stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
CIPP/E 2022 Exam Flashcards | StudBud
Explore
/
CIPP/E 2022 Exam
CIPP/E 2022 Exam
100 terms
·
StudBud Administration
·
19 plays
Imported from external platform
Flashcards
100 cards
F
Practice quiz
P
Host live
L
Questions
100
Answers
1
What period of time should data subjects be informed when data is collected from them indirectly?
Reasonable period of time not greater than one month
48 hours
Reasonable period of time less than two weeks
2
Why would BCRs not allow transfer of employee names to phone providers in the same country to provide them with services
BCRs only provide adequate safeguards for orgs that move data outside.
BCRs secure transfers to 3d parties without needing to fulfill addtl reqmts
BCRs only deal with intraorganizational transfers not transfers to 3d party
BCRs require contractual arrangements to legitimize intl transfers of data
3
What information must data subjects be provided when personal data that will be processed was indirectly collected?
purposes
Time of collection
Source of data
4
What are some solutions to lengthy privacy notices?
adding graphics
layered notices; "just-in-time" notices; standardized icons
layered notices; using graphics; skipping them
5
What are the main values of a Data Protection Impact Assessment?
Incorporate data protection considerations into organizational planning
Demonstrating compliance to supervisory authorities
Demonstrate compliance to SVAs & incorporate data protection into planning
Assess the impact of a personal data breach
6
Which exemption to the e-Privacy Directive allows the data controller to send electronic marketing information?
Data subject and controller work in the same industry
Controller is a nonprofit organization
Recipients are existing customers
Recipient's email address is taken from the public register
7
Which institution is responsible for ensuring that directives are implemented properly by the member states?
European Commission
European Data Protection Supervisor
European Parliament
European Court of Justice
8
Which institution has the power to adopt adequacy findings for the European Union?
European Commission
European data protection supervisor
Working party 29
European court of justice
9
What is the main duty/characteristic of the Council of the EU?
Enforce the GDPR
Draft EU legislation
One of the main decision-making bodies of the EU
10
What is data processing?
Any action performed on data
Any specific manual change to data
when data has time to think
Any action
11
What info must be provided when data subjects' personal data is shared w/an outside org to provide a promised service?
Nature of processing
Source of data
Recipients of the data
12
What are the Article 9 special categories of data under the GDPR?
race/ethnic background; political opinions; religious/philosophy views
All of these
trade union membership; genetic data; health, sex life, sexual orientation
biometric data used to identify
13
Information provision is required even if a necessitates disproportionate effort.
False
True
14
Under what condition is processing sensitive employee data acceptable?
Necessary for C to carry out obligation in the field of employment law
Necessary for the interest of the controller and the employee
Necessary for the interest pursued by the controller
Necessary to improve the quality of the employer employee relationship
15
What are the data protection considerations associated with collecting personal data via CCTV?
info provision; indvd rights; lawfulness; prior checks; DPIA; proportional
Information provision and individual rights
Lawfulness, proportionality and prior checking
DPIA
16
What must be in a data processor contract?
subject matter and duration of processing and categories of data subjects
Rights and obligations of the controller
subject/duration; data subject cats; datatypes; nature/purpose; C rights
Types of personal data and nature and purpose of the processing
17
To which categories may a data subject object to processing?
Research/statistical purposes; direct marketing; public/legitimate interest
Statistical purposes; analytics; direct marketing
Direct marketing; telemarketing; crash marketing
18
What is most accurate concerning obligations imposed by the GDPR regarding notification of data processing activities?
No longer required as the GDPR has switched to an accountability framework
Required of all processors but is not required of controllers
Optional but recommended to foster transparency
Mandatory to finance the National Data protection authorities operations
19
Do DPOs have to be experts in data protection laws and practices?
No
Not an expert but knowledgeable
Yes
20
What are the exceptions to the personal data breach notification requirement for data subjects?
individual notice requires disproportionate effect
post breach actions greatly reduced the risk on rights & freedoms of subjec
All of these
prior implementation that made data unintelligible or encrypted
21
Are criteria for derogations broad or strictly / narrowly interpreted?
Broad
Both
Strict/Narrowly
22
What information must be provided to data subjects in all circumstances?
purpose of processing; identity of data processor; data subjects rights
identity of data processor; data subjects rights
purpose of processing; identity of data controller; data subjects' rights
23
Which is an example of cloud computing?
A web-based email platform
A software package installed on a laptop
Single web server
A portable mass storage device
24
Through what means of communications does the e-Privacy Directive govern the processing of data?
public carriers and private carriers
communication networks
electronic and public carriers
public carriers and communication networks
25
Which coop mechanism starts collaborative process w/ the Comm., EDPB and SVAs for ensuring consistent GDPR application?
Application Mechanism
Cooperative Assistance
Consistency Mechanism
26
Can employers be made to consult work councils/trade unions to process employees' personal data?
Nope
Yes
Only under specific circumstances
27
Which three types of law should be considered when processing employees' personal data?
local employment law + EU data protection law + member state data pro law
local employment law
local employment law + GDPR
EU data protection law + member state data protection law
28
According to the GDPR, the right to data portability applies when?
Processing was done through manual means
Processing was originally based on the user's consent
Processing was based on a public interest
Processing was based on the controller's legitimate interests
29
What US Act requires companies to have a system in place to receive anonymous complaints about potential wrongdoing?
Sarbanes-Oxley Act
Convention 108
Freedom of Information Act
30
What are the 3 processing criteria used to determine territorial scope/application of the GDPR?
Non-EU but EU law applies by public international law; EU data; EU business
EU data subjects for goods/services or monitoring behavior; EU business
C = in EU; EU data subjects for goods/services/monitoring; EU law = public
Controller is in the EU; EU data subjects; EU is ruling class of people
31
Article 32 requires "the controller and processor shall implement ____"
Data protection considerations
Appropriate technical and organizational measures
Appropriate protection
32
Which of these is not a special category of data?
Ethnic origin
Health information
Social security number
Political affiliation
33
When does a data protection policy need to be used?
When proportionate in relation to processing activities
Whenever there's no DPIA
When the SVA requires
34
If a third country C or P does not want to comply with the SVA decision, then the SVA has the power to:
Force the C or P to relocate to the EU
Waive its decision because powers are limited to the EU
Order the suspension of data flows to a recipient in the third country
Carry out its actions outside the EU without consent of the target country
35
Which data subject right provides entitlements to certain information, obtainable from the controller upon request?
Right of Access
Erasure
Right to knowledge
36
Under the GDPR individuals can absolutely object to any form of direct marketing at any time.
False
True
37
What should a company do before responding to an employee's personal information request?
Wait for advice from the Irish DPA before sending any information
Consult with a security lawyer to determine most secure way to fulfill
Meet with legal to ensure no data protection laws are being violated
Accounting for GDPR compliance, contact employee without undue delay
38
A controller may charge an administrative fee to data subjects that request their information be provided orally.
True
False
39
What are the 3 duties/characteristics of the European Parliament?
main: supervisory oversight of other institutions (make laws)
main: legislative development (supervisory oversight + budget development)
main: budget development
40
What data protection milestone applies to public electronics communication services and networks?
Convention 108
e-Privacy Directive (EU Directive on Privacy and Electronic Communications)
41
The right to be forgotten is?
Right to Erasure
Right to Access
Right to Information
Right to Denial
42
In what amount of time must a company respond to a data subjects request for information?
Within 6 months of having received the request
Without undue delay or within a month of receiving the request
3 months after they are authenticate the identity of the requester
Within a month of having received the request
43
If an employee requests all emails about him from his prior job, what next steps should that employer take?
HR should ask employees who still work at the employer if they have emails
Provide the employee the information, there is no need for consent for work
Nothing, email need not be provided in response to a subject access request
Conduct email search in accordance with policy & inform affected employees
44
Who may be a controller involved in online behavioral advertising?
ad network and advertiser
ad network; website publisher; advertiser
website publisher and advertiser
45
Exclusions to the material scope of the GDPR are narrowly interpreted.
True
False
46
Along with legitimacy, what is another condition that must be met when carrying out employee monitoring?
Must be in the public interest at the time of collection
Must be done during agreed upon time constraints
Must be performed under an employment contract
Must be limited to what is necessary for the purposes
47
What appropriate safeguards allow MLN companies to adopt policy suites with rules for handling personal data?
