IAPP CIPP/E Practice Questions & Answers • ExamPrepare

Question 1

What is considered a best practice under the EDPB's Guidelines 3/2022 on Dark patterns in social media platform interfaces?

Offer multiple options users can choose from to set up their privacy settings and data protection preferences.
Offer several data protection tools for users to control how their data is processed and how to exercise their rights.
Provide relevant links to additional information, settings, or actions wherever helpful for users to navigate online interfaces.
Provide a variety of content to users so they can answer multiple questions about their personal data and make their privacy choices.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

A retailer sends a promotional email containing a 1x1 invisible pixel. When a recipient opens the email, the email client fires an HTTP request to the retailer's server, which logs the event, timestamp, and IP address.

According to EDPB Guidelines 2/2023 (v2.0, Oct. 2024), why would the ePrivacy Directive apply in this situation?

The server logs the recipient's IP address.
The email is a promotional communication.
The request constitutes gaining access to information on the recipient's device.
The invisible pixel is downloaded to recipients' devices without their knowledge.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

SCENARIO

Please use the following to answer the next questions:

PetStop, a Dutch retail chain with 250 employees, experienced issues with employees fraudulently clocking in and out for each other. To address this, the company implemented a fingerprint-scanning system from an outside vendor, BioClock, for time tracking. The BioClock system stores a mathematical template for each fingerprint on cloud servers in the Netherlands.

PetStop's HR director later informed employees that fingerprint scanning is necessary to prevent fraud. The company's privacy policy states that it processes employee data through HR systems for employment purposes. However, it does not reference biometric data or outside vendors.

Several employees filed complaints with their works council, objecting to the collection of biometric data. During its investigation, the works council discovered that PetStop's security team had been accessing the fingerprint scan logs to track which employees consistently arrived late or left early, using this data for performance reviews.

What would justify the implementation of BioClock under the employment and social security exception in Article 9(2)(b) GDPR?

Official works council approval.
Prior explicit employee consent.
Unavailability of less intrusive alternatives.
Sufficient organizational and technical measures.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

SCENARIO

Please use the following to answer the next questions:

PetStop, a Dutch retail chain with 250 employees, experienced issues with employees fraudulently clocking in and out for each other. To address this, the company implemented a fingerprint-scanning system from an outside vendor, BioClock, for time tracking. The BioClock system stores a mathematical template for each fingerprint on cloud servers in the Netherlands.

PetStop's HR director later informed employees that fingerprint scanning is necessary to prevent fraud. The company's privacy policy states that it processes employee data through HR systems for employment purposes. However, it does not reference biometric data or outside vendors.

Several employees filed complaints with their works council, objecting to the collection of biometric data. During its investigation, the works council discovered that PetStop's security team had been accessing the fingerprint scan logs to track which employees consistently arrived late or left early, using this data for performance reviews.

MULTI-SELECT

Please select 2 of the 5 options below. No partial credit will be given.

Which two core GDPR principles did PetStop violate?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

SCENARIO

Please use the following to answer the next questions:

PetStop, a Dutch retail chain with 250 employees, experienced issues with employees fraudulently clocking in and out for each other. To address this, the company implemented a fingerprint-scanning system from an outside vendor, BioClock, for time tracking. The BioClock system stores a mathematical template for each fingerprint on cloud servers in the Netherlands.

PetStop's HR director later informed employees that fingerprint scanning is necessary to prevent fraud. The company's privacy policy states that it processes employee data through HR systems for employment purposes. However, it does not reference biometric data or outside vendors.

Several employees filed complaints with their works council, objecting to the collection of biometric data. During its investigation, the works council discovered that PetStop's security team had been accessing the fingerprint scan logs to track which employees consistently arrived late or left early, using this data for performance reviews.

What must PetStop do before using employee scan times for performance reviews?

Update the company's privacy policy.
Conduct an algorithmic impact assessment.
Notify employees about the purpose and legal basis.
Require that analysis of the scan times include a human-in-the-loop.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

The European Data Protection Supervisor (EDPS), unlike the member state data protection authority, has the power to?

Order suspension of data flows to a recipient in a member state.
Approve binding corporate rules for multinational corporations.
Carry out investigations as data protection audits.
Issue reprimands to a controller or a processor.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.