IAPP CIPP-E Exam Dumps

Certified Information Privacy Professional/Europe (CIPP/E)

Recent CIPP-E Exam Results

Our IAPP CIPP-E dumps are key to get success. More than 80000+ success stories.

20

Clients Passed IAPP CIPP-E Exam Today

93%

Passing score in Real IAPP CIPP-E Exam

95%

Questions were from our given CIPP-E dumps

IAPP CIPP-E Sample Questions

Question # 1

In which of the following cases would an organization MOST LIKELY be required to followboth ePrivacy and data protection rules?

A. When creating an untargeted pop-up ad on a website.  
B. When calling a potential customer to notify her of an upcoming product sale.  
C. When emailing a customer to announce that his recent order should arrive earlier than expected.
D. When paying a search engine company to give prominence to certain products andservices within specific search results. 

Answer: D

Show Answer

Question # 2

SCENARIOPlease use the following to answer the next question:Liem, an online retailer known for its environmentally friendly shoes, has recently expandedits presence in Europe. Anxious to achieve market dominance, Liem teamed up withanother eco friendly company, EcoMick, which sells accessories like belts and bags.Together the companies drew up a series of marketing campaigns designed to highlight theenvironmental and economic benefits of their products. After months of planning, Liem andEcoMick entered into a data sharing agreement to use the same marketing database,MarketIQ, to send the campaigns to their respective contacts.Liem and EcoMick also entered into a data processing agreement with MarketIQ, the termsof which included processing personal data only upon Liem and EcoMick’s instructions,and making available to them all information necessary to demonstrate compliance withGDPR obligations.Liem and EcoMick then procured the services of a company called JaphSoft, a marketingoptimization firm that uses machine learning to help companies run successful campaigns.Clients provide JaphSoft with the personal data of individuals they would like to be targetedin each campaign. To ensure protection of itsclients’ data, JaphSoft implements the technical and organizational measures it deemsappropriate. JaphSoft works to continually improve its machine learning models byanalyzing the data it receives from its clients to determine the most successful componentsof a successful campaign. JaphSoft then uses such models in providing services to itsclient-base. Since the models improve only over a period of time as more information iscollected, JaphSoft does not have a deletion process for the data it receives from clients.However, to ensure compliance with data privacy rules, JaphSoft pseudonymizes thepersonal data by removing identifyinginformation from the contact information. JaphSoft’s engineers, however, maintain allcontact information in the same database as the identifying information.Under its agreement with Liem and EcoMick, JaphSoft received access to MarketIQ, whichincluded contact information as well as prior purchase history for such contacts, to createcampaigns that would result in the most views of the two companies’ websites. A prior Liemcustomer, Ms. Iman, received a marketing campaign from JaphSoft regarding Liem’s aswell as EcoMick’s latest products. While Ms. Iman recalls checking a box to receiveinformation in the future regarding Liem’s products, she has never shopped EcoMick, norprovided her personal data to that company.Which of the following BEST describes the relationship between Liem, EcoMick andJaphSoft?

A. Liem is a controller and EcoMick is a processor because Liem provides specificinstructions regarding how the marketing campaigns should be rolled out.
B. EcoMick and JaphSoft are is a controller and Liem is a processor because EcoMick issharing its marketing data with Liem for contacts in Europe. 
C. JaphSoft is the sole processor because it processes personal data on behalf of its clients. 
D. Liem and EcoMick are joint controllers because they carry out joint marketing activities.  

Answer: D

Show Answer

Question # 3

Which sentence best describes proper compliance for an international organization usingBinding Corporate Rules (BCRs) as a controller or processor?

A. Employees must sign an ad hoc contractual agreement each time personal data isexported. 
B. All employees are subject to the rules in their entirety, regardless of where the work istaking place. 
C. All employees must follow the privacy regulations of the jurisdictions where the currentscope of their work is established. 
D. Employees who control personal data must complete a rigorous certification procedure,as they are exempt from legal enforcement. 

Answer: B

Show Answer

Question # 4

SCENARIOPlease use the following to answer the next question:T-Craze, a German-headquartered specialty t-shirt company, was successfully selling tolarge German metropolitan cities. However, after a recent merger with another Germanbased company that was selling to a broader European market, T-Craze revamped itsmarketing efforts to sell to a wider audience. These efforts included a complete redesign ofits logo to reflect the recent merger, and improvements to its website meant to capturemore information about visitors through the use of cookies.T-Craze also opened various office locations throughout Europe to help expand itsbusiness. While Germany continued to host T-Craze’s headquarters and main productdesign office, its French affiliate became responsible for all marketing and sales activities.The French affiliate recently procured the services of Right Target, a renowned marketingfirm based in the Philippines, to run its latest marketing campaign. After thorough research,Right Target determined that T-Craze is most successful with customers between the agesof 18 and 22. Thus, its first campaign targeted university students in several Europeancapitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Targetalso ran subsequent campaigns for T- Craze, though with much less success.The last two campaigns included a wider demographic group and resulted in countlessunsubscribe requests, including a large number in Spain. In fact, the Spanish dataprotection authority received a complaint from Sofia, a mid-career investment banker. Sofiawas upset after receiving a marketing communication even after unsubscribing from suchcommunications from the Right Target on behalf of T-Craze.Which of the following is T-Craze’s lead supervisory authority?

A. Germany, because that is where T-Craze is headquartered.  
B. France, because that is where T-Craze conducts processing of personal information.  
C. Spain, because that is T-Craze’s primary market based on its marketing campaigns.  
D. T-Craze may choose its lead supervisory authority where any of its affiliates are based,because it has presence in several European countries.  

Answer: A

Show Answer

Question # 5

In addition to the European Commission, who can adopt standard contractual clauses,assuming that all required conditions are met?

A. Approved data controllers.  
B. The Council of the European Union.  
C. National data protection authorities.  
D. The European Data Protection Supervisor.  

Answer: C

Show Answer

Question # 6

It a company receives an anonymous email demanding ransom for the stolen personaldata of its clients, what must the company do next, per GDPR requirements'3

A. Notify the police and Tile a criminal complaint about the incident  
B. Start an investigation to understand the incident's possible scope, duration and nature  
C. Send a notification to the competent supervisory authority describing the incident.  
D. Send an email about the incident to all clients and ask them to change their passwords  

Answer: C

Show Answer

Question # 7

What is true if an employee makes an access request to his employer for any personaldata held about him?

A. The employer can automatically decline the request if it contains personal data about athird person.
B. The employer can decline the request if the information is only held electronically.  
C. The employer must supply all the information held about the employee.  
D. The employer must supply any information held about an employee unless anexemption applies.  

Answer: D

Show Answer

Question # 8

What type of data lies beyond the scope of the General Data Protection Regulation? 

A. Pseudonymized  
B. Anonymized  
C. Encrypted  
D. Masked  

Answer: B

Show Answer

Question # 9

The EDPB's Guidelines 8/2020 on the targeting of social media users stipulates that inorder to rely on legitimate interest as a legal basis to process personal data, three testsmust be passed. Which of the following is NOT one of the three tests?

A. Purpose test.  
B. Necessity test.  
C. Balancing test.  
D. Adequacy test.  

Answer: D

Show Answer

Question # 10

Which of the following countries will continue to enjoy adequacy status under the GDPR,pending any future European Commission decision to the contrary?

A. Greece  
B. Norway  
C. Australia  
D. Switzerland  

Answer: D

Show Answer

Question # 11

If a data subject puts a complaint before a DPA and receives no information about itsprogress or outcome, how long does the data subject have to wait before taking action inthe courts?

A. 1 month.  
B. 3 months.  
C. 5 months.  
D. 12 months.  

Answer: B

Show Answer

Question # 12

How is the retention of communications traffic data for law enforcement purposesaddressed by European data protection law?

A. The ePrivacy Directive allows individual EU member states to engage in such dataretention. 
B. The ePrivacy Directive harmonizes EU member states’ rules concerning such dataretention. 
C. The Data Retention Directive’s annulment makes such data retention now permissible.  
D. The GDPR allows the retention of such data for the prevention, investigation, detectionor prosecution of criminal offences only. 

Answer: B

Show Answer

Question # 13

What is the primary purpose of Convention 108+, which amends the Convention for theProtection of Individuals with regard to Automatic Processing of Personal Data?

A. To issue updated guidelines for data transfers from the EU to third-country signatories tothe Convention. 
B. To modify the process for third countries to obtain an adequacy decision from theEuropean Commission. 
C. To strengthen data protection in line with the European and international regulatoryframework. 
D. To establish new data subject rights and safeguards for consumers in the EU memberstates.

Answer: C

Show Answer

Question # 14

A news website based m (he United Slates reports primarily on North American events Thewebsite is accessible to any user regardless of location, as the website operator does notblock connections from outside of the U.S. The website offers a pad subscription thatrequires the creation of a user account; this subscription can only be paid in U.S. dollars.Which of the following explains why the website operator, who is the responsible for allprocessing related to account creation and subscriptions, is NOT required to comply withthe GDPR?

A. Payments cannot be made in a European Union currency.  
B. The controller does not have an establishment in the European Union.  
C. The website is not available in several official languages of European Un on Member States 
D. The website cannot block connections from outside the U.S. that use a Virtual PrivateNetwork (VPN) to simulate a US location.

Answer: A

Show Answer

Question # 15

In which case would a controller who has undertaken a DPIA most likely need to consultwith a supervisory authority?

A. Where the DPIA identifies that personal data needs to be transferred to other countriesoutside of the EEA
B. Where the DPIA identifies high risks to individuals’ rights and freedoms that thecontroller can take steps to reduce. 
C. Where the DPIA identifies that the processing being proposed collects the sensitive dataof EU citizens.  
D. Where the DPIA identifies risks that will require insurance for protecting its business interests. 

Answer: B

Show Answer