CIPP-E V1

Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?A . Data subjects must be sufficiently informed of the purposes for which their personal data is processed.B . Processing of special categories of personal data on a large scale requires appointing a...

Which of the following is the weakest lawful basis for processing employee personal data?A . Processing based on fulfilling an employment contract.B . Processing based on employee consent.C . Processing based on legitimate interests.D . Processing based on legal obligation.View AnswerAnswer: B Explanation: Reference: https://www.itgovernance.co.uk/blog/gdpr-lawful-bases-for-processing-with-examples

Under Article 58 of the GDPR, which of the following describes a power of supervisory authorities in European Union (EU) member states?A . The ability to enact new laws by executive order.B . The right to access data for investigative purposes.C . The discretion to carry out goals of elected...

The origin of privacy as a fundamental human right can be found in which document?A . Universal Declaration of Human Rights 1948.B . European Convention of Human Rights 1953.C . OECD Guidelines on the Protection of Privacy 1980.D . Charier of Fundamental Rights of the European Union 2000.View AnswerAnswer: A

Which of the following countries will continue to enjoy adequacy status under the GDPR, pending any future European Commission decision to the contrary?A . GreeceB . NorwayC . AustraliaD . SwitzerlandView AnswerAnswer: D Explanation: Reference: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

What is the main task of the European Data Protection Board?A . To assess adequacy of data protection in third countriesB . To ensure consistent application of the GDPR.C . To proactively prevent disputes between national supervisory authorities.D . To publish guidelines tor data subjects on how to property enforce...

For which of the following operations would an employer most likely be justified in requesting the data subject’s consent?A . Posting an employee’s bicycle race photo on the company’s social media.B . Processing an employee’s health certificate in order to provide sick leave.C . Operating a CCTV system on company...

How does the GDPR now define “processing”?A . Any act involving the collecting and recording of personal data.B . Any operation or set of operations performed on personal data or on sets of personal data.C . Any use or disclosure of personal data compatible with the purpose for which the...

According to Article 14 of the GDPR, how long does a controller have to provide a data subject with necessary privacy information, if that subject’s personal data has been obtained from other sources?A . As soon as possible after obtaining the personal data.B . As soon as possible after the...

Article 29 Working Party has emphasized that the GDPR forbids “forum shopping”, which occurs when companies do what?A . Choose the data protection officer that is most sympathetic to their business concerns.B . Designate their main establishment in member state with the most flexible practices.C . File appeals of infringement...