QUESTION: 49

WP29's "Guidelines on Personal data breach notification under Regulation 2016/679'' provides examples of ways to communicate data breaches transparently.
Which of the following was listed as a method that would NOT be effective for communicating a breach to data subjects?

A postal notification
A direct electronic message
A notice on a corporate blog
A prominent advertisement in print media

Answer(s): C

Explanation:

According to the WP29's "Guidelines on Personal data breach notification under Regulation 2016/679'', the communication of a personal data breach to the data subjects should be clear, concise, transparent, easily accessible and understandable, and use clear and plain language. The communication should also be made as soon as reasonably feasible and in close cooperation with the supervisory authority. The guidelines provide some examples of methods that may be effective for communicating a breach to data subjects, such as a direct electronic message (e.g. email, SMS, direct message), a postal notification, a prominent advertisement in print media, or a notice on the homepage of the affected website. However, the guidelines also state that a notice on a corporate blog or social media would not be an effective method of communication, as it would not reach all the affected data subjects and would not allow them to take immediate action to protect themselves. Therefore, the correct answer is C. A notice on a corporate blog.

Reference:

WP29's "Guidelines on Personal data breach notification under Regulation 2016/679'', pages 20-211

https://www.google.com/url?
sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwih19CSx9LqAhVQe8AKHe- VDQEQFjAAegQIAhAB&url=https%3A%2F%2Fec.europa.eu%2Fnewsroom%2Farticle29%2Fdocument .cfm% 3Fdoc_id%3D49827&usg=AOvVaw2uhYsKyRzJ6lwhQyiMURJF (21)

Reveal Solution Next Question

QUESTION: 50

Which of the following would require designating a data protection officer?

Processing is carried out by an organization employing 250 persons or more.
Processing is carried out for the purpose of providing for-profit goods or services to individuals in the EU.
The core activities of the controller or processor consist of processing operations of financial information or information relating to children.
The core activities of the controller or processor consist of processing operations that require systematic monitoring of data subjects on a large scale.

Answer(s): D

Explanation:

According to Article 37 of the GDPR, the designation of a data protection officer (DPO) is mandatory for controllers and processors in three cases1:
When the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
When the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
When the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.

The GDPR does not define what constitutes "regular and systematic monitoring" or "large scale", but the Article 29 Working Party (now replaced by the European Data Protection Board) has provided some guidance on these concepts. According to the guidance, "regular and systematic monitoring" includes all forms of tracking and profiling on the internet, including for the purposes of behavioural advertising, but also offline activities such as CCTV or health data monitoring. The guidance also suggests some criteria to assess whether the processing is carried out on a large scale, such as the number of data subjects concerned, the volume of data or the range of data items processed, the duration or permanence of the processing activity, and the geographical extent of the processing. In the given scenario, option D is the only one that clearly falls under the second case of mandatory DPO designation, as it implies that the controller or processor is engaged in regular and systematic monitoring of data subjects on a large scale as part of their core activities. This could include, for example, online behavioural advertising, location tracking, loyalty programs, or health data analytics. The other options are not sufficient to trigger the obligation to appoint a DPO, unless they are combined with other factors that indicate a large scale or a high risk of the processing. For instance, option A is not relevant, as the GDPR does not set a threshold based on the size or number of employees of the organisation. Option B is also not decisive, as the GDPR does not distinguish between for-profit or non-profit purposes of the processing. Option C may require a DPO if the processing of financial information or information relating to children is done on a large scale and involves special categories of data, but it is not a general rule.

Reference:

1: Article 37 of the GDPR
2: Guidelines on Data Protection Officers (`DPOs')
3: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
4: https://edpb.europa.eu/sites/edpb/files/files/file1/wp243rev01_en.pdf
5: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
6: [https://edpb.europa.eu/sites/edpb/files/files/file1/wp243rev01_en.pdf]
7: [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679]

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data- protection- regulation-gdpr/accountability-and-governance/data-protection-officers/

Reveal Solution Next Question

QUESTION: 51

Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?

The group of undertakings must obtain approval from a supervisory authority.
The group of undertakings must be comprised of organizations of similar sizes and functions.
The data protection officer must be located in the country where the data controller has its main establishment.
The data protection officer must be easily accessible from each establishment where the undertakings are located.

Answer(s): D

Explanation:

According to Article 37(2) of the GDPR, a group of undertakings may appoint a single data protection officer (DPO) provided that the DPO is easily accessible from each establishment. This means that the DPO should be able to communicate effectively with the data subjects and the supervisory authorities in the relevant languages and jurisdictions, and to perform the tasks referred to in Article 39 of the GDPR34. The accessibility of the DPO does not necessarily depend on the physical location of the DPO, but rather on the availability of the DPO to the relevant stakeholders via various means of communication. Therefore, the DPO does not have to be located in the country where the data controller has its main establishment, nor does the group of undertakings have to obtain approval from a supervisory authority or be comprised of organizations of similar sizes and functions to appoint a single DPO.

Reference:

CIPP/E Certification - International Association of Privacy Professionals, Free CIPP/E Study Guide - International Association of Privacy Professionals, GDPR - EUR-Lex, What's different about a group data protection officer?, Data Protection Officers: What US Companies Need to Know - Cooley

https://www.privacy-regulation.eu/en/article-37-designation-of-the-data-protection- officer- GDPR.htm

Reveal Solution Next Question

QUESTION: 52

What obligation does a data controller or processor have after appointing a data protection officer?

To ensure that the data protection officer receives sufficient instructions regarding the exercise of his or her defined tasks.
To provide resources necessary to carry out the defined tasks of the data protection officer and to maintain his or her expert knowledge.
To ensure that the data protection officer acts as the sole point of contact for individuals' Questions: about their personal data.
To submit for approval to the data protection officer a code of conduct to govern organizational practices and demonstrate compliance with data protection principles.

Answer(s): B

Explanation:

According to the UK GDPR, the controller and the processor must support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge. The controller and the processor must also ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks and that he or she reports directly to the highest management level of the controller or the processor.

Reference:

https://www.i-scoop.eu/gdpr/data-controller-data-controller-duties/

Reveal Solution Next Question

Free CIPP-E Exam Braindumps (page: 13)

QUESTION: 49

Explanation:

Reference:

QUESTION: 50

Explanation:

Reference:

QUESTION: 51

Explanation:

Reference:

QUESTION: 52

Explanation:

Reference: