Question 1

Many businesses print their employees' photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GOPR. Why would such practice be permitted?

Options :

A : Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption.

B : Because photographs qualify as biometric data only when they undergo a "specific technical processing".

C : Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer.

D : Because photographic ID is a physical security measure which is "necessary for reasons of substantial public interest".

Answer: B

Question 2

Why is advisable to avoid consent as a legal basis for an employer to process employee data?

Options :

A : Employee data can only be processed if there is an approval from the data protection officer.

B : Consent may not be valid if the employee feels compelled to provide it.

C : An employer might have difficulty obtaining consent from every employee.

D : Data protection laws do not apply to processing of employee data.

Answer: B

Question 3

What was the aim of the European Data Protection Directive 95/46/EC?

Options :

A : To harmonize the implementation of the European Convention of Human Rights across all member states.

B : To implement the OECD Guidelines on the Protection of Privacy and trans-border flows of Personal Data.

C : To completely prevent the transfer of personal data out of the European Union.

D : To further reconcile the protection of the fundamental rights of individuals with the free flow of data from one member state to another.

Answer: D

Question 4

According to the Personal Data Protection Commission’s (PDPC) “Guide to basic data anonymization techniques,” recently adopted by the Spanish Data Protection Agency, which of the following is NOT a valid basic anonymization technique?

Options :

A : Swapping

B : Generalization

C : Data Adjustment.

D : Attribute Suppression.

Answer: C

Question 5

A data controller appoints a data protection officer. Which of the following conditions would NOT result in an infringement of Articles 37 to 39 of the GDPR?

Options :

A : If the data protection officer lacks ISO 27001 auditor certification

B : If the data protection officer is provided by the data processor.

C : If the data protection officer also manages the marketing budget.

D : If the data protection officer receives instructions from the data controller.

Answer: D

Smartly Prepare Exam with Free Online CIPP-E Practice Test

Buying Options: