data
- D. It must seek authorization from the European supervisory authorities
Answer: A
NEW QUESTION 120
Under the GDPR, which of the following is true in regard to adequacy decisions involving cross-border transfers?
- A. To be considered as adequate, third countries must implement the EU General Data Protection Regulation into their national legislation.
- B. The European Commission can adopt an adequacy decision for individual companies.
- C. The European Commission can adopt, repeal or amend an existing adequacy decision.
- D. EU member states are vested with the power to accept or reject a European Commission adequacy decision.
Answer: B
NEW QUESTION 121
......
Pass Your IAPP Exam with CIPP-E Exam Dumps: https://www.test4cram.com/CIPP-E_real-exam-dumps.html
CIPP-E Exam Dumps - IAPP Practice Test Questions: https://drive.google.com/open?id=1goX1mNLpVsIS23IH2H86HV9IIBjbExEI