CIPP-E Practice Questions

According to the EDPB Guidelines 05/2020 on consent under Regulation 2016/6791, valid consent for

the use of cookies must meet the following conditions:

•

It must be freely given, which means that the data subject must have a genuine choice and

the ability to refuse or withdraw consent without detriment.

•

It must be specific, which means that the data subject must give consent for each distinct

purpose of the processing and for each type of cookie.

•

It must be informed, which means that the data subject must receive clear and

comprehensive information about the identity of the controller, the purposes of the processing, the

types of cookies used, the duration of the cookies, and the possibility of withdrawing consent.

•

It must be unambiguous, which means that the data subject must express their consent by a

clear affirmative action, such as clicking on an “I agree” button or selecting specific settings in a

cookie banner.

•

It must be granular, which means that the data subject must be able to consent to different

types of cookies separately, such as essential, functional, performance, or marketing cookies.

Therefore, a “Cookies Settings” button is not a necessary element to collect valid consent for the use

of cookies, as long as the data subject can exercise their choice and preference through other means,

such as a cookie banner with different options. However, a “Cookies Settings” button may be a good

practice to enhance transparency and user control, as it allows the data subject to access and modify

their consent settings at any time.

On the other hand, a “Reject All” cookies button is a necessary element to collect valid consent for

the use of cookies, as it ensures that the data subject can freely refuse consent without detriment. A

list of cookies that may be placed and information on the purpose of the cookies are also necessary

elements to collect valid consent for the use of cookies, as they ensure that the data subject is

informed and can give specific consent for each type of cookie.

Reference: EDPB Guidelines 05/2020 on consent under Regulation 2016/6791, pages 17-23.

According to Article 32 of the GDPR, the controller and the processor must implement appropriate

technical and organisational measures to ensure a level of security appropriate to the risk of the

processing1. The GDPR does not prescribe specific security measures, but rather provides a list of

factors to consider when determining the appropriate level of security, such as:

The state of the art and the costs of implementation;

The nature, scope, context and purposes of processing;

The risk of varying likelihood and severity for the rights and freedoms of natural persons.

Therefore, the level of security required by the GDPR is not absolute, but relative to the specific

circumstances of each processing activity. The GDPR also encourages the use of codes of conduct and

certification mechanisms to demonstrate compliance with the security requirements1.

In the scenario, Natural Insight is a processor who receives customer information from BHealthy, a

controller, for the purpose of providing pricing services. Natural Insight has a contractual obligation

to implement technical and organisational measures to ensure the security of the data, as well as to

comply with the GDPR. Natural Insight’s security obligations are not limited to the measures

assessed by BHealthy prior to entering into the contract, nor to the level of security that a reasonable

data subject would expect. Rather, Natural Insight must take into account the industry practices for

protecting customer contact information and purchase history, as well as the potential risks that may

arise from the processing, such as data breaches, identity theft, fraud, or discrimination. Natural

Insight must also keep up with the state of the art and the costs of implementation, and adjust its

security measures accordingly.

Reference:

4: Art. 32 GDPR Security of processing

The Convention 108+ is the modernized version of the Council of Europe Convention for the

Protection of Individuals with regard to Automatic Processing of Personal Data, which was opened

for signature on 10 October 20181. The Convention 108+ aims to reinforce the individuals’

protection, strengthen the implementation of the Convention, and promote it as a universal standard

for data protection2. The Convention 108+ reflects the same principles as those enshrined in the EU’s

General Data Protection Regulation (GDPR), which applies from 25 May 20183. Therefore, the

Convention 108+ and the GDPR are largely consistent and coherent in their provisions and

objectives.

However, one of the principles of the Convention 108+ that is not consistent with a principle found in

the GDPR is the necessity of the bulk collection of personal data by the government. The Convention

108+ allows for the possibility of bulk collection of personal data by the government for national

security purposes, subject to certain safeguards and oversight mechanisms. The GDPR, on the other

hand, does not regulate the processing of personal data by the government for national security

purposes, as this falls outside the scope of EU law. The GDPR also does not explicitly endorse the

bulk collection of personal data by the government, but rather requires that any processing of

personal data must be based on a legal basis, respect the principles of data protection, and ensure

the rights and freedoms of data subjects. Therefore, the correct answer is C.

Reference:

Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data

Convention 108+ and the GDPR

General Data Protection Regulation

[Convention 108+: the consultative committee of the convention for the protection of individuals

with regard to the processing of personal data (T-PD) publishes its guidelines on artificial intelligence

and data protection]

[Article 3 GDPR – Territorial scope]

[Article 5 GDPR – Principles relating to processing of personal data]

I hope this helps you understand the Convention 108+ and the GDPR better. If you have any other

questions, please feel free to ask me.

Reference: https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:52018PC0449&from=HU

The Data Retention Directive (2006/24/EC) was a legal framework that required Member States to

ensure that providers of publicly available electronic communications services or of public

communications networks retained certain data for a period of between six months and two years,

for the purpose of the prevention, investigation, detection and prosecution of serious

crime1. However, on 8 April 2014, the Court of Justice of the European Union (CJEU) declared the

Directive invalid, as it entailed a wide-ranging and particularly serious interference with the

fundamental rights to respect for private life and to the protection of personal data, without limiting

the access of the competent national authorities to the data retained to what was strictly

necessary2. The CJEU also found that the Directive did not provide sufficient safeguards to ensure

effective protection of the data against the risk of abuse and against any unlawful access and use of

the data2. Therefore, the Directive is no longer part of EU law.

Reference:

Directive 2006/24/EC of the European Parliament and of the Council

Court of Justice of the European Union PRESS RELEASE No 54/14

I hope this helps you understand the GDPR and data retention better. If you have any other

questions, please feel free to ask me.

Reference: https://gdpr-info.eu/art-82-gdpr/

According to the GDPR, location data is a type of personal data that can reveal information about an

individual’s habits, p

, or movements1. Location data can also be considered as a special

category of personal data if it reveals information about an individual’s health, ethnic origin, or

religious beliefs2. Therefore, location data is subject to the GDPR’s rules on the lawful processing of

personal data, which require a valid legal basis, such as consent, contract, legal obligation, vital

interest, public interest, or legitimate interest2.

In this scenario, Who-R-U decides to track locations using its app, which means that it collects and

processes location data from its app users. This data can be used to identify the app users, as well as

to infer information about their interests, preferences, or behavior. Therefore, Who-R-U needs to

comply with the GDPR, even if it only offers its services to Canadians, because it monitors the

behavior of individuals in the EU2.

One of the possible legal bases for processing location data is consent, which means that the app

users must give their informed, specific, and freely given agreement to the collection and use of their

location data2. Consent must be obtained before the processing starts, and it must be easy to

withdraw at any time2. Consent must also be granular, meaning that the app users must be able to

choose which purposes and types of location data they agree to share1.

Therefore, if Who-R-U decides to track locations using its app, it must get consent from the app

users, and provide them with clear and transparent information about how, why, and for how long

their location data will be processed, who will have access to it, and what rights they have under the

GDPR12. Who-R-U must also ensure that the consent is voluntary, and that the app users can opt out

of location tracking without affecting the functionality or quality of the app12. Reference: 1 Policy

Brief: Location Data Under Existing Privacy Laws | FPF. Available at: 5 (Accessed: 11 December

2023)2 What is the General Data Protection Regulation (GDPR)? | Cloudflare. Available

at: 6 (Accessed: 11 December 2023).

Ben’s collection of additional data from customers, especially sensitive data such as philosophical beliefs and political opinions, created several potential issues for the company, such as: The risk of violating the data minimization principle, which requires that personal data collected must be adequate, relevant and limited to what is necessary for the purposes of the processing1. The risk of infringing the rights and freedoms of the data subjects, who may not be aware of or consent to the secondary use of their data by Ben Knows Best, or the unauthorized access and copying of their data by Sam. The risk of non-compliance with the GDPR’s requirements for processing special categories of data, which include data revealing philosophical beliefs and political opinions. Such data can only be processed under certain conditions, such as explicit consent, substantial public interest, or legal claims2. The risk of data breaches or losses, as the data is transferred to a separate database, copied by Sam, and stored on the company’s servers in Vermont, which may not have adequate security measures or safeguards. Therefore, the company would most likely require a data protection impact assessment (DPIA) to identify and mitigate these risks. A DPIA is a process that helps assess the impact of the envisaged processing operations on the protection of personal data, and consult with the supervisory authority if the DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk3. The other options are not necessarily required by the GDPR, although they may be good practices or contractual terms. Reference: Free CIPP/E Study Guide, page 32, section 4.1.2 CIPP/E Certification, page 27, section 4.1.2 The Ultimate CIPP/E Study Guide for 2023, page 36, section 4.1.2 Principles - General Data Protection Regulation (GDPR), Article 5 Special categories of personal data - General Data Protection Regulation (GDPR), Article 9 Data protection impact assessment - General Data Protection Regulation (GDPR), Article 35

