QUESTION: 117

In the event of a data breach, which type of information are data controllers NOT required to provide to either the supervisory authorities or the data subjects?

The predicted consequences of the breach.
The measures being taken to address the breach.
The type of security safeguards used to protect the data.
The contact details of the appropriate data protection officer.

Answer(s): A

Explanation:

According to the CIPP/E study guide, Article 33 of the GDPR requires data controllers to notify the supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Article 34 of the GDPR requires data controllers to communicate the personal data breach to the data subject without undue delay when the breach is likely to result in a high risk to the rights and freedoms of natural persons. Both articles specify the minimum information that the data controller must provide to the supervisory authority and the data subject, which includes: the nature of the breach, the categories and approximate number of data subjects and personal data records concerned, the name and contact details of the data protection officer or other contact point, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its possible adverse effects. However, neither article requires the data controller to disclose the type of security safeguards used to protect the data, as this information is not relevant for the purposes of notification and may even compromise the security of the data further.

Reference:

1: CIPP/E study guide, page 84; Art. 33 GDPR; Guidelines 01/2021 on Examples regarding Data Breach Notification2: CIPP/E study guide, page 85; [Art. 34 GDPR]; Guidelines 01/2021 on Examples regarding Data Breach Notification3: Personal Data Breach | European Data Protection Supervisor; What is a data breach and what do we have to do ... - European Commission.

https://www.dataprotection.ie/en/organisations/know-your-obligations/data-protection- impact- assessments

Reveal Solution Next Question

QUESTION: 118

In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?

Where the DPIA identifies that personal data needs to be transferred to other countries outside of the EE
Where the DPIA identifies high risks to individuals' rights and freedoms that the controller can take steps to reduce.
Where the DPIA identifies that the processing being proposed collects the sensitive data of EU citizens.
Where the DPIA identifies risks that will require insurance for protecting its business interests.

Answer(s): B

Explanation:

According to the Free CIPP/E Study Guide, page 14, "if the DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, the controller shall consult the supervisory authority prior to the processing." This means that the controller must seek the advice of the supervisory authority when the DPIA identifies high risks that cannot be sufficiently reduced by the controller's own measures. The other options are not necessarily cases where the consultation is required, although they may trigger other obligations under the GDPR, such as obtaining a valid legal basis, providing adequate safeguards, or informing the data subjects.

Reference:

Free CIPP/E Study Guide, page 14
GDPR, Article 36

https://www.dataguidance.com/opinion/eu-how-when-and-why-carrying-out-dpia

Reveal Solution Next Question

QUESTION: 119

According to the GDPR, what is the main task of a Data Protection Officer (DPO)?

To create and maintain records of processing activities.
To conduct Privacy Impact Assessments on behalf of the controller or processor.
To monitor compliance with other local or European data protection provisions.
To create procedures for notification of personal data breaches to competent supervisory authorities.

Answer(s): B

Explanation:

According to Article 35 of the GDPR, the controller must carry out a data protection impact assessment (DPIA) prior to processing that is likely to result in a high risk to the rights and freedoms of natural persons. The DPIA is a process for assessing and mitigating the potential impact of the processing on the protection of personal data. The controller must seek the advice of the DPO, where designated, when carrying out a DPIA. The DPO can assist the controller in conducting the DPIA and ensuring its compliance with the GDPR requirements. The DPO can also monitor the performance of the DPIA and act as a contact point for the supervisory authority and the data subjects.

Reference:

Article 35 of the GDPR
European Data Protection Law & Practice textbook, Chapter 7: Data Protection Impact Assessment, Section 7.2: When is a DPIA required?, Subsection 7.2.1: The role of the DPO Roles and Responsibilities of a Data Protection Officer

https://digitalguardian.com/blog/what-data-protection-officer-dpo-learn-about-new- role-required- gdpr-compliance

Reveal Solution Next Question

QUESTION: 120

In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?

A medical organization that wants to begin genetic testing to support earlier research for which they have performed a DPI
A data controller who plans to use a new technology product that has already undergone a DPIA by the product's provider.
A marketing team that wants to collect mailing addresses of customers for whom they already have email addresses.
A railway operator who plans to evaluate the same video surveillance in all the train stations of his company.

Answer(s): D

Explanation:

According to the WP29 guidance on DPIA1, conducting a single DPIA to address multiple processing operations is allowed when the following conditions are met:
The processing operations present similar high risks, which would result in very similar mitigating measures;
The DPIA is reviewed and updated regularly to take into account any changes or new risks; The DPIA is complemented by ad hoc assessments where necessary to address more specific issues. The WP29 guidance cites the example of a railway operator who plans to evaluate the same video surveillance in all the train stations of his company as a case where a single DPIA would be sufficient, provided that the above conditions are met. The other options do not meet these conditions, as they involve different types of processing operations, different purposes, different data subjects, or different technologies.

Reference:

WP29 guidance on DPIA
WP29 guidance on DPIA, page 16

Reveal Solution Next Question

Free CIPP-E Exam Braindumps (page: 30)

QUESTION: 117

Explanation:

Reference:

QUESTION: 118

Explanation:

Reference:

QUESTION: 119

Explanation:

Reference:

QUESTION: 120

Explanation:

Reference: