IAPP CIPP-E Practice Exams
Last updated on Apr 07,2025- Exam Code: CIPP-E
- Exam Name: Certified Information Privacy Professional/Europe (CIPP/E)
- Certification Provider: IAPP
- Latest update: Apr 07,2025
SCENARIO
Please use the following to answer the next question:
Liem, an online retailer known for its environmentally friendly shoes, has recently expanded its presence in Europe. Anxious to achieve market dominance, Liem teamed up with another eco friendly company, EcoMick, which sells accessories like belts and bags. Together the companies drew up a series of marketing campaigns designed to highlight the environmental and economic benefits of their products. After months of planning, Liem and EcoMick entered into a data sharing agreement to use the same marketing database, MarketIQ, to send the campaigns to their respective contacts.
Liem and EcoMick also entered into a data processing agreement with MarketIQ, the terms of which included processing personal data only upon Liem and EcoMick’s instructions, and making available to them all information necessary to demonstrate compliance with GDPR obligations.
Liem and EcoMick then procured the services of a company called JaphSoft, a marketing optimization firm that uses machine learning to help companies run successful campaigns. Clients provide JaphSoft with the personal data of individuals they would like to be targeted in each campaign. To ensure protection of its clients’ data, JaphSoft implements the technical and organizational measures it deems appropriate. JaphSoft works to continually improve its machine learning models by analyzing the data it receives from its clients to determine the most successful components of a successful campaign. JaphSoft then uses such models in providing services to its client-base. Since the models improve only over a period of time as more information is collected, JaphSoft does not have a deletion process for the data it receives from clients. However, to ensure compliance with data privacy rules, JaphSoft pseudonymizes the personal data by removing identifying information from the contact information. JaphSoft’s engineers, however, maintain all contact information in the same database as the identifying information.
Under its agreement with Liem and EcoMick, JaphSoft received access to MarketIQ, which included contact information as well as prior purchase history for such contacts, to create campaigns that would result in the most views of the two companies’ websites. A prior Liem customer, Ms. Iman, received a marketing campaign from JaphSoft regarding Liem’s as well as EcoMick’s latest products. While Ms. Iman recalls checking a box to receive information in the future regarding Liem’s products, she has never shopped EcoMick, nor provided her personal data to that company.
JaphSoft’s use of pseudonymization is NOT in compliance with the CDPR because?
- A . JaphSoft failed to first anonymize the personal data.
- B . JaphSoft pseudonymized all the data instead of deleting what it no longer needed.
- C . JaphSoft was in possession of information that could be used to identify data subjects.
- D . JaphSoft failed to keep personally identifiable information in a separate database.
In the Planet 49 case, what was the man judgement of the Coon of Justice of the European Union (CJEU) regarding the issue of cookies?
- A . If the cookies do not track personal data, then pre-checked boxes are acceptable.
- B . If the ePrivacy Directive requires consent for cookies, then the GDPR’s consent requirements apply.
- C . If a website’s cookie notice makes clear the information gathered and the lifespan of the cookie, then pre-checked boxes are acceptable.
- D . If a data subject continues to scroll through a website after reading a cookie banner, this activity constitutes valid consent for the tracking described in the cookie banner.
SCENARIO
Please use the following to answer the next question:
Liem, an online retailer known for its environmentally friendly shoes, has recently expanded its presence in Europe. Anxious to achieve market dominance, Liem teamed up with another eco friendly company, EcoMick, which sells accessories like belts and bags. Together the companies drew up a series of marketing campaigns designed to highlight the environmental and economic benefits of their products. After months of planning, Liem and EcoMick entered into a data sharing agreement to use the same marketing database, MarketIQ, to send the campaigns to their respective contacts.
Liem and EcoMick also entered into a data processing agreement with MarketIQ, the terms of which included processing personal data only upon Liem and EcoMick’s instructions, and making available to them all information necessary to demonstrate compliance with GDPR obligations.
Liem and EcoMick then procured the services of a company called JaphSoft, a marketing optimization firm that uses machine learning to help companies run successful campaigns. Clients provide JaphSoft with the personal data of individuals they would like to be targeted in each campaign. To ensure protection of its clients’ data, JaphSoft implements the technical and organizational measures it deems appropriate. JaphSoft works to continually improve its machine learning models by analyzing the data it receives from its clients to determine the most successful components of a successful campaign. JaphSoft then uses such models in providing services to its client-base. Since the models improve only over a period of time as more information is collected, JaphSoft does not have a deletion process for the data it receives from clients. However, to ensure compliance with data privacy rules, JaphSoft pseudonymizes the personal data by removing identifying information from the contact information. JaphSoft’s engineers, however, maintain all contact information in the same database as the identifying information.
Under its agreement with Liem and EcoMick, JaphSoft received access to MarketIQ, which included contact information as well as prior purchase history for such contacts, to create campaigns that would result in the most views of the two companies’ websites. A prior Liem customer, Ms. Iman, received a marketing campaign from JaphSoft regarding Liem’s as well as EcoMick’s latest products. While Ms. Iman recalls checking a box to receive information in the future regarding Liem’s products, she has never shopped EcoMick, nor provided her personal data to that company.
For what reason would JaphSoft be considered a controller under the GDPR?
- A . It determines how long to retain the personal data collected.
- B . It has been provided access to personal data in the MarketIQ database.
- C . It uses personal data to improve its products and services for its client-base through machine learning.
- D . It makes decisions regarding the technical and organizational measures necessary to protect the personal data.
A company in France suffers a robbery over the weekend owing to a faulty alarm system. When it is determined that the break-in involves the loss of a substantial amount of data, the company decides on a CCTV system to monitor for future incidents. Company technicians install cameras in the entrance of the building, hallways and offices. Footage is recorded continuously, and is monitored by the home office in the United States.
What is the most realistic step the company could take to address their security concerns and comply with the personal data processing principles set out in Article 5 of the GDPR?
- A . Seek informed consent from company employees.
- B . Have cameras recording during work hours only.
- C . Retain captured footage for no more than 30 days.
- D . Restrict camera placement to building entrances only.
What is the MAIN reason GDPR Article 4(22) establishes the concept of the “concerned supervisory authority”?
- A . To encourage the consistency of local data processing activity.
- B . To give corporations a choice about who their supervisory authority will be.
- C . To ensure the GDPR covers controllers that do not have an establishment in the EU but have a representative in a member state.
- D . To ensure that the interests of individuals residing outside the lead authority’s jurisdiction are represented.
Under Article 80(1) of the GDPR, individuals can elect to be represented by not-for-profit organizations in a privacy group litigation or class action.
These organizations are commonly known as?
- A . Law firm organizations.
- B . Civil society organizations.
- C . Human rights organizations.
- D . Constitutional rights organizations.
Which marketing-related activity is least likely to be covered by the provisions of Privacy and Electronic Communications Regulations (Directive 2002/58/EC)?
- A . Advertisements passively displayed on a website.
- B . The use of cookies to collect data about an individual.
- C . A text message to individuals from a company offering concert tickets for sale.
- D . An email from a retail outlet promoting a sale to one of their previous customer.
Bioface is a company based in the United States. It has no servers, personnel or assets in the European Union. By collecting photographs from social media and other web-based services, such as newspapers and blogs, it uses machine learning to develop a facial recognition algorithm. The algorithm identifies individuals in photographs who are not in its data set based the algorithm and its existing data. The service collects photographs of data subjects in the European Union and will identify them if presented with their photographs. Bioface offers its service to government agencies and companies in the United States and Canada, but not to those in the European Union. Bioface does not offer the service to individuals.
Why is Bioface subject to the territorial scope of the General Data Protection Regulation?
- A . It collects data from European Union websites, which constitutes an establishment in the European Union.
- B . It offers services in the European Union by identifying data subjects in the European Union.
- C . It collects data from subjects and uses it for automated processing.
- D . It monitors the behavior of data subjects in the European Union.
After detecting an intrusion involving the theft of unencrypted personal data, who shall the breached company notify first under GDPR requirements?
- A . Any parents of children whose personal data was compromised.
- B . Any affected customers whose data was compromised.
- C . A competent supervisory authority.
- D . A local law enforcement agency
Article 29 Working Party has emphasized that the GDPR forbids “forum shopping”, which occurs when companies do what?
- A . Choose the data protection officer that is most sympathetic to their business concerns.
- B . Designate their main establishment in member state with the most flexible practices.
- C . File appeals of infringement judgments with more than one EU institution simultaneously.
- D . Select third-party processors on the basis of cost rather than quality of privacy protection.