IAPP CIPP-E Exam Questions : Certified Information Privacy Professional/Europe (CIPP/E)

SCENARIO
Please use the following to answer the next question:
Gentle Hedgehog Inc. is a privately owned website design agency incorporated in Italy. The company has numerous remote workers in different EU countries. Recently, the management of Gentle Hedgehog noticed a decrease in productivity of their sales team, especially among remote workers. As a result, the company plans to implement a robust but privacy-friendly remote surveillance system to prevent absenteeism, reward top performers, and ensure the best quality of customer service when sales people are interacting with customers.
Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employee surveillance software whose European headquarters is in Germany. Sauron Eye's software provides powerful remote-monitoring capabilities, including 24/7 access to computer cameras and microphones, screen captures, emails, website history, and keystrokes. Any device can be remotely monitored from a central server that is securely installed at Gentle Hedgehog headquarters. The monitoring is invisible by default; however, a so-called Transparent Mode, which regularly and conspicuously notifies all users about the monitoring and its precise scope, also exists. Additionally, the monitored employees are required to use a built-in verification technology involving facial recognition each time they log in.
After fixing the privacy problems, how long may Gentle Hedgehog store the monitoring data, assuming that no valid data erasure request is received?
.

• A. As long as provided by the EDPB guidelines for remote employee monitoring.
• B. As long as required by the company's legitimate interests.
• C. As long as stated in the privacy policy that all employees must follow when processing personal data.
• D. As long as a concerned employee does not request erasure of the data.

Which of the following is NOT a role of works councils?

• A. Determining the monetary fines to be levied against employers for data breach violations of employee data.
• B. Determining whether to approve or reject certain decisions of the employer that affect employees.
• C. Determining what changes will affect employee working conditions.
• D. Determining whether employees' personal data can be processed or not.

In which of the following cases would an organization MOST LIKELY be required to follow both ePrivacy and data protection rules?

• A. When calling a potential customer to notify her of an upcoming product sale.
• B. When creating an untargeted pop-up ad on a website.
• C. When emailing a customer to announce that his recent order should arrive earlier than expected.
• D. When paying a search engine company to give prominence to certain products and services within specific search results.

In its Guidelines 01/2021 on Examples regarding Personal Data Breach Notification, the EDPB classifies a ransomware attack as a breach primarily of?

• A. Integrity.
• B. Confidentiality.
• C. Availability.
• D. Resilience.

An entity's website stores text files on EU users' computer and mobile device browsers. Prior to doing so, the entity is required to provide users with notices containing information and consent under which of the following frameworks?

• A. Data Protection Directive 95/46/EC.
• B. General Data Protection Regulation 2016/679.
• C. E-Privacy Directive 2002/58/EC.
• D. E-Commerce Directive 2000/31/EC.