QUESTION: 73

What is the MAIN reason GDPR Article 4(22) establishes the concept of the "concerned supervisory authority"?

To encourage the consistency of local data processing activity.
To give corporations a choice about who their supervisory authority will be.
To ensure the GDPR covers controllers that do not have an establishment in the EU but have a representative in a member state.
To ensure that the interests of individuals residing outside the lead authority's jurisdiction are represented.

Answer(s): D

Explanation:

According to GDPR Article 4(22), a supervisory authority is concerned by the processing of personal data if the data subjects residing in its member state are substantially affected or likely to be substantially affected by the processing, or if a complaint has been lodged with it. This concept is mainly introduced to ensure that the rights and interests of data subjects are protected by the supervisory authorities that are closest to them, regardless of where the controller or processor is established or where the lead supervisory authority is located. The concerned supervisory authorities have the right to participate in the one-stop-shop and consistency mechanisms, and to express their views and objections on the draft decisions of the lead supervisory authority. They also have the duty to cooperate and assist each other in the performance of their tasks.

Reference:

GDPR Article 4(22), GDPR Article 60, GDPR Article 63, The role of the 'supervisory authority concerned' (Chapter 3.1 ...

Reveal Solution Next Question

QUESTION: 74

Which area of privacy is a lead supervisory authority's (LSA) MAIN concern?

Data subject rights
Data access disputes
Cross-border processing
Special categories of data

Answer(s): C

Explanation:

A lead supervisory authority (LSA) is the main point of contact for organisations that process personal data across multiple EU member states. The LSA is responsible for coordinating cross- border investigations, issuing binding decisions, and enforcing GDPR compliance. Cross-border processing is the main concern of the LSA, as it involves data processing activities that affect data subjects in more than one member state, or that take place in more than one member state. The other options are not the main concern of the LSA, as they are either covered by the national supervisory authorities of each member state, or are not specific to cross-border processing.

Reference:

Is it possible to choose your lead supervisory authority under the GDPR?, Art. 56 GDPR Competence of the lead supervisory authority, Navigating GDPR Compliance with a Lead Supervisory Authority, Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority

https://iapp.org/news/a/is-it-possible-to-choose-your-lead-supervisory-authority-under- the-gdpr/

Reveal Solution Next Question

QUESTION: 75

If a multi-national company wanted to conduct background checks on all current and potential employees, including those based in Europe, what key provision would the company have to follow?

Background checks on employees could be performed only under prior notice to all employees.
Background checks are only authorized with prior notice and express consent from all employees including those based in Europe.
Background checks on European employees will stem from data protection and employment law, which can vary between member states.
Background checks may not be allowed on European employees, but the company can create lists based on its legitimate interests, identifying individuals who are ineligible for employment.

Answer(s): C

Explanation:

The GDPR does not explicitly regulate background checks, but it does apply to the processing of personal data that may be obtained or used during such checks. Therefore, the company must comply with the GDPR principles, such as lawfulness, fairness, transparency, data minimization, purpose limitation, accuracy, storage limitation, integrity and confidentiality, and accountability. The company must also identify a lawful basis for processing personal data, such as legal obligation, legitimate interest, or consent, and respect the data subject rights, such as the right to information, access, rectification, erasure, restriction, objection, and portability. Moreover, the company must be aware of the specific rules and restrictions regarding the processing of special categories of data (such as biometric, health, or political data) and data relating to criminal convictions and offences, which are subject to Article 10 of the GDPR and the laws of each member state. The company must also consider the national employment laws and the guidelines of the relevant supervisory authorities, which may impose additional conditions or limitations on the scope, methods, and purposes of background checks. For example, some member states may require prior authorization,

notification, or consultation with the supervisory authority, the data subject, or the works council before conducting background checks. Some member states may also prohibit or restrict certain types of background checks, such as social media screening, credit checks, or criminal record checks, unless they are necessary, proportionate, and relevant for the specific job position or sector. Therefore, the company must conduct a thorough assessment of the legal framework and the risks and benefits of background checks in each member state where it operates or recruits employees, and ensure that it has a clear and consistent policy and procedure for conducting background checks in a GDPR-compliant manner.

Reference:

How to `background check' under the GDPR, How to perform GDPR compliant background checks, GDPR and the processing of criminal conviction data across Europe, Pre-employment vetting: Data protection and criminal records, How GDPR Affects Background Checking

https://www.shrm.org/resourcesandtools/tools-and-samples/toolkits/pages/ conductingbackgroundinvestigations.aspx

Reveal Solution Next Question

QUESTION: 76

Why is advisable to avoid consent as a legal basis for an employer to process employee data?

Employee data can only be processed if there is an approval from the data protection officer.
Consent may not be valid if the employee feels compelled to provide it.
An employer might have difficulty obtaining consent from every employee.
Data protection laws do not apply to processing of employee data.

Answer(s): B

Explanation:

According to the GDPR, consent must be freely given, specific, informed and unambiguous. However, in the context of employment, there is often an imbalance of power between the employer and the employee, which may affect the validity of consent. The employee may feel pressured or coerced to give consent, or may not be able to withdraw it without negative consequences. Therefore, consent is not a reliable or appropriate legal basis for processing employee data in most cases. The employer should consider other lawful bases, such as contractual necessity, legal obligation, legitimate interests or specific conditions for special category data.

Reference:

1 Art. 4 (11) GDPR Definitions - General Data Protection Regulation (GDPR)2 Can my employer require me to give my consent to use my personal data? | European Commission. 3 When is consent appropriate? | ICO. 4 Art. 6 (1) GDPR Lawfulness of processing -

General Data Protection Regulation (GDPR)5 Art. 9 (2) GDPR Processing of special categories of personal data - General Data Protection Regulation (GDPR).

Reveal Solution Next Question

Free CIPP-E Exam Braindumps (page: 19)

QUESTION: 73

Explanation:

Reference:

QUESTION: 74

Explanation:

Reference:

QUESTION: 75

Explanation:

Reference:

QUESTION: 76

Explanation:

Reference: