CIPPE Module 8 – AllNet Law

This multiple choice assessment focuses on the General Data Protection Regulation (GDPR).

Enforcement and Penalties

Format: Multiple Choice

Time: 15 minutes

The result will be provided immediately, with details on all questions.

Full Name

Email

In which of the following cases would an organization MOST LIKELY be required to follow both ePrivacy and data protection rules?

When creating an untargeted pop-up ad on a website.

When calling a potential customer to notify her of an upcoming product sale.

When emailing a customer to announce that his recent order should arrive earlier than expected.

When paying a search engine company to give prominence to certain products and services within specific search results.

The e-Privacy Directive 2002/58/EC contains which provision?

Location data may be freely processed.

Unsolicited commercial telephone calls, emails and faxes need opt-out consent.

Corporate communication systems must have adequate security.

Cookies require prior information and consent.

Along with legitimacy, what is another condition that must be met when carrying out employee monitoring?

The monitoring must be in the public interest.

The monitoring must be limited to what is necessary for the purposes.

The monitoring must be under an employment contract.

The monitoring must be held to time constraints.

How is an employer obliged to proceed before engaging in the general monitoring of email traffic and internet use of all of its employees?

The employer must provide a prior opt-out option.

The employer must seek prior legal advice.

The employer must provide prior notice.

The employer must seek prior verbal consent.

Which is an example of direct marketing?

An email sent to an individual about an order she has placed for a book

An email sent to an individual promoting a new book which is on sale

A letter addressed to ‘the household’ about a charity bookstore

An advertisement on a website promoting a new book which is on sale

Which instrument could be used, or which treaty could be joined, by a non-European country that wanted to demonstrate an international commitment to implement data protection legislation and to provide protection of individuals with regard to automatic processing of personal data?

Directive 95/46/EC.

The Treaty of Lisbon.

The Council of Europe’s Convention 108.

Charter of Fundamental Rights of the European Union.

What should an organisation consider when determining appropriate periods for retaining personal data?

Whether the stated purpose for collecting the personal data still applies.

Whether the personal data is stored on premise or with a cloud storage provider.

Whether the personal data can be retained for an undetermined future use.

Whether there was a lawful basis for processing when the personal data was collected.