According to Articles 33 and 34 of the GDPR, the Gummy Bear Company potentially violated its breach notification obligations by allowing Sam to copy and use the personal data of its customers in Ireland without their consent or authorization. A personal data breach is defined as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed (Article 4(12)). The Gummy Bear Company, as a data controller, is required to notify the competent supervisory authority of the personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33(1)). The notification should include the nature of the personal data breach, the categories and approximate number of data subjects and personal data records concerned, the likely consequences of the personal data breach, and the measures taken or proposed to address the personal data breach (Article 33(3)). The Gummy Bear Company is also required to communicate the personal data breach to the affected data subjects without undue delay, if the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons (Article 34(1)). The communication should describe the nature of the personal data breach and the measures taken or proposed to address the personal data breach (Article 34(2)). Therefore, the Gummy Bear Company should analyze and evaluate all of its breach notification obligations, taking into account the nature and circumstances of the personal data breach, the type and sensitivity of the personal data involved, the potential impact and harm to the data subjects, and the applicable laws and regulations of the jurisdictions where the data subjects reside. The Gummy Bear Company should also document the personal data breach and the remedial actions taken, and cooperate with the supervisory authorities and the data subjects as required by the GDPR. Reference: GDPR, Articles 4(12), 33, 341; EDPB Guidelines 01/2021 on Examples regarding Data Breach Notification2

ccording to the GDPR, the regulation applies to the processing of personal data in the context of the

activities of an establishment of a controller or a processor in the Union, regardless of whether the

processing takes place in the Union or not1. The GDPR also applies to the processing of personal data

of data subjects who are in the Union by a controller or processor not established in the Union,

where the processing activities are related to: (a) the offering of goods or services, irrespective of

whether a payment of the data subject is required, to such data subjects in the Union; or (b) the

monitoring of their behaviour as far as their behaviour takes place within the Union1.

In this scenario, a U.S. company’s website sells widgets to customers in the EU and places cookies to

monitor their behavior. These factors would subject the company to the GDPR, as they indicate that

the company is offering goods or services and monitoring the behavior of data subjects in the

Union2. However, the fact that the website is in English and French, and is accessible in France,

would not in itself subject the company to the GDPR, as these factors do not necessarily imply an

intention to target customers in the Union3. The language and accessibility of the website are not

sufficient to establish a relevant and sufficient degree of stability and continuity of the company’s

activities in the Union3. Therefore, the correct answer is B.

Reference:

Art. 3 GDPR – Territorial scope

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

What does territorial scope mean under the GDPR?

I hope this helps you understand the GDPR and territorial scope better. If you have any other

questions, please feel free to ask me.

The GDPR applies to the processing of personal data in the context of the activities of an

establishment of a controller or a processor in the Union, regardless of whether the processing takes

place in the Union or not1. This means that the GDPR applies to any controller or processor that has

a branch, office, subsidiary, or other stable arrangement in the EU, even if the data processing occurs

outside the EU. However, the GDPR also applies to the processing of personal data of data subjects

who are in the Union by a controller or processor not established in the Union, where the processing

activities are related to: (a) the offering of goods or services, irrespective of whether a payment of

the data subject is required, to such data subjects in the Union; or (b) the monitoring of their

behaviour as far as their behaviour takes place within the Union1. This means that the GDPR applies

to any controller or processor that targets or tracks EU data subjects, even if they do not have a

presence in the EU. In this case, the website operator is not required to comply with the GDPR

because it does not have an establishment in the EU (option B), and it does not offer goods or

services or monitor the behaviour of EU data subjects. The website operator reports primarily on

North American events, does not block connections from outside the U.S., and only accepts

payments in U.S. dollars, which indicate that it does not intend to target or track EU data subjects.

Therefore, option B is the correct answer. Reference: Art. 3 GDPR – Territorial scope, Guidelines

3/2018 on the territorial scope of the GDPR (Article 3), [What does territorial scope mean under the

GDPR?]