IAPP Information Privacy Pro /Europe (CIPP-E) Practice Questions & Study Guide

Free IAPP Information Privacy Pro /Europe (CIPP-E) Practice Questions Preview

• Question 1

  Which statement is correct when considering the right to privacy under Article 8 of the European Convention on Human Rights (ECHR)?

  • A. The right to privacy is an absolute right
  • B. The right to privacy has to be balanced against other rights under the ECHR
  • C. The right to freedom of expression under Article 10 of the ECHR will always override the right to privacy
  • D. The right to privacy protects the right to hold opinions and to receive and impart ideas without interference

  Correct Answer: B

  Explanation:

  The AI agrees with the suggested answer, which is B: The right to privacy has to be balanced against other rights under the ECHR.
  
  Reasoning: Article 8 of the European Convention on Human Rights (ECHR) provides a right to respect for private and family life, home, and correspondence. However, this right is not absolute. It is a qualified right, meaning that it can be subject to certain restrictions. These restrictions must be prescribed by law and necessary in a democratic society for a legitimate aim, such as national security, public safety, or the protection of the rights and freedoms of others. This necessitates a balancing exercise between the right to privacy and other competing rights and interests. This is consistent with established legal principles and case law relating to the interpretation and application of Article 8.
  
  Reasons for not choosing other answers:

  • A: The right to privacy is an absolute right - This is incorrect because, as noted above, the right to privacy under Article 8 is a qualified, not an absolute, right.
  • C: The right to freedom of expression under Article 10 of the ECHR will always override the right to privacy - This is incorrect. Rights under the ECHR must be balanced against each other. Article 10 (freedom of expression) does not automatically override Article 8 (right to privacy). A proper balancing exercise is required.
  • D: The right to privacy protects the right to hold opinions and to receive and impart ideas without interference - While privacy can relate to the freedom to hold opinions, this option is more directly aligned with Article 10 of the ECHR, which protects freedom of expression. Article 8 primarily focuses on private and family life, home, and correspondence.

• Question 2

  What is one major goal that the OECD Guidelines, Convention 108 and the Data Protection Directive (Directive 95/46/EC) all had in common but largely failed to achieve in Europe?

  • A. The establishment of a list of legitimate data processing criteria
  • B. The creation of legally binding data protection principles
  • C. The synchronization of approaches to data protection
  • D. The restriction of cross-border data flow

  Correct Answer: C

  Explanation:

  The suggested answer (C) is correct. The OECD Guidelines, Convention 108, and the Data Protection Directive (Directive 95/46/EC) all aimed to harmonize data protection approaches across different jurisdictions, specifically within Europe. While they established frameworks and principles, their major goal was to create a unified data protection landscape.

  
  

  The reason for choosing option C is because these initiatives sought to synchronize data protection laws and practices to facilitate cross-border data flows while protecting individual rights. The lack of complete synchronization and the persistence of divergent national laws were significant drivers for the introduction of the GDPR. The GDPR aimed to address these inconsistencies and create a more uniform data protection framework across the European Union.

  
  

  The reasons for not choosing the other options are:

  • Option A is incorrect because while these frameworks touched upon legitimate data processing criteria, establishing a definitive list was not their primary goal.
  • Option B is incorrect because these initiatives did create data protection principles; hence, this was not a goal they failed to achieve.
  • Option D is incorrect because the aim was to manage and regulate, not necessarily restrict, cross-border data flow, facilitating it under certain conditions.

  
  

  These frameworks aimed to harmonize data protection laws across different jurisdictions. However, significant differences in the implementation and enforcement of data protection laws persisted among European countries, leading to a lack of synchronization, which was one of the key reasons for the introduction of the GDPR.

  
  

  While the Data Protection Directive (95/46/EC) laid the groundwork, its inconsistent implementation across member states highlighted the need for a more unified and enforceable regulation, leading to the creation of the GDPR. This evolution underscores the initial failure to achieve complete synchronization, which the GDPR directly addresses.

  • OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, https://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm
  • Convention 108, https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108
  • Directive 95/46/EC, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:31995L0046
  • GDPR, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

• Question 3

  A key component of the OECD Guidelines is the “Individual Participation Principle”. What parts of the General Data Protection Regulation (GDPR) provide the closest equivalent to that principle?

  • A. The lawful processing criteria stipulated by Articles 6 to 9
  • B. The information requirements set out in Articles 13 and 14
  • C. The breach notification requirements specified in Articles 33 and 34
  • D. The rights granted to data subjects under Articles 12 to 22

  Correct Answer: D

  Explanation:

  The AI agrees with the suggested answer, D.
  The rights granted to data subjects under Articles 12 to 22 of the GDPR provide the closest equivalent to the OECD's "Individual Participation Principle" because these articles empower individuals to control their personal data. These rights include the right to access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and the right to object (Article 21). These provisions directly enable individuals to participate in and influence how their data is processed.
  Option A is incorrect because lawful processing criteria, while fundamental, do not directly provide mechanisms for individual participation.
  Option B, while related to transparency, is less directly linked to participation. Information requirements ensure individuals are informed, but do not necessarily grant them rights to actively engage in or control processing.
  Option C is incorrect because breach notification requirements address data security incidents and do not relate to individual participation in data processing.

  • Right of access by the data subject, https://gdpr-info.eu/art-15-gdpr/
  • Right to rectification, https://gdpr-info.eu/art-16-gdpr/
  • Right to erasure (‘right to be forgotten’), https://gdpr-info.eu/art-17-gdpr/
  • Right to restriction of processing, https://gdpr-info.eu/art-18-gdpr/
  • Right to data portability, https://gdpr-info.eu/art-20-gdpr/
  • Right to object, https://gdpr-info.eu/art-21-gdpr/

• Question 4

  Which EU institution is vested with the competence to propose new data protection legislation on its own initiative?

  • A. The European Council
  • B. The European Parliament
  • C. The European Commission
  • D. The Council of the European Union

  Correct Answer: C

  Explanation:

  Based on my understanding and the discussion provided, I agree with the suggested answer C, the European Commission.
  
  The European Commission is primarily responsible for proposing new legislation within the EU. This includes data protection legislation. Article 17(1) of the Treaty on European Union (TEU) states that the Commission "shall promote the general interest of the Union and take appropriate initiatives to that end. It shall ensure the application of the Treaties, and measures adopted by the institutions pursuant thereto. It shall oversee the application of Union law under the control of the Court of Justice of the European Union. It shall execute the budget and manage programmes. It shall exercise coordinating, executive and management functions, as laid down in the Treaties." This implies that the Commission has the power to propose new regulations such as those regarding data protection.
  
  Here's why the other options are incorrect:

  • A. The European Council: The European Council defines the general political direction and priorities of the European Union, but it does not have the power to propose legislation.
  • B. The European Parliament: The European Parliament is a co-legislator with the Council of the European Union, meaning it can amend and adopt legislation proposed by the Commission, but it cannot propose legislation on its own initiative.
  • D. The Council of the European Union: The Council of the European Union is also a co-legislator with the European Parliament. It amends, adopts, or rejects legislative proposals, but it does not initiate them.

  Therefore, the European Commission is the correct answer.

  Citations:

  • Consolidated version of the Treaty on European Union, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012M/TXT

• Question 5

  What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?

  • A. ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.
  • B. CJEU can force national governments to implement and honor EU law, while the ECHR cannot.
  • C. CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.
  • D. ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.

  Correct Answer: B

  Explanation:

  The AI suggests that the suggested answer B is correct.
  Reasoning: The core distinction between the CJEU and the ECHR lies in their mandates and enforcement powers.
  

  • The CJEU's primary role is to ensure that EU law is uniformly interpreted and applied across all EU member states. It has the power to enforce EU law by compelling national governments to comply with EU directives and regulations. Judgments of the CJEU are binding on member states, and the Commission can take member states to the CJEU for failing to implement EU law properly. (Curia.europa.eu)
  • The ECHR, on the other hand, deals with violations of the European Convention on Human Rights. While its judgments are significant and can lead to changes in national law, the ECHR does not have the same direct enforcement power as the CJEU. It cannot directly force national governments to implement its decisions in the same way the CJEU can enforce EU law. The ECHR's role is primarily to provide redress to individuals whose rights under the Convention have been violated. (Echr.coe.int)

  
  Reasons for not choosing the other options:

  • Option A is incorrect because both the ECHR and the CJEU can address issues concerning privacy as a fundamental right, though within their respective jurisdictions and legal frameworks.
  • Option C is incorrect because the CJEU does not hear appeals on human rights decisions made by national courts in the same way as a regular appellate court. The ECHR also does not function as a general court of appeal for national court decisions.
  • Option D is incorrect because while the ECHR can issue judgments against governments that fail to implement human rights laws, it does not have direct enforcement mechanisms like the CJEU.

  • Citations:
  • Curia.europa.eu, https://curia.europa.eu/jcms/jcms/j_6/
  • Echr.coe.int, https://www.echr.coe.int/

• Question 6

  SCENARIO -
  Please use the following to answer the next question:
  Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
  Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
  Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
  Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester’s Alumni portal.
  Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
  Under their security policy, the University encrypts all of its personal data records in transit and at rest.
  In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna’s data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna’s training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
  One of Anna’s tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
  Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
  Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
  Which of the University’s records does Anna NOT have to include in her record of processing activities?

  • A. Student records
  • B. Staff and alumni records
  • C. Frank’s performance database
  • D. Department for Education records

  Correct Answer: D

  Explanation:

  Based on the analysis and the discussion summary, the AI agrees with the suggested answer D.
  The reason is that the Department for Education records, in the context of a university's record of processing activities, are least likely to contain personal data directly processed by the University itself for its core functions related to students, staff, and alumni. The other options (student records, staff and alumni records, and Frank's performance database) are more likely to contain personal data that the university processes.
  Other options are not the best answer because:

  • A. Student records are core to the university's operations and contain a wealth of personal data.
  • B. Staff and alumni records also contain significant personal data related to employment and alumni relations.
  • C. Frank's performance database, if it contains personal data relating to performance, is also relevant.

  • Reasoning Breakdown
    • The General Data Protection Regulation (GDPR) requires organizations to maintain records of processing activities (Article 30 GDPR).
    • These records should include categories of personal data processed, the purpose of processing, and other relevant information.
    • Student, staff, and alumni records undoubtedly contain personal data and are part of the university's processing activities.
    • A performance database of an individual (Frank) will contain personal data and constitute processing activity.
    • Department for Education records are less likely to be directly processed by the University for their core functions and hence less likely to be included in the university's record of processing activities. These records are also less likely to contain personal data that is controlled or processed by the University, and instead might contain aggregated or anonymized data.

  
  Citations:

  • GDPR Article 30 - Records of processing activities, https://gdpr-info.eu/art-30-gdpr/

• Question 7

  SCENARIO -
  Please use the following to answer the next question:
  Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
  Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
  Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
  Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester’s Alumni portal.
  Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
  Under their security policy, the University encrypts all of its personal data records in transit and at rest.
  In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna’s data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna’s training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
  One of Anna’s tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
  Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
  Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
  Before Anna determines whether Frank’s performance database is permissible, what additional information does she need?

  • A. More information about Frank’s data protection training.
  • B. More information about the extent of the information loss.
  • C. More information about the algorithm Frank used to mask student numbers.
  • D. More information about what students have been told and how the research will be used.

  Correct Answer: D

  Explanation:

  The AI agrees with the suggested answer of D. More information about what students have been told and how the research will be used.
  
  Reasoning:
  Anna needs to determine if Frank's processing is permissible under GDPR. To do this, she needs to ensure the processing aligns with the principles of transparency, purpose limitation, and lawfulness.
  
  1. Transparency and Purpose Limitation: Under GDPR, individuals have the right to be informed about how their data is used (transparency), and data should only be processed for specified, explicit, and legitimate purposes (purpose limitation) (Article 5(1)(b) and Article 13 GDPR). Anna needs to know what the students have been told about the use of their data for research purposes. If the research use is not compatible with the original purpose for which the data was collected (e.g., academic administration), then additional consent or a different legal basis might be required.
  
  2. Lawfulness: Knowing how the research will be used is essential to determine the appropriate legal basis for processing. The University needs a legal basis, such as consent, legitimate interest, or public interest, to process the student data for research (Article 6 GDPR). Without knowing the specifics of the research and its intended use, Anna cannot assess whether a valid legal basis exists.
  
  Reasons for not choosing other answers:
  

  • A. More information about Frank’s data protection training: While it is relevant that Frank has attended data protection training, this is not the most immediate piece of information Anna requires to determine the permissibility of the processing. His level of training does not directly impact whether the processing is lawful, fair, and transparent.
  • B. More information about the extent of the information loss: The data loss from the laptop is a separate issue that needs to be addressed as a data breach. While important, it does not directly inform Anna's assessment of the permissibility of Frank's performance database under GDPR.
  • C. More information about the algorithm Frank used to mask student numbers: The algorithm is a pseudonymization technique. Even if the student numbers are transformed, the data is still considered personal data under the GDPR because the students are still identifiable. Pseudonymization can be a security measure, but it does not remove the need for a legal basis and transparency about the processing (Recital 26 GDPR). The nature of the algorithm is less important than ensuring that students have been informed and that the processing purpose is legitimate.

  • GDPR Article 5(1)(b): Purpose Limitation, https://gdpr-info.eu/art-5-gdpr/
  • GDPR Article 6: Lawfulness of processing, https://gdpr-info.eu/art-6-gdpr/
  • GDPR Article 13: Information to be provided where personal data are collected from the data subject, https://gdpr-info.eu/art-13-gdpr/
  • GDPR Recital 26: Encourages pseudonymisation as a security measure, https://gdpr-info.eu/recitals/no-26/

• Question 8

  SCENARIO -
  Please use the following to answer the next question:
  Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
  Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
  Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
  Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees. These records are available to former students after registering through Granchester’s Alumni portal.
  Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
  Under their security policy, the University encrypts all of its personal data records in transit and at rest.
  In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna’s data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna’s training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
  One of Anna’s tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
  Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
  Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
  Anna will find that a risk analysis is NOT necessary in this situation as long as?

  • A. The data subjects are no longer current students of Frank’s
  • B. The processing will not negatively affect the rights of the data subjects
  • C. The algorithms that Frank uses for the processing are technologically sound
  • D. The data subjects gave their unambiguous consent for the original processing

  Correct Answer: B

  Explanation:

  The AI assistant agrees with the suggested answer B.
  Reasoning:
  According to GDPR, a Data Protection Impact Assessment (DPIA), which includes a risk analysis, is required when processing is likely to result in a high risk to the rights and freedoms of natural persons.
  Therefore, if the processing will not negatively affect the rights of the data subjects, a risk analysis may not be necessary. This aligns with the principles of risk-based assessment within the GDPR framework.

  Reasons for not choosing other options:

  • A. The data subjects are no longer current students of Frank’s: The status of data subjects as current or former students does not automatically negate the need for a risk analysis. The critical factor is the potential impact on their rights and freedoms, regardless of their student status.
  • C. The algorithms that Frank uses for the processing are technologically sound: While using technologically sound algorithms is important for data security, it does not eliminate the need for a risk analysis if the processing itself poses a risk to data subjects' rights. The technology's soundness is just one aspect of the overall risk assessment.
  • D. The data subjects gave their unambiguous consent for the original processing: Consent for the original processing does not automatically waive the need for a risk analysis for subsequent or different processing activities. A risk analysis assesses the potential impact of the specific processing in question, regardless of prior consent. Moreover, consent can be withdrawn.

  Citation:

  • Data Protection Impact Assessments (DPIAs), https://gdpr-info.eu/art-35-gdpr/

• Question 9

  Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?

  • A. The European Parliament
  • B. The European Commission
  • C. The Article 29 Working Party
  • D. The European Council

  Correct Answer: B

  Explanation:

  The suggested answer B, The European Commission, is correct.
  The European Commission is indeed the institution with the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country. This power is derived from the GDPR, specifically Article 45, which outlines the conditions for transfers based on adequacy decisions.
  The European Commission assesses the legal framework, data protection authority independence, and international commitments of the third country to determine whether it offers a level of protection essentially equivalent to that guaranteed in the EU. If the European Commission deems the level of protection adequate, it adopts an adequacy decision, allowing data to flow freely from the EU to that country.
  The other options are incorrect:

  • A. The European Parliament: While the European Parliament is involved in data protection matters and can express its opinion on adequacy decisions, it does not have the power to adopt them.
  • C. The Article 29 Working Party: This group was replaced by the European Data Protection Board (EDPB). Neither the Article 29 Working Party nor the EDPB has the power to adopt adequacy findings; they provide guidance and opinions to the European Commission.
  • D. The European Council: The European Council sets the EU's overall political direction and priorities but is not directly involved in making adequacy decisions.

• Question 10

  What is true of both the General Data Protection Regulation (GDPR) and the Council of Europe Convention 108?

  • A. Both govern international transfers of personal data
  • B. Both govern the manual processing of personal data
  • C. Both only apply to European Union countries
  • D. Both require notification of processing activities to a supervisory authority

  Correct Answer: A

  Explanation:

  The AI agrees with the suggested answer, which is A: Both govern international transfers of personal data.
  The reasoning behind this choice is that both the GDPR and Convention 108 have provisions addressing the transfer of personal data across borders.
  The GDPR's Chapter V outlines specific requirements for transfers of personal data to third countries or international organizations. Similarly, Convention 108 (Article 12) addresses transborder data flows. This makes option A the correct answer.

  Here's why the other options are incorrect:

  • Option B is incorrect because Convention 108 focuses on the automated processing of personal data.
  • Option C is incorrect because while GDPR applies to the EU, Convention 108 is an international treaty open to countries beyond the EU.
  • Option D is incorrect because while GDPR mandates notification of certain processing activities to supervisory authorities, Convention 108 does not have the same broad notification requirement.

  Citations:

  • GDPR Chapter V, https://gdpr-info.eu/chapter-5/
  • Convention 108, Article 12, https://rm.coe.int/1680078b64