QUESTION: 9

Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?

The European Parliament
The European Commission
The Article 29 Working Party
The European Council

Answer(s): B

Explanation:

According to Article 45 of the GDPR, the European Commission has the power to determine, on the basis of an assessment, whether a non-EU country, a territory or a sector within that country, or an international organisation ensures an adequate level of data protection. This means that the data protection rules and standards in that country or organisation are equivalent to those in the EU. The effect of an adequacy decision is that personal data can flow freely from the EU to that country or organisation without any further safeguards or authorisations. The European Commission has adopted adequacy decisions for several countries and organisations, such as Japan, Canada, and the EU-US Data Privacy Framework.

Reference:

Data protection adequacy for non-EU countries, Adequate Level of Protection

Reveal Solution Next Question

QUESTION: 10

What is true of both the General Data Protection Regulation (GDPR) and the Council of Europe Convention 108?

Both govern international transfers of personal data
Both govern the manual processing of personal data
Both only apply to European Union countries
Both require notification of processing activities to a supervisory authority

Answer(s): D

Explanation:

The GDPR and the Convention 108 are two important data protection instruments that aim to protect the rights and freedoms of individuals with regard to their personal data. They both have some similarities and some differences, but one common feature is that they both require notification of processing activities to a supervisory authority.
A supervisory authority is an independent public body that monitors and enforces compliance with data protection laws. In the EU, there are 47 national data protection authorities (DPAs) that have the power to impose administrative fines, issue guidelines, conduct investigations, and cooperate with other authorities. In the Council of Europe, there are 54 parties to the Convention 108 that have established their own supervisory authorities or have agreed to be supervised by an external authority.
Notification of processing activities is a requirement for any controller or processor of personal data that falls under the scope of the GDPR or the Convention 108. A controller is a natural or legal person who determines the purposes and means of the processing of personal data. A processor is a natural or legal person who processes personal data on behalf of a controller. Notification means informing the supervisory authority about certain aspects of the processing, such as:

The identity and contact details of the controller and processor The categories and sources of personal data
The purposes and legal basis for processing
The recipients or categories of recipients of personal data The retention period or criteria for determining it
The existence of any automated decision-making or profiling The rights of data subjects and how they can exercise them Notification can be done in various ways, such as:
Submitting a written notification form
Publishing a notice on a website or other platform
Sending an email or other electronic message
Using an online system or portal
Notification should be done as soon as possible after becoming aware of any relevant information about the processing. It should also be updated whenever there are significant changes in relation to the processing.
Therefore, both the GDPR and the Convention 108 require notification of processing activities to a supervisory authority. This is one way to ensure transparency, accountability, and compliance with data protection laws.

Reference:

https://rm.coe.int/090000168093b851

Reveal Solution Next Question

QUESTION: 11

Which aspect of the GDPR will likely have the most impact on the consistent implementation of data protection laws throughout the European Union?

That it essentially functions as a one-stop shop mechanism
That it takes the form of a Regulation as opposed to a Directive
That it makes notification of large-scale data breaches mandatory
That it makes appointment of a data protection officer mandatory

Answer(s): B

Explanation:

One of the main differences between a Regulation and a Directive in the EU law is that a Regulation is directly applicable and binding in all EU member states, without the need for national implementing measures, while a Directive sets out the objectives and principles that the member states must achieve, but leaves them the choice of form and methods to transpose it into their national laws. Therefore, by taking the form of a Regulation, the GDPR aims to harmonize and unify the data protection rules across the EU, and to ensure a consistent implementation and enforcement of the data protection laws throughout the EU. The other aspects of the GDPR listed in the question, such as the one-stop shop mechanism, the mandatory notification of large-scale data breaches, and the mandatory appointment of a data protection officer, are also important features of the GDPR, but they do not have the same impact on the consistency of the data protection laws as the form of a Regulation.

Reference:

Difference between A Regulation And Directive (European Law)1; EUR-Lex - 310401_2 -

EN - EUR-Lex2; EU GDPR vs. European Data Protection Directive 95/46/EC - Advisera3; Difference between GDPR and Data Protection Directive - Profolus

Reveal Solution Next Question

QUESTION: 12

How is the retention of communications traffic data for law enforcement purposes addressed by European data protection law?

The ePrivacy Directive allows individual EU member states to engage in such data retention.
The ePrivacy Directive harmonizes EU member states' rules concerning such data retention.
The Data Retention Directive's annulment makes such data retention now permissible.
The GDPR allows the retention of such data for the prevention, investigation, detection or prosecution of criminal offences only.

Answer(s): B

Explanation:

The ePrivacy Directive is a European Union (EU) directive that aims to protect the confidentiality of electronic communications and prevent their indiscriminate interception or monitoring. It was adopted in 2002 and amended in 2009. It applies to all providers of electronic communication services, such as internet service providers, mobile network operators, and online platforms. One of the main objectives of the ePrivacy Directive is to ensure that the retention of communications traffic data for law enforcement purposes is subject to strict conditions and safeguards. Communications traffic data refers to any information relating to the transmission or routing of electronic communications, such as IP addresses, timestamps, and metadata. Such data can be used by competent national authorities for the prevention, investigation, detection or prosecution of criminal offences and safeguarding national security. However, the ePrivacy Directive does not allow individual EU member states to engage in such data retention without harmonizing their rules. Article 6(1)(b) of the directive states that "Member States shall ensure that any measures taken by them in relation to the retention of traffic data are consistent with this Directive". Therefore, each EU member state must adopt a national law that complies with the requirements and limitations set by the directive. The Data Retention Directive (DRD) was a previous EU directive that aimed to establish a common framework for the retention of communications traffic data for law enforcement purposes across all

EU member states. It was adopted in 2006 and amended in 2010. However, it was annulled by the Court of Justice of the European Union (CJEU) in 2014 on procedural grounds. The CJEU found that some provisions of the DRD were inconsistent with other EU directives and principles, such as Article 8(2) of the Charter of Fundamental Rights (CFR), which protects individuals from arbitrary interference with their privacy.
The GDPR is a new EU regulation that implements some aspects of the DRD into national law through its provisions on processing personal data. However, it does not address directly the issue of communications traffic data retention for law enforcement purposes. Instead, it requires providers to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk involved in processing personal data. These measures include encryption, pseudonymisation, access control, and accountability7 . The GDPR also grants individuals certain rights regarding their personal data, such as access, rectification, erasure, portability, and objection7 .
Therefore, under current EU law, there is no single legal basis for retaining communications traffic data for law enforcement purposes across all EU member states. Each member state must adopt its own national law that respects the principles and limitations established by the ePrivacy Directive.

Reference:

ePrivacy Directive ePrivacy Regulation
What is Communications Traffic Data?
How is Communications Traffic Data Retained?
Data Retention Directive
Data Retention Directive annulled by CJEU
General Data Protection Regulation
What are your rights regarding your personal data?

https://www.law.kuleuven.be/citip/en/archive/copy_of_publications/440retention-of- traffic-data- dumortier-goemans2f90.pdf (9)

Reveal Solution Next Question

Free CIPP-E Exam Braindumps (page: 3)

QUESTION: 9

Explanation:

Reference:

QUESTION: 10

Explanation:

Reference:

QUESTION: 11

Explanation:

Reference:

QUESTION: 12

Explanation:

Reference: