CIPPE M10 – AllNet Law

This multiple choice assessment focuses on the new General Data Protection Regulation (GDPR).

The purpose of the assessment is to enable you to assess the extent and depth of your knowledge of the Data Protection Law in preparation for the DPL.

Format: Multiple Choice

Time: 90 minutes

The result will be provided immediately, with details on all questions.

Full Name

Email

1) Along with the name and contact details of the data controller processing the personal data, what other information must be included in the records of processing to be maintained by the data controller under the GDPR?

Retention period of each category of personal data, where possible.

Reason(s) for processing the personal data.

Third countries to which the information may be transferred.

All of the above

2) Which BEST describes data protection by ‘design and default’?

Employing a dedicated Data Protection Officer to ensure policies are in place.

Always using the best available security solution for any personal data.

Deploying appropriate technical and organisational measures to meet the GDPR principles.

Ensuring consent is always obtained when processing personal data.

3) Which of the following statements regarding Data Protection Officers (DPOs) is FALSE?

The DPO must report to the highest management level.

A DPO may perform additional job roles.

The DPO must be a permanent employee.

A DPO's role has a protected status.

4) If a multi-national company wanted to conduct background checks on all current and potential European-based employees, what key provision would the company have to follow?

Background checks on European employees are regulated under the GDPR and employers must comply with the guidance therein.

Background checks on European employees can be performed only after receiving explicit consent from all employees based in Europe.

Background checks on European employees will be regulated by data protection and employment laws in the appropriate member state.

Background checks on European employees are not allowed, but the company can create a list of ineligible individuals based on its legitimate interests.

5) In which of the following situations must a data protection impact assessment (DPIA) be used?

A clothing store wants to build aggregated metrics on the types of clothing their customers purchase by season.

A start-up company specialising in online gaming is using new technologies to build a new battleship game.

A bank is implementing surveillance cameras outside each of their buildings to help them identify possible bank thieves.

A pool company is implementing a new advertising campaign targeted to customers who have visited their store in the past 12 months.