IAPP CIPP-E Certified Information Privacy Professional/Europe (CIPP/E) Online Training
IAPP CIPP-E Online Training
The questions for CIPP-E were last updated at Apr 21,2025.
- Exam Code: CIPP-E
- Exam Name: Certified Information Privacy Professional/Europe (CIPP/E)
- Certification Provider: IAPP
- Latest update: Apr 21,2025
How is the retention of communications traffic data for law enforcement purposes addressed by European data protection law?
- A . The ePrivacy Directive allows individual EU member states to engage in such data retention.
- B . The ePrivacy Directive harmonizes EU member states’ rules concerning such data retention.
- C . The Data Retention Directive’s annulment makes such data retention now permissible.
- D . The GDPR allows the retention of such data for the prevention, investigation, detection or prosecution of criminal offences only.
Since blockchain transactions are classified as pseudonymous, are they considered to be within the material scope of the GDPR or outside of it?
- A . Outside the material scope of the GDPR, because transactions do not include personal data about data subjects m the European Union.
- B . Within the material scope of the GDPR but outside of the territorial scope, because blockchains are decentralized.
- C . Within the material scope of the GDPR to the extent that transactions include data subjects in the European Union.
- D . Outside the material scope of the GDPR, because transactions are for personal or household purposes
Which change was introduced by the 2009 amendments to the e-Privacy Directive 2002/58/EC?
- A . A voluntary notification for personal data breaches applicable to all data controllers.
- B . A voluntary notification for personal data breaches applicable to electronic communication providers.
- C . A mandatory notification for personal data breaches applicable to all data controllers.
- D . A mandatory notification for personal data breaches applicable to electronic communication providers.
Bioface is a company based in the United States. It has no servers, personnel or assets in the European Union. By collecting photographs from social media and other web-based services, such as newspapers and blogs, it uses machine learning to develop a facial recognition algorithm. The algorithm identifies individuals in photographs who are not in its data set based the algorithm and its existing data. The service collects photographs of data subjects in the European Union and will identify them if presented with their photographs. Bioface offers its service to government agencies and companies in the United States and Canada, but not to those in the European Union. Bioface does not offer the service to individuals.
Why is Bioface subject to the territorial scope of the General Data Protection Regulation?
- A . It collects data from European Union websites, which constitutes an establishment in the European Union.
- B . It offers services in the European Union by identifying data subjects in the European Union.
- C . It collects data from subjects and uses it for automated processing.
- D . It monitors the behavior of data subjects in the European Union.
After detecting an intrusion involving the theft of unencrypted personal data, who shall the breached company notify first under GDPR requirements?
- A . Any parents of children whose personal data was compromised.
- B . Any affected customers whose data was compromised.
- C . A competent supervisory authority.
- D . A local law enforcement agency
SCENARIO
Please use the following to answer the next question:
Javier is a member of the fitness club EVERFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Javier lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Javier was photographed while working out at a branch of EVERFIT in Frankfurt, Germany. At the time, Javier gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club’s U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Javier no longer feels comfortable with his photograph being publicly associated with the fitness club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Javier sends a letter to EVETFIT requesting that his image be removed from the website and all promotional materials. Months pass and Javier, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact EVETFIT through alternate channels, he decides to take action against the company.
Javier contacts the U.K. Information Commissioner’s Office (‘ICO’ C the U.K.’s supervisory authority) to lodge a complaint about this matter. The ICO, pursuant to Article 56 (3) of the GDPR, informs the CNIL (i.e. the supervisory authority of EVERFIT’s main establishment) about this matter. Despite the fact that EVERFIT has an establishment in the U.K., the CNIL decides to handle the case in accordance with Article 60 of the GDPR. The CNIL liaises with the ICO, as relevant under the cooperation procedure. In light of issues amongst the supervisory authorities to reach a decision, the European Data Protection Board becomes involved and, pursuant to the consistency mechanism, issues a binding decision.
Additionally, Javier sues EVERFIT for the damages caused as a result of its failure to honor his request to have his photograph removed from the brochure and website.
Under the cooperation mechanism, what should the lead authority (the CNIL) do after it has formed its view on the matter?
- A . Submit a draft decision to other supervisory authorities for their opinion.
- B . Request that the other supervisory authorities provide the lead authority with a draft decision for its consideration.
- C . Submit a draft decision directly to the Commission to ensure the effectiveness of the consistency mechanism.
- D . Request that members of the seconding supervisory authority and the host supervisory authority co-draft a decision.
Which marketing-related activity is least likely to be covered by the provisions of Privacy and Electronic Communications Regulations (Directive 2002/58/EC)?
- A . Advertisements passively displayed on a website.
- B . The use of cookies to collect data about an individual.
- C . A text message to individuals from a company offering concert tickets for sale.
- D . An email from a retail outlet promoting a sale to one of their previous customer.
Under which of the following conditions does the General Data Protection Regulation NOT apply to the processing of personal data?
- A . When the personal data is processed only in non-electronic form
- B . When the personal data is collected and then pseudonymised by the controller
- C . When the personal data is held by the controller but not processed for further purposes
- D . When the personal data is processed by an individual only for their household activities
Pursuant to Article 17 and EDPB Guidelines S’2019 on RTBF criteria in search engines cases, all of the following would be valid grounds for data subject delisting requests EXCEPT?
- A . The personal dale has been collected in relation to the offer of Information society services (ISS) to a child.
- B . The data subject withdraws consent and there is no other legal basis for the processing.
- C . The personal data is no longer necessary in relation to the search engine provider’s processing
- D . The processing s necessary for exercising the right of freedom of expression and information
SCENARIO
Please use the following to answer the next question:
Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy company operating in every continent. All of the company’s IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father’s company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.
Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company’s online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers’ philosophical beliefs, political opinions and marital status.
If a customer identifies as single, Ben then copies all of that customer’s personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.
Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.
Joe also hires his best friend’s daughter, Alice, who just graduated from law school in the U.S., to be the company’s new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company’s operations in the European Union to the U.S.
Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company’s IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone’s information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.
As a result of Sam’s actions, the Gummy Bear Company potentially violated Articles 33 and 34 of the GDPR and will be required to do what?
- A . Notify its Data Protection Authority about the data breach.
- B . Analyze and evaluate the liability for customers in Ireland.
- C . Analyze and evaluate all of its breach notification obligations.
- D . Notify all of its customers that reside in the European Union.
Latest CIPP-E Dumps Valid Version with 157 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
