Question No : 1
SCENARIO
Please use the following to answer the next question:
Dynaroux Fashion (‘Dynaroux’) is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Ronan is their recently appointed data protection officer, who oversees the company’s compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jonas, the CEO, tells Ronan that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company’s customers by analyzing their purchases. Ronan tells the CEO that: (a) the potential risks of such activities means that Dynaroux needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Dynaroux may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jonas tells Ronan that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Dynaroux’s business plan and associated processing activities.
Which of the following facts about Dynaroux would trigger a data protection impact assessment under the GDPR?

• A.The company will be undertaking processing activities involving sensitive data categories such as financial and children’s data.
• B.The company employs approximately 650 people and will therefore be carrying out extensive processing activities.
• C.The company plans to undertake profiling of its customers through analysis of their purchasing patterns.
• D.The company intends to shift their business model to rely more heavily on online shopping.

Show Answers

Answer:

Question No : 2
Which of the following is NOT a role of works councils?

• A.Determining the monetary fines to be levied against employers for data breach violations of employee data.
• B.Determining whether to approve or reject certain decisions of the employer that affect employees.
• C.Determining whether employees’ personal data can be processed or not.
• D.Determining what changes will affect employee working conditions.

Show Answers

Answer:

Question No : 3
What is true of both the General Data Protection Regulation (GDPR) and the Council of Europe Convention 108?

• A.Both govern international transfers of personal data
• B.Both govern the manual processing of personal data
• C.Both only apply to European Union countries
• D.Both require notification of processing activities to a supervisory authority

Show Answers

Answer:
Explanation:
Reference: https://rm.coe.int/090000168093b851

Question No : 4
SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees’ computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees’ computers.
Since these measures would potentially impact employees, Building Block’s Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees’ computers activity and their location. During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company’s computers, and from working remotely without authorization.
In addition to notifying employees about the purpose of the monitoring, the potential uses of their data and their privacy rights, what information should Building Block have provided them before implementing the security measures?

• A.Information about what is specified in the employment contract.
• B.Information about who employees should contact with any queries.
• C.Information about how providing consent could affect them as employees.
• D.Information about how the measures are in the best interests of the company.

Show Answers

Answer:

Question No : 5
What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?

• A.ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.
• B.CJEU can force national governments to implement and honor EU law, while the ECHR cannot.
• C.CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.
• D.ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.

Show Answers

Answer:

Question No : 6
A company in France suffers a robbery over the weekend owing to a faulty alarm system. When it is determined that the break-in involves the loss of a substantial amount of data, the company decides on a CCTV system to monitor for future incidents. Company technicians install cameras in the entrance of the building, hallways and offices. Footage is recorded continuously, and is monitored by the home office in the United States.
What is the most realistic step the company could take to address their security concerns and comply with the personal data processing principles set out in Article 5 of the GDPR?

• A.Seek informed consent from company employees.
• B.Have cameras recording during work hours only.
• C.Retain captured footage for no more than 30 days.
• D.Restrict camera placement to building entrances only.

Show Answers

Answer:

Question No : 7
An employee of company ABCD has just noticed a memory stick containing records of client data, including their names, addresses and full contact details has disappeared. The data on the stick is unencrypted and in clear text. It is uncertain what has happened to the stick at this stage, but it likely was lost during the travel of an employee.
What should the company do?

• A.Notify as soon as possible the data protection supervisory authority that a data breach may have taken place.
• B.Launch an investigation and if nothing is found within one month, notify the data protection supervisory authority.
• C.Invoke the “disproportionate effort” exception under Article 33 to postpone notifying data subjects until more information can be gathered.
• D.Immediately notify all the customers of the company that their information has been accessed by an unauthorized person.

Show Answers

Answer:

Question No : 8
Which of the following countries will continue to enjoy adequacy status under the GDPR, pending any future European Commission decision to the contrary?

• A.Greece
• B.Norway
• C.Australia
• D.Switzerland

Show Answers

Answer:
Explanation:
Reference: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

Question No : 9
What is the key difference between the European Council and the Council of the European Union?

• A.The Council of the European Union is helmed by a president.
• B.The Council of the European Union has a degree of legislative power.
• C.The European Council focuses primarily on issues involving human rights.
• D.The European Council is comprised of the heads of each EU member state.

Show Answers

Answer:
Explanation:
Reference: https://www.quora.com/What-is-the-difference-between-the-European-Council-the-Council-of-the-European-Union-and-the-Council-of-Europe

Question No : 10
SCENARIO
Please use the following to answer the next question:
WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of their service, WonderKids will pass all personal data provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person booking the childcare, address and contact details, as well as information about the children to be cared for including name, age, gender and health information. The privacy statement on Wonderkids’ website states the following:
“WonderkKids provides the information you disclose to us through this website to your childcare provider for scheduling and health and safety reasons. We may also use your and your child’s personal information for our own legitimate business purposes and we employ a third-party website hosting company located in Switzerland to store the data. Any data stored on equipment located in Switzerland meets the European Commission provisions for guaranteeing adequate safeguards for you and your child’s personal information. We will only share you and your child’s personal information with businesses that we see as adding real value to you. By providing us with any personal data, you consent to its transfer to affiliated businesses and to send you promotional offers.”
“We may retain you and your child’s personal information for no more than 28 days, at which point the data will be depersonalized, unless your personal information is being used for a legitimate business purpose beyond 28 days where it may be retained for up to 2 years.”
“We are processing you and your child’s personal information with your consent. If you choose not to provide certain information to us, you may not be able to use our services. You have the right to: request access to you and your child’s personal information; rectify or erase you or your child’s personal information; the right to correction or erasure of you and/or your child’s personal information; object to any processing of you and your child’s personal information. You also have the right to complain to the supervisory authority about our data processing activities.”
What must the contract between WonderKids and the hosting service provider contain?

• A.The requirement to implement technical and organizational measures to protect the data.
• B.Controller-to-controller model contract clauses.
• C.Audit rights for the data subjects.
• D.A non-disclosure agreement.

Show Answers

Answer: