Short Practice

This multiple choice assessment focuses on the new General Data Protection Regulation (GDPR).

The purpose of the assessment is to enable you to assess the extent and depth of your knowledge of the Data Protection Law in preparation for the CIPP-E.

Format: Multiple Choice

Time: 90 minutes

The result will be provided immediately, with details on all questions.

Full Name

Email

5) Which statement describes a European best practices approach to the protection of employment data held by an organisation?

Employers should avoid all types of monitoring when collecting employee information within the workplace.

Organisations should seek legal advice from a privacy lawyer before processing employee data.

Employee data should not be processed without expressed, verbal permission by the employee.

Employers should consult with regulatory bodies such as works councils about proposed data processing activity.

12) Under the GDPR, would a European company be allowed to use video surveillance to monitor employee access to inventory?

No, under the GDPR this is never allowed.

No, video surveillance is too intrusive a solution.

Yes, provided that certain conditions have been met.

Yes, without any further conditions to be taken into account.

13) Which institution is responsible for ensuring that directives are implemented properly by the member states?

European Court of Justice

European Commission

European Parliament

European Data Protection Supervisor

14) What is true for a contract based on European Commission (EC) Standard Contractual Clauses with a processor outside the European Economic Area?

For subcontracting, the processor must inform the controller and obtain written approval.

Before the processing starts, the processor must provide proof of compliance with technical and organisational measures.

The data subject must consent to processing by the processor.

The processor must provide a compliance statement from its data protection authority.

15) Which type of data subject is NOT covered by the GDPR?

newborn children

persons under 18

persons over 65

deceased individuals

16) Use the following scenario to answer questions 16-18:

Rob, a former employee of the Tea & Biscuits Corporation (a U.S.-based multi-national) has hand-delivered a letter to the Reception of the Irish Subsidiary, on May 1. Rob asked for a copy of all data that Tea & Biscuits Corporation holds about him from the start of his employment with them over 18 years ago, including all email correspondence about him from his past three managers, and anyone from the HR Department. Rob has included a copy of his passport, his old employee identification number, and his current address.

One of Rob's previous managers was made redundant at the same time as Rob; another has re-located to Tea & Biscuits Singapore office. The receptionist was not sure what to do with the letter, so she sent it via internal mail to the Facilities Manager who was out of the office on holiday until May 5. The Facilities Manager sent it to the HR Manager who is very busy on a new redundancy program. The HR Manager emailed the legal team to ask what he should do with the letter on May 21. The local Irish lawyers got back to the HR Manager on May 25 and suggested that the HR Manager get in touch with Rob immediately and tell him that his issue has been looked into.

Question:
What should Tea & Biscuits do before responding to Rob with the information he has requested?

Make sure that no U.S. data protection laws will be violated before sending any information.

Take into account GDPR compliance before sending any information. Then contact Rob ‘without undue delay’ to clarify any questions about the SAR and let him know the SAR is being processed.

Consult with a security lawyer before sending any information.

Wait for advice from the Irish Data Protection Authority before sending any information.

17) Use the following scenario to answer questions 16-18:

Rob, a former employee of the Tea & Biscuits Corporation (a U.S.-based multi-national) has hand-delivered a letter to the Reception of the Irish Subsidiary, on May 1. Rob asked for a copy of all data that Tea & Biscuits Corporation holds about him from the start of his employment with them over 18 years ago, including all email correspondence about him from his past three managers, and anyone from the HR Department. Rob has included a copy of his passport, his old employee identification number, and his current address.

One of Rob's previous managers was made redundant at the same time as Rob; another has re-located to Tea & Biscuits Singapore office. The receptionist was not sure what to do with the letter, so she sent it via internal mail to the Facilities Manager who was out of the office on holiday until May 5. The Facilities Manager sent it to the HR Manager who is very busy on a new redundancy program. The HR Manager emailed the legal team to ask what he should do with the letter on May 21. The local Irish lawyers got back to the HR Manager on May 25 and suggested that the HR Manager get in touch with Rob immediately and tell him that his issue has been looked into.

Question:
What is the time period within which Tea & Biscuits Corporation needs to respond to the data subject?

within a month of having received the request

within six months of having received the request

without undue delay or within a month of receiving the request

three months after they have authenticated the identity of the requestor

18) Use the following scenario to answer questions 16-18:

Rob, a former employee of the Tea & Biscuits Corporation (a U.S.-based multi-national) has hand-delivered a letter to the Reception of the Irish Subsidiary, on May 1. Rob asked for a copy of all data that Tea & Biscuits Corporation holds about him from the start of his employment with them over 18 years ago, including all email correspondence about him from his past three managers, and anyone from the HR Department. Rob has included a copy of his passport, his old employee identification number, and his current address.

One of Rob's previous managers was made redundant at the same time as Rob; another has re-located to Tea & Biscuits Singapore office. The receptionist was not sure what to do with the letter, so she sent it via internal mail to the Facilities Manager who was out of the office on holiday until May 5. The Facilities Manager sent it to the HR Manager who is very busy on a new redundancy program. The HR Manager emailed the legal team to ask what he should do with the letter on May 21. The local Irish lawyers got back to the HR Manager on May 25 and suggested that the HR Manager get in touch with Rob immediately and tell him that his issue has been looked into.

Question:
What should Tea & Biscuits do next to respond to Rob's request for email?

Nothing. Email does not need to be provided in response to a subject access request under the local Irish Data Protection law.

The HR Manager should ask employees who still work at Tea & Biscuits if they have any email correspondence with Rob in their possession.

Conduct an email search in accordance with its monitoring policy and inform affected employees before any disclosures to Rob.

HR should provide Rob the information he requested. There are only 5 days left and no need to get other employees’ consent because the emails are all work related not personal.

19) Which of the following is not covered in the 3-part test of the Legitimate Interest Assessment?

The purpose test

The complexity test

The necessity test

The balancing test

20) How is an employer obliged to proceed before engaging in the general monitoring of email traffic and internet use of all of its employees?

The employer must provide a prior opt-out option.

The employer must seek prior legal advice.

The employer must provide prior notice.

The employer must seek prior verbal consent.

21) Which is NOT a compatible purpose for processing data beyond the purpose originally specified at the time of collection?

performance of a contract

transferring data to an archive

statistical purposes

historical or scientific research

22) Along with legitimacy, what is another condition that must be met when carrying out employee monitoring?

The monitoring must be in the public interest.

The monitoring must be limited to what is necessary for the purposes.

The monitoring must be under an employment contract.

The monitoring must be held to time constraints.

23) Which is an example of cloud computing?

a software package installed on a laptop

a web-based email platform

a portable mass storage device

a single web-server

24) According to the GDPR, the right to data portability applies:

when the processing was based on a public interest

when processing was originally based on the user’s consent

when the processing was done through ‘manual means’

when the processing was based on the controller’s legitimate interests

25) The collection is part of a historical research initiative. Which is the most accurate statement concerning the obligations imposed by the GDPR?

As a Regulation rather than a Directive, the GDPR sets forth binding provisions for EU member states to follow without discretion.

The GDPR provides a framework which member states can choose to use as a basis for national legislation.

As a Regulation rather than a Directive, the GDPR sets forth binding provisions for EU member states to follow but it leaves them discretion in some areas.

The GDPR imposes binding obligations on all EU member states as well as on all countries deemed ‘adequate’ by the European Commission.

26) Which of the following will NOT be considered as direct marketing?

messages sent to individuals to inform them about something such as the order they have placed

messages sent to individuals to inform them about something such as an update to the company's privacy policy

mailings send out to companies without contact persons being mentioned

All of the above

27) Which, according to the GDPR, is NOT one of the considerations that should be taken into account to determine the appropriate technical and organisational measures to ensure a level of data security appropriate to the risk?

costs of implementation

the state of the art

scope of processing

the size of the organisation

28) Which is NOT a special category of data?

political affiliation

health information

ethnic origin

Social Security number

29) Which institution has the power to adopt adequacy findings for the European Union?

Working Party 29

European Commission

European Data Protection Supervisor

European Court of Justice

30) Which exemption to the e-Privacy Directive 2002/58/EC allows the data controller to send electronic marketing information?

The recipients are existing customers.

The controller is a non-profit organisation.

The data subject and controller work in the same industry.

The recipient’s email address is taken from a public register.

31) Which of the following is NOT one of the cases where Processors and Controllers must appoint a DPO?

the processing is carried out by a public authority or body, except for courts acting in their judicial capacity

the processing is carried out by a controller or processor with over 250 employees and large scale of data, up to 5000 records

the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale

the core activities of the controller or the processor consist of processing on a large scale of special categories

32) According to the Treaty of Lisbon, the majority of EU legislation cannot be adopted without the approval of which two European Institutions?

European Council and European Parliament.

European Commission and European Parliament.

European Parliament and Council of the European Union.

European Commission and the Court of Justice of the European Union.

33) When would a data subject have the right to require the erasure of his or her data without undue delay?

When erasure is in the public interest.

When the controller is a public authority.

When the processing is carried out by automated means.

When the data is no longer necessary for its original purpose.

34) In which case should a data subject’s consent be regarded as freely given under the GDPR?

If the data subject is able to withdraw consent without detriment.

If the data subject is informed that opting out requires an affirmative action.

If the data subject has been given a sufficient deadline for providing consent.

If the data subject has been offered a consent agreement tailored to his situation.

35) Which of the following lists the attribute of security controls?

Backup, Resilience, Availability, Integrity

Minimisation, Confidentiality, Integrity, Limitation

Confidentiality, Integrity, Availability, Resilience

None of the above

36) An online furniture store requires customers to consent to their details being shared with other homeware stores as part of the checkout process. The store is making consent a condition of sale – in order to share the data with other stores, which is not necessary for that sale.

This means consent:

Consent is freely given

Consent is not freely given

Consent is implied

Consent is valid

37) Which of the following is a responsibility of the European Data Protection Board?

Make available