This page was exported from Exam for engine [ http://blog.test4engine.com ] Export date:Mon Nov 18 2:27:28 2024 / +0000 GMT ___________________________________________________ Title: Get Feb-2023 updated Exam CIPP-E Dumps with New Questions [Q51-Q75] --------------------------------------------------- Get Feb-2023 updated Exam CIPP-E Dumps with New Questions 100% Pass Guarantee for CIPP-E Exam Dumps with Actual Exam Questions What are the Problems of IAPP CIPP/E Exam Candidates face many problems when they start preparing for the IAPP CIPP/E Exam. If a candidate wants to prepare his for the IAPP CIPP/E Exam without any problem and get good grades in the exam. Then they have to choose the best IAPP CIPP/E Exam exam dumps for real exam questions practice. There are many websites that are offering the latest IAPP CIPP/E Exam questions and answers but these questions are not verified by IAPP certified experts and that's why many are failed in their just first attempt. Test4Engine is the best platform which provides the candidate with the necessary IAPP 63 questions that will help him to pass the IAPP CIPP/E Exam on the first time. The candidate will not have to take the IAPP CIPP/E Exam twice because with the help of IAPP CIPP/E Exam exam dumps the Candidate will have every valuable material required to pass the IAPP CIPP/E Exam. We are providing the latest and actual questions and that is the reason why this is the one that he needs to use and there are no chances to fail when a candidate will have valid braindumps from Test4Engine. We have the guarantee that the questions that we have will be the ones that will pass candidate in the IAPP CIPP/E Exam in the very first attempt.   NEW QUESTION 51SCENARIOPlease use the following to answer the next Question:Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a few months ago. Although no one was hurt, Louis has been plagued by texts and calls from a company called Accidentable offering to help him recover compensation for personal injury. Louis has heard about insurance companies selling customers’ data to third parties, and he’s convinced that Accidentable must have gotten his information from Bedrock Insurance.Louis has also been receiving an increased amount of marketing information from Bedrock, trying to sell him their full range of their insurance policies.Perturbed by this, Louis has started looking at price comparison sites on the internet and has been shocked to find that other insurers offer much cheaper rates than Bedrock, even though he has been a loyal customer for many years. When his Bedrock policy comes up for renewal, he decides to switch to Zantrum Insurance.In order to activate his new insurance policy, Louis needs to supply Zantrum with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask Bedrock to transfer his information directly to Zantrum. He also takes this opportunity to ask Bedrock to stop using his personal data for marketing purposes.Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Louis it cannot transfer his data directly to Zantrum as this is not technically feasible. Bedrock also explains that Louis’s contract included a provision whereby Louis agreed that his data could be used for marketing purposes; according to Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which was filled with legal jargon and very confusing.In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He writes to Accidentable to ask for the name of the organization that supplied his details to them. He warns Accidentable that he plans to complain to the data protection authority, because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.Accidentable’s response letter confirms Louis’s suspicions. Accidentable is Bedrock Insurance’s wholly owned subsidiary, and they received information about Louis’s accident from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis that there has been no breach of the GDPR, as Louis’s contract included, a provision in which he agreed to share his information with Bedrock’s affiliates for business purposes.Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them insisting that all his information be erased from their computer system.Based on the GDPR’s position on the use of personal data for direct marketing purposes, which of the following is true about Louis’s rights as a data subject?  Louis does not have the right to object to the use of his data because he previously consented to it.  Louis has the right to object at any time to the use of his data and Bedrock must honor his request to cease use.  Louis has the right to object to the use of his data, unless his data is required by Bedrock for the purpose of exercising a legal claim.  Louis does not have the right to object to the use of his data if Bedrock can demonstrate compelling legitimate grounds for the processing. NEW QUESTION 52A Spanish electricity customer calls her local supplier with questions about the company’s upcoming merger.Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?  Verify that the request is applicable to the data collected before the GDPR entered into force.  Verify that the purpose of the request from the customer is in line with the GDPR.  Verify that the personal data has not already been sent to the customer.  Verify that the identity of the customer can be proven by other means. Explanation/Reference: https://fpf.org/wp-content/uploads/2018/11/GDPR_CCPA_Comparison-Guide.pdfNEW QUESTION 53Why is advisable to avoid consent as a legal basis for an employer to process employee data?  Employee data can only be processed if there is an approval from the data protection officer.  Consent may not be valid if the employee feels compelled to provide it.  An employer might have difficulty obtaining consent from every employee.  Data protection laws do not apply to processing of employee data. NEW QUESTION 54SCENARIOPlease use the following to answer the next question:Javier is a member of the fitness club EVERFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Javier lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Javier was photographed while working out at a branch of EVERFIT in Frankfurt, Germany. At the time, Javier gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club’s U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Javier no longer feels comfortable with his photograph being publicly associated with the fitness club.After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Javier sends a letter to EVETFIT requesting that his image be removed from the website and all promotional materials. Months pass and Javier, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact EVETFIT through alternate channels, he decides to take action against the company.Javier contacts the U.K. Information Commissioner’s Office (‘ICO’ – the U.K.’s supervisory authority) to lodge a complaint about this matter. The ICO, pursuant to Article 56 (3) of the GDPR, informs the CNIL (i.e. the supervisory authority of EVERFIT’s main establishment) about this matter. Despite the fact that EVERFIT has an establishment in the U.K., the CNIL decides to handle the case in accordance with Article 60 of the GDPR. The CNIL liaises with the ICO, as relevant under the cooperation procedure. In light of issues amongst the supervisory authorities to reach a decision, the European Data Protection Board becomes involved and, pursuant to the consistency mechanism, issues a binding decision.Additionally, Javier sues EVERFIT for the damages caused as a result of its failure to honor his request to have his photograph removed from the brochure and website.Assuming that multiple EVETFIT branches across several EU countries are acting as separate data controllers, and that each of those branches were responsible for mishandling Javier’s request, how may Javier proceed in order to seek compensation?  He will have to sue the EVETFIT’s head office in France, where EVETFIT has its main establishment.  He will be able to sue any one of the relevant EVETFIT branches, as each one may be held liable for the entire damage.  He will have to sue each EVETFIT branch so that each branch provides proportionate compensation commensurate with its contribution to the damage or distress suffered by Javier.  He will be able to apply to the European Data Protection Board in order to determine which particular EVETFIT branch is liable for damages, based on the decision that was made by the board. NEW QUESTION 55SCENARIOPlease use the following to answer the next question:Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a few months ago. Although no one was hurt, Louis has been plagued by texts and calls from a company called Accidentable offering to help him recover compensation for personal injury. Louis has heard about insurance companies selling customers’ data to third parties, and he’s convinced that Accidentable must have gotten his information from Bedrock Insurance.Louis has also been receiving an increased amount of marketing information from Bedrock, trying to sell him their full range of their insurance policies.Perturbed by this, Louis has started looking at price comparison sites on the internet and has been shocked to find that other insurers offer much cheaper rates than Bedrock, even though he has been a loyal customer for many years. When his Bedrock policy comes up for renewal, he decides to switch to Zantrum Insurance.In order to activate his new insurance policy, Louis needs to supply Zantrum with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask Bedrock to transfer his information directly to Zantrum. He also takes this opportunity to ask Bedrock to stop using his personal data for marketing purposes.Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Louis it cannot transfer his data directly to Zantrum as this is not technically feasible. Bedrock also explains that Louis’s contract included a provision whereby Louis agreed that his data could be used for marketing purposes; according to Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which was filled with legal jargon and very confusing.In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He writes to Accidentable to ask for the name of the organization that supplied his details to them. He warns Accidentable that he plans to complain to the data protection authority, because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.Accidentable’s response letter confirms Louis’s suspicions. Accidentable is Bedrock Insurance’s wholly owned subsidiary, and they received information about Louis’s accident from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis that there has been no breach of the GDPR, as Louis’s contract included, a provision in which he agreed to share his information with Bedrock’s affiliates for business purposes.Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them insisting that all his information be erased from their computer system.Which statement accurately summarizes Bedrock’s obligation in regard to Louis’s data portability request?  Bedrock does not have a duty to transfer Louis’s data to Zantrum if doing so is legitimately not technically feasible.  Bedrock does not have to transfer Louis’s data to Zantrum because the right to data portability does not apply where personal data are processed in order to carry out tasks in the public interest.  Bedrock has failed to comply with the duty to transfer Louis’s data to Zantrum because the duty applies wherever personal data are processed by automated means and necessary for the performance of a contract with the customer.  Bedrock has failed to comply with the duty to transfer Louis’s data to Zantrum because it has an obligation to develop commonly used, machine-readable and interoperable formats so that all customer data can be ported to other insurers on request. NEW QUESTION 56SCENARIOPlease use the following to answer the next question:Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA analysis. The company is headquartered in Montreal, and all of its employees are located there. The company offers its services to Canadians only: Its website is in English and French, it accepts only Canadian currency, and it blocks internet traffic from outside of Canada (although this solution doesn’t prevent all non-Canadian traffic). It also declines to process orders that request the DNA report to be sent outside of Canada, and returns orders that show a non-Canadian return address.Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU, and the company is exploring a number of plans to expand its customer base.The first plan, collegially called We-Track-U, will use an app to collect information about its current Canadian customer base. The expansion will allow its Canadian customers to use the app while traveling abroad. He suggests that the company use this app to gather location information. If the plan shows promise, Bob proposes to use push notifications and text messages to encourage existing customers to pre-register for an EU version of the service. Bob calls this work plan, We-Text-U. Once the company has gathered enough pre- registrations, it will develop EU-specific content and services.Another plan is called Customer for Life. The idea is to offer additional services through the company’s app, like storage and sharing of DNA information with other applications and medical providers. The company’s contract says that it can keep customer DNA indefinitely, and use it to offer new services and market them to customers. It also says that customers agree not to withdraw direct marketing consent. Paul, the marketing director, suggests that the company should fully exploit these provisions, and that it can work around customers’ attempts to withdraw consent because the contract invalidates them.The final plan is to develop a brand presence in the EU. The company has already begun this process. It is in the process of purchasing the naming rights for a building in Germany, which would come with a few offices that Who-R-U executives can use while traveling internationally. The office doesn’t include any technology or infrastructure; rather, it’s simply a room with a desk and some chairs.On a recent trip concerning the naming-rights deal, Bob’s laptop is stolen. The laptop held unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of Canad a. The reports include customer name, birthdate, ethnicity, racial background, names of relatives, gender, and occasionally health information.The Customer for Life plan may conflict with which GDPR provision?  Article 6, which requires processing to be lawful.  Article 7, which requires consent to be as easy to withdraw as it is to give.  Article 16, which provides data subjects with a rights to rectification.  Article 20, which gives data subjects a right to data portability. NEW QUESTION 57In which scenario is a Controller most likely required to undertake a Data Protection Impact Assessment?  When the controller is collecting email addresses from individuals via an online registration form for marketing purposes.  When personal data is being collected and combined with other personal data to profile the creditworthiness of individuals.  When the controller is required to have a Data Protection Officer.  When personal data is being transferred outside of the EEA. Reference:%20the%20General,and%20freedoms%20of%20natural%20persons%27.NEW QUESTION 58What permissions are required for a marketer to send an email marketing message to a consumer in the EU?  A prior opt-in consent for consumers unless they are already customers.  A pre-checked box stating that the consumer agrees to receive email marketing.  A notice that the consumer’s email address will be used for marketing purposes.  No prior permission required, but an opt-out requirement on all emails sent to consumers. NEW QUESTION 59Under which of the following conditions does the General Data Protection Regulation NOT apply to the processing of personal data?  When the personal data is processed only in non-electronic form  When the personal data is collected and then pseudonymised by the controller  When the personal data is held by the controller but not processed for further purposes  When the personal data is processed by an individual only for their household activities Explanation/Reference: https://gdpr-info.eu/art-6-gdpr/NEW QUESTION 60Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC). Why is the Directive no longer part of EU law?  The Directive was superseded by the EU Directive on Privacy and Electronic Communications.  The Directive was superseded by the General Data Protection Regulation.  The Directive was annulled by the Court of Justice of the European Union.  The Directive was annulled by the European Court of Human Rights. NEW QUESTION 61What ruling did the Planet 49 CJEU judgment make regarding the issue of pre-ticked boxes?  They are allowed if determined to be technically necessary.  They do not amount to valid consent under any circumstances.  They are allowed if recorded In the register of processing activities.  They constitute valid consent if the processing is necessary for purposes of legitimate interest NEW QUESTION 62Higher fines are assessed for GDPR violations due to which of the following?  Failure to notify a supervisory authority and data subjects of a personal data breach  Violations of a data controller’s obligations to obtain a child’s consent  Failure to appoint a data protection officer.  Violations of a data subject”s rights NEW QUESTION 63According to the GDPR, what is the main task of a Data Protection Officer (DPO)?  To create and maintain records of processing activities.  To conduct Privacy Impact Assessments on behalf of the controller or processor.  To monitor compliance with other local or European data protection provisions.  To create procedures for notification of personal data breaches to competent supervisory authorities. Reference https://digitalguardian.com/blog/what-data-protection-officer-dpo-learn-about-new-role-required- gdpr-complianceNEW QUESTION 64What is true of both the General Data Protection Regulation (GDPR) and the Council of Europe Convention108?  Both govern international transfers of personal data  Both govern the manual processing of personal data  Both only apply to European Union countries  Both require notification of processing activities to a supervisory authority Explanation/Reference: https://rm.coe.int/090000168093b851NEW QUESTION 65If two controllers act as joint controllers pursuant to Article 26 of the GDPR, which of the following may NOT be validly determined by said controllers?  The definition of a central contact point for data subjects.  The rules regarding the exercising of data subjects” rights.  The rules to provide information to data subjects in Articles 13 and 14.  The non-disclosure of the essence of their arrangement to data subjects NEW QUESTION 66SCENARIOPlease use the following to answer the next question:Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy company operating in every continent. All of the company’s IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father’s company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company’s online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers’ philosophical beliefs, political opinions and marital status.If a customer identifies as single, Ben then copies all of that customer’s personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.Joe also hires his best friend’s daughter, Alice, who just graduated from law school in the U.S., to be the company’s new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company’s operations in the European Union to the U.S.Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company’s IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone’s information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.In preparing the company for its impending lawsuit, Alice’s instruction to the company’s IT Department violated Article 5 of the GDPR because the company failed to first do what?  Send out consent forms to all of its employees.  Minimize the amount of data collected for the lawsuit.  Inform all of its employees about the lawsuit.  Encrypt the data from all of its employees. NEW QUESTION 67Many businesses print their employees’ photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?  Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption.  Because photographs qualify as biometric data only when they undergo a “specific technical processing”.  Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer.  Because photographic ID is a physical security measure which is “necessary for reasons of substantial public interest”. Reference https://ess.csa.canon.com/rs/206-CLL-191/images/IAPP-Top-10-Operational-Impacts-of- GDPR.pdf?TC=DM&CN=CSA_OMNIA_Partners&CS=CSA&CR=T1_Gov%20GenNonProfit (11)NEW QUESTION 68According to the GDPR, when should the processing of photographs be considered processing of special categories of personal data?  When processed with the intent to publish information regarding a natural person on publicly accessible media.  When processed with the intent to proceed to scientific or historical research projects.  When processed with the intent to uniquely identify or authenticate a natural person.  When processed with the intent to comply with a law. NEW QUESTION 69SCENARIOPlease use the following to answer the next question:Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:* Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.* Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).* Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees.These records are available to former students after registering through Granchester’s Alumni portal.* Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.* Under their security policy, the University encrypts all of its personal data records in transit and at rest.In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna’s data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level.Mindful of Anna’s training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.One of Anna’s tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.Before Anna determines whether Frank’s performance database is permissible, what additional information does she need?  More information about Frank’s data protection training.  More information about the extent of the information loss.  More information about the algorithm Frank used to mask student numbers.  