CIPP-E Practice Test

CIPP-E Practice Test practice questions, page 13 of 13, with answer review and explanations.

Question 61

An unforeseen power outage results in company Z’s lack of access to customer data for six hours. According to article 32 of the GDPR, this is considered a breach. Based on the WP 29’s February, 2018 guidance, company Z should do which of the following?

  1. Notify affected individuals that their data was unavailable for a period of time.
  2. Document the loss of availability to demonstrate accountability
  3. Notify the supervisory authority about the loss of availability
  4. Conduct a thorough audit of all security systems

Question 62

In addition to the European Commission, who can adopt standard contractual clauses, assuming that all required conditions are met?

  1. Approved data controllers.
  2. The Council of the European Union.
  3. National data protection authorities.
  4. The European Data Protection Supervisor.

Question 63

SCENARIO - Please use the following to answer the next question: Zandelay Fashion (‘Zandelay’) is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company’s compliance with the General Data Protection Regulation (GDPR) and other privacy legislation. The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers. In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company’s customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme. Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay’s business plan and associated processing activities. What would MOST effectively assist Zandelay in conducting their data protection impact assessment?

  1. Information about DPIAs found in Articles 38 through 40 of the GDPR.
  2. Data breach documentation that data controllers are required to maintain.
  3. Existing DPIA guides published by local supervisory authorities.
  4. Records of processing activities that data controllers are required to maintain.