CIPP-E Free Practice Test

Under the Data Protection Law Enforcement Directive of the EU, a government can carry out covert investigations involving personal data, as long it is set forth by law and constitutes a measure that is both necessary and what?

1. A. Prudent.
2. B. Important.
3. C. Proportionate.
4. D. DPA-approved.

Correct Answer: C

Which sentence BEST summarizes the concepts of “fairness,” “lawfulness” and “transparency”, as expressly required by Article 5 of the GDPR?

1. A. Fairness and transparency refer to the communication of key information before collecting data; lawfulness refers to compliance with government regulations.
2. B. Fairness refers to limiting the amount of data collected from individuals; lawfulness refers to the approval of company guidelines by the state; transparency solely relates to communication of key information before collecting data.
3. C. Fairness refers to the security of personal data; lawfulness and transparency refers to the analysis of ordinances to ensure they are uniformly enforced.
4. D. Fairness refers to the collection of data from diverse subjects; lawfulness refers to the need for legal rules to be uniform; transparency refers to giving individuals access to their data.

Correct Answer: A

Which of the following Convention 108+ principles, as amended in 2018, is NOT consistent with a principle found in the GDPR?

1. A. The obligation of companies to declare data breaches.
2. B. The requirement to demonstrate compliance to a supervisory authority.
3. C. The necessity of the bulk collection of personal data by the government.

Correct Answer: B

Assuming that the “without undue delay” provision is followed, what is the time limit for complying with a data access request?

1. A. Within 40 days of receipt
2. B. Within 40 days of receipt, which may be extended by up to 40 additional days
3. C. Within one month of receipt, which may be extended by up to an additional month
4. D. Within one month of receipt, which may be extended by an additional two months

Correct Answer: C

An employee of company ABCD has just noticed a memory stick containing records of client data, including their names, addresses and full contact details has disappeared. The data on the stick is unencrypted and in clear text. It is uncertain what has happened to the stick at this stage, but it likely was lost during the travel of an employee. What should the company do?

1. A. Notify as soon as possible the data protection supervisory authority that a data breach may have taken place.
2. B. Launch an investigation and if nothing is found within one month, notify the data protection supervisory authority.
3. C. Invoke the “disproportionate effort” exception under Article 33 to postpone notifying data subjects until more information can be gathered.
4. D. Immediately notify all the customers of the company that their information has been accessed by an unauthorized person.

Correct Answer: A