More information about what students have been told and how the research will be used. NEW QUESTION 70SCENARIOPlease use the following to answer the next question:Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy company operating in every continent. All of the company’s IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father’s company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company’s online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers’ philosophical beliefs, political opinions and marital status.If a customer identifies as single, Ben then copies all of that customer’s personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.Joe also hires his best friend’s daughter, Alice, who just graduated from law school in the U.S., to be the company’s new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company’s operations in the European Union to the U.S.Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company’s IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone’s information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.The data transfer mechanism that Alice drafted violates the GDPR because the company did not first get approval from?  The Court of Justice of the European Union.  The European Data Protection Board.  The Data Protection Authority.  The European Commission. NEW QUESTION 71Which of the following does NOT have to be included in the records most processors must maintain in relation to their data processing activities?  Name and contact details of each controller on behalf of which the processor is acting.  Categories of processing carried out on behalf of each controller for which the processor is acting.  Details of transfers of personal data to a third country carried out on behalf of each controller for which the processor is acting.  Details of any data protection impact assessment conducted in relation to any processing activities carried out by the processor on behalf of each controller for which the processor is acting. Reference https://gdpr-info.eu/art-30-gdpr/NEW QUESTION 72  She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn’t sure whether or not this is required.Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn’t have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B’s live systems in order to create a new database for Company  This database will be stored in a test environment hosted on Company C’s U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.Unfortunately, Company C’s U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A’s employees is visible to anyone visiting Company C’s website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees.The GDPR requires sufficient guarantees of a company’s ability to implement adequate technical and organizational measures. What would be the most realistic way that Company B could have fulfilled this requirement?  Hiring companies whose measures are consistent with recommendations of accrediting bodies.  Requesting advice and technical support from Company A’s IT team.  Avoiding the use of another company’s data to improve their own services.  Vetting companies’ measures with the appropriate supervisory authority. Explanation/Reference: https://www.knowyourcompliance.com/gdpr-technical-organisational-measures/NEW QUESTION 73To receive a preliminary interpretation on provisions of the GDPR, a national court will refer its case to which of the following?  The Court of Justice of the European Union.  The European Data Protection Supervisor.  The European Court of Human Rights.  The European Data Protection Board. Reference https://www.privacy-regulation.eu/en/recital-143-GDPR.htmNEW QUESTION 74A homeowner has installed a motion-detecting surveillance system that films his front doc and entryway. The camera does not film any public areas only areas that are the property of the homeowner. The system has seen declared to the authorities per the homeowner’s country law, and a placard indicating the area is being video monitored is visible when entering the property Why can the homeowner NOT depend on the household exemption with regards to the processing of the video images recorded by the surveillance camera system?  The surveillance camera system can potentially capture biometric information of the homeowner’s family, which would be considered a processing of special categories of personal data.  The homeowner has not specified which security measures ore in place as part of the surveillance camera system  The GDPR specifically excludes surveillance camera images from the household exemption  The surveillance camera system can potentially film individuals who enter its filming perimeter NEW QUESTION 75According to the GDPR, what is the main task of a Data Protection Officer (DPO)?  To create and maintain records of processing activities.  To conduct Privacy Impact Assessments on behalf of the controller or processor.  To monitor compliance with other local or European data protection provisions.  To create procedures for notification of personal data breaches to competent supervisory authorities.  Loading … CIPP-E exam dumps with real IAPP questions and answers: https://www.test4engine.com/CIPP-E_exam-latest-braindumps.html --------------------------------------------------- Images: https://blog.test4engine.com/wp-content/plugins/watu/loading.gif https://blog.test4engine.com/wp-content/plugins/watu/loading.gif --------------------------------------------------- --------------------------------------------------- Post date: 2023-02-01 09:06:09 Post date GMT: 2023-02-01 09:06:09 Post modified date: 2023-02-01 09:06:09 Post modified date GMT: 2023-02-01 09:06:09