CIPP-E Free Practice Test

When may browser settings be relied upon for the lawful application of cookies?

1. A. When a user rejects cookies that are strictly necessary.
2. B. When users are aware of the ability to adjust their settings.
3. C. When users are provided with information about which cookies have been set.
4. D. When it is impossible to bypass the choices made by users in their browser settings.

Correct Answer: B

Under the GDPR, where personal data is not obtained directly from the data subject, a controller is exempt from directly providing information about processing to the data subject if?

1. A. The data subject already has information regarding how his data will be used
2. B. The provision of such information to the data subject would be too problematic
3. C. Third-party data would be disclosed by providing such information to the data subject
4. D. The processing of the data subject’s data is protected by appropriate technical measures

Correct Answer: A

SCENARIO
Please use the following to answer the next question:
BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information – name, location, and prior purchase history – with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.
Prior to sharing its customer list, BHealthy conducted a review of Natural Insight’s security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy’s data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight’s machine learning algorithms.
In which case would Natural Insight’s use of BHealthy’s data for improvement of its algorithms be considered data processor activity?

1. A. If Natural Insight uses BHealthy’s data for improving price point predictions only for BHealthy.
2. B. If Natural Insight receives express contractual instructions from BHealthy to use its data for improving its algorithms.
3. C. If Natural Insight agrees to be fully liable for its use of BHealthy’s customer information in its product improvement activities.
4. D. If Natural Insight satisfies the transparency requirement by notifying BHealthy’s customers of its plans to use their information for its product improvement activities.

Correct Answer: A

Which of the following is NOT a role of works councils?

1. A. Determining the monetary fines to be levied against employers for data breach violations of employee data.
2. B. Determining whether to approve or reject certain decisions of the employer that affect employees.
3. C. Determining whether employees’ personal data can be processed or not.
4. D. Determining what changes will affect employee working conditions.

Correct Answer: C

SCENARIO
Please use the following to answer the next question:
T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies.
T-C raze also opened various office locations throughout Europe to help expand its business. While Germany continued to host T-Craze’s headquarters and main product-design office, its French affiliate became responsible for all marketing and sales activities. The French affiliate recently procured the services of Right Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T- Craze, though with much less success.
The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze.
Why does the Spanish supervisory authority notify the French supervisory authority when it opens an investigation into T-Craze based on Sofia’s complaint?

1. A. T-Craze has a French affiliate.
2. B. The French affiliate procured the services of Right Target.
3. C. T-Craze conducts its marketing and sales activities in France.
4. D. The Spanish supervisory authority is providing a courtesy notification not required under the GDPR.

Correct Answer: C