IAPP CIPP-E Certified Information Privacy Professional/Europe (CIPP/E) Online Training
IAPP CIPP-E Online Training
The questions for CIPP-E were last updated at Apr 26,2025.
- Exam Code: CIPP-E
- Exam Name: Certified Information Privacy Professional/Europe (CIPP/E)
- Certification Provider: IAPP
- Latest update: Apr 26,2025
Limitation of liability. […]
Consent
By completing this registration form, you attest that you are at least 16 years of age, and that you consent to the processing of your personal data by Vigotron for the purpose of using the M-Health app. Although you are entitled to opt out of any advertising or marketing, you agree that Vigotron may contact you or provide you with any required notices, agreements, or other information concerning the services by email or other electronic means. You also agree that the Company may send automated emails with alerts regarding any problems with the M-Health app that may affect your well being.
What is one potential problem Vigotron’s age policy might encounter under the GDPR?
- A . Age restrictions are more stringent when health data is involved.
- B . Users are only required to be aged 13 or over to be considered adults.
- C . Organizations must make reasonable efforts to verify parental consent.
- D . Organizations that tie a service to marketing must seek consent for each purpose.
Based on GDPR Article 35, which of the following situations would trigger the need to complete a DPIA?
- A . A company wants to combine location data with other data in order to offer more personalized service for the customer.
- B . A company wants to use location data to infer information on a person’s clothes purchasing habits.
- C . A company wants to build a dating app that creates candidate profiles based on location data and data from third-party sources.
- D . A company wants to use location data to track delivery trucks in order to make the routes more efficient.
SCENARIO
Please use the following to answer the next question:
Brady is a computer programmer based in New Zealand who has been running his own business for two years. Brady’s business provides a low-cost suite of services to customers throughout the European Economic Area (EEA). The services are targeted towards new and aspiring small business owners. Brady’s company, called Brady Box, provides web page design services, a Social Networking Service (SNS) and consulting services that help people manage their own online stores.
Unfortunately, Brady has been receiving some complaints. A customer named Anna recently uploaded her plans for a new product onto Brady Box’s chat area, which is open to public viewing. Although she realized her mistake two weeks later and removed the document, Anna is holding Brady Box responsible for not noticing the error through regular monitoring of the website. Brady believes he should not be held liable.
Another customer, Felipe, was alarmed to discover that his personal information was transferred to a third- party contractor called Hermes Designs and worries that sensitive information regarding his business plans may be misused. Brady does not believe he violated European privacy rules. He provides a privacy notice to all of his customers explicitly stating that personal data may be transferred to specific third parties in fulfillment of a requested service. Felipe says he read the privacy notice but that it was long and complicated
Brady continues to insist that Felipe has no need to be concerned, as he can personally vouch for the integrity of Hermes Designs. In fact, Hermes Designs has taken the initiative to create sample customized banner advertisements for customers like Felipe. Brady is happy to provide a link to the example banner ads, now posted on the Hermes Designs webpage. Hermes Designs plans on following up with direct marketing to these customers.
Brady was surprised when another customer, Serge, expressed his dismay that a quotation by him is being used within a graphic collage on Brady Box’s home webpage. The quotation is attributed to Serge by first and last name. Brady, however, was not worried about any sort of litigation. He wrote back to Serge to let him know that he found the quotation within Brady Box’s Social Networking Service (SNS), as Serge himself had posted the quotation. In his response, Brady did offer to remove the quotation as a courtesy.
Despite some customer complaints, Brady’s business is flourishing. He even supplements his income through online behavioral advertising (OBA) via a third-party ad network with whom he has set clearly defined roles. Brady is pleased that, although some customers are not explicitly aware of the OBA, the advertisements contain useful products and services.
Based on current trends in European privacy practices, which aspect of Brady Box’ Online Behavioral Advertising (OBA) is most likely to be insufficient if the company becomes established in Europe?
- A . The lack of the option to opt in.
- B . The level of security within the website.
- C . The contract with the third-party advertising network.
- D . The need to have the contents of the advertising approved.
Which of the following is NOT recognized as being a common characteristic of cloud-computing services?
- A . The service’s infrastructure is shared among the supplier’s customers and can be located in a number of countries.
- B . The supplier determines the location, security measures, and service standards applicable to the processing.
- C . The supplier allows customer data to be transferred around the infrastructure according to capacity.
- D . The supplier assumes the vendor’s business risk associated with data processed by the supplier.
There are three domains of security covered by Article 32 of the GDPR that apply to both the controller and the processor. These include all of the following EXCEPT?
- A . Consent management and withdrawal.
- B . Incident detection and response.
- C . Preventative security.
- D . Remedial security.
A company wishes to transfer personal data to a country outside of the European Union/EEA In order to do so, they are planning an assessment of the country’s laws and practices, knowing that these may impinge upon the transfer safeguards they intend to use All of the following factors would be relevant for the company to consider EXCEPT’?
- A . Any onward transfers, such as transfers of personal data to a sub-processor in the same or another third country.
- B . The process of modernization in the third country concerned and their access to emerging technologies that rely on international transfers of personal data
- C . The technical, financial, and staff resources available to an authority m the third country concerned that may access the personal data to be transferred
- D . The contractual clauses between the data controller or processor established in the European Union/EEA and the recipient of the transfer established in the third country concerned
Which of the following would NOT be relevant when determining if a processing activity would be considered profiling?
- A . If the processing is to be performed by a third-party vendor
- B . If the processing involves data that is considered personal data
- C . If the processing of the data is done through automated means
- D . If the processing is used to predict the behavior of data subjects
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company’s revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children’s Questions: on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well. The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a QUESTION, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure’s integrated speakers, making it appear as though that the toy is actually responding to the child’s QUESTION. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures’ abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character’s abilities remain intact.
In light of the requirements of Article 32 of the GDPR (related to the Security of Processing), which practice should the company institute?
- A . Encrypt the data in transit over the wireless Bluetooth connection.
- B . Include dual-factor authentication before each use by a child in order to ensure a minimum amount of security.
- C . Include three-factor authentication before each use by a child in order to ensure the best level of security possible.
- D . Insert contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union.
When hiring a data processor, which action would a data controller NOT be able to depend upon to avoid liability in the event of a security breach?
- A . Documenting due diligence steps taken in the pre-contractual stage.
- B . Conducting a risk assessment to analyze possible outsourcing threats.
- C . Requiring that the processor directly notify the appropriate supervisory authority.
- D . Maintaining evidence that the processor was the best possible market choice available.
Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC).
Why is the Directive no longer part of EU law?
- A . The Directive was superseded by the EU Directive on Privacy and Electronic Communications.
- B . The Directive was superseded by the General Data Protection Regulation.
- C . The Directive was annulled by the Court of Justice of the European Union.
- D . The Directive was annulled by the European Court of Human Rights.
Latest CIPP-E Dumps Valid Version with 157 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