Binding Corporate Rules
Multinational Rules
Adequacy Decisions
48
What data protection milestone is a treaty among member states of the Council of Europe?
Treaty of Europe Union
Convention 108
e-Privacy Directive
49
Pseudonymous data is governed by the GDPR.
True
False
50
Which layer of a layered notice contains the full privacy notice?
2nd/middle
Any layer
3rd/bottom
1st/top
51
Who has accountability obligations under the GDPR?
Controllers and Processors
Controllers
Companies
Processors
52
The cutting-edge technology is always the best choice for security and is what is meant by state-of-the-art.
True
False
53
Which cooperation mechanism facilitates the provision of relevant information between supervisory authorities?
transferred mechanism
mutual assistance
DPOs
54
Are BYOD policies designed to only protect employees' personal data?
Kinda
No
Yes
55
When should a Controller notify an SVA of a loss of personal information likely to result in harm to an individual?
No later than 5 calendar days after the incident is identified
Within 72 hours after the controller becomes aware
Without unreasonable delay but no later than 30 days
Notification to the supervisory authority isn't required
56
Which of the following statements is correct with regard to Big Data?
Subject to the proportionality principle of the GDPR
Subject to Case by case review under the GDPR
Permitted to retain all data collected prior to the GDPR
Exempt from the proportionality principle of the GDPR
57
Should alternatives to employee monitoring be considered first?
Sometimes
Yes
Nope
58
According to the GDPR, when does an org need to take action to legitimize cross-border data transfers of personal data?
Transferred from outside the EU to the EU
Transferred from EU to a third country that's not adequate
Transferred from EU to EU
Routed through another jurisdiction, whether or not in the EU
59
3 types of information granted to data subjects through the Right of Access are?
categories of data; length of encryption code; location of data
purpose of processing; recipients of data; retention periods
copy of data; erasure of data; information about data
60
Under the GDPR, which legal basis for processing personal data would be difficult to use for processing employee data?
Contract, it's hard to prove with power inequality.
Individual rights and freedoms
Consent, it's hard to prove with power inequality
61
What is profiling?
Automated processing for evaluating, analyzing, predicting personal aspects
Judging based on data subject's appearance
Automated processing to provide a service
62
Which lawful processing criteria is commonly used when a customer purchases a good/service?
Consent
Contract
Necessity
63
What types of electronic communication based data does the e-Privacy Directive govern?
traffic data; location data; content data
traffic data; IP identifiers; content data
location data; traffic data
64
What are the 2 processing criteria used to determine material scope of the GDPR?
human interaction; robotic assistance
forming a filing system; human interaction
no human interaction in whole or in part; forming a filing system
65
Who created the Universal Declaration of Human Rights?
Council of Europe
European Union
United Nations
66
Which intl data transfer option is a determination by the Commission that a country has achieved EU level data protectio
Adequacy Decision
Appropriate Safeguards
Derogations and Restrictions
67
Privacy notices should use visuals as appropriate.
False
True
68
Information must fill what 3 requirements when provided to data subjects about the processing of their personal data?
intelligible/accessible form; clear & plain language; concise communication
visually appealing; intelligible/accessible form; clear communication
concise communication; plain language; visually appealing
69
What is the 4 Step Test?
1) any info 2) tied to 3) any person 4) for anything
1) any info, 2) relating to, 3) an identified or identifiable, 4) person
The way to make a DPIA
70
Both data processors and data controllers can be a natural person.
True
False
71
What is the main duty/characteristic of the European Commission?
To set the budgetary goals
To enforce legislation
To set political agenda
Sole power to propose legislation
72
Under what circumstances must a Controller notify the supervisory authority of a personal data breach?
Breach is likely to result in a risk to the rights and freedoms of persons
Breach is of a certain scale
Within 24 hours
Within 48 hours
73
Under the GDPR, privacy notices relating to Services intended for children must be:
Be in accessible form in a language the child can understand
Concise legal language for a subject matter expert or legal professional
Be in an accessible form for adults to understand and explain to child
Same format as privacy notices for adults as children are not separated
74
The GDPR requires Controllees to always contact the SVA following a DPIA and before processing personal data.
True
False
75
How can social network service providers be open and transparent ahou the processing of personal data?
Providing notice to individuals about the processing of their personal data
Getting consent in writing of individuals
Providing money to data subjects for the processing of their personal data
76
What information must be provided to data subjects when their personal data will be stored in a database in the US?
the intention to transfer data internationally
The location of the storage
the email address of the storing facility
77
What does "data protection by design" entail?
Begins after processing and incorporates data protection considerations
Begins prior to processing incorporating data protection in planning
Begins after processing incorporating data protection in product or service
78
Under the GDPR, would a European company be allowed to use video surveillance to monitor employee access to inventory?
Yes, provided that the company complies with specific conditions
Yes, without any further conditions to be taken into account
No, video surveillance is never allowed under the GDPR
No, video surveillance is too intrusive a solution for inventory access
79
What does CIAR stand for?
C-onfidentiality I-ntegrity A-vailability R-esilience
C-onfidentiality I-ntegrity A-vailability R-espect
C-onfusion I-ntegrity A-pologize R-espect
80
What forms of marketing are subject to the e-Privacy Directive?
direct marketing
telemarketing
telephone marketing and email marketing
email marketing
81
Article 32 says must take into account "__ w/costs of implementation & nature, scope, context, purpose of processing."
State of the art
State of world affairs
State of businesses
82
What is the function of the 4 Step Test?
Determine the processor's rights and obligations
Determine who to notify after breach
Determine if data is personal data
Determine who's the data controller
83
What circumstances require an organization to appoint a DPO?
core activities of the c/p incl reg & systematic large scale monitoring
controller is a public authority
C = public authority / 2 core activities of the controller and/or processor
core activities of the c/p large scale processing of special data cats
84
What are the options in order for international data transfers?
1. Derogations & restriction 2. Appropriate Safeguards 3. Adequacy Decision
1. Adequacy Decision 2. Appropriate Safeguards 3. Derogations & restriction
1. Adequacy Decision 2. Derogation & Restriction 3. Appropriate Safeguards
1. Appropriate Safeguards 2. Adequacy Decision 3. Derogation & Restriction
85
What must be included in controller's personal data processing records but not in the processor's records?
Purposes of processing
Criteria for processing
Recipients of the data
86
What information must be provided to data subjects when C's necessity is being used as the legal basis for processing?
Controller's address
Controller's legitimate interests
Controller's rights and obligations
87
What's the main duty/characteristic of the European Council?
Set overall political agenda of the EU
Pass EU legislation
Set budget for EU
88
Who does the GDPR task with promoting, monitoring and enforcing the GDPR?
DPOs
EU Council
EU Parliament
Supervisory Authorities
89
A Processor is responsible for keeping appropriate technical and organizational measures to keep personal data secure.
True
False
90
Which is not one of the considerations to determine appropriate technical and organizational measures for data security?
State of the art
Scope of processing
Cost of implementation
Size of the organization
91
What European Institution is composed of 47 member states?
EU
European Council
Council of Europe
92
What are the GDPR methods of restricting processing of personal data?
using data under narrower conditions only
noting the restriction in the system only
Making the data temporarily unavailable only
note in system; make unavailable; move to separate system; narrow condition
93
How many of the 6 lawful processing criteria must be met under the GDPR?
2
1
6
3
94
How many active participants does the European Data Protection Board (EDPB) have?
27
22
21
47
95
Which is NOT a compatible purpose for processing data beyond the original purpose disclosed at collection?
Statistical purposes
Performance of a contract
Historical or scientific research
Transferring data to an archive
96
What is true for a contract based on European Commission Standard Contractual Clauses with a processor outside the EEA?
Data subject must consent to processing by a P located outside of the EEA
For subcontracting, the P must inform the C and obtain written approval
Before processing, P must obtain permission from the European Commission
P must provide a compliance statement from its data protection authority
97
Which is an example of direct marketing?
Email sent about an order placed for a book
Letter addressed to the household about a charity bookstore
Ad on a website promoting a new book on sale
Email sent promoting a new book on sale
98
Anonymous data is governed by the GDPR.
True
False
99
A Processor can process personal data without documented instructions from the controller.
True
False
100
Organizations that are not established in the EU that monitor behavior will be subject to the GDPR when?
Individual being monitored as a citizen of the EU
Behavior being monitored occurs within the EU
Monitoring equipment is located in the EU
Individual being monitored is an EU citizen visiting the US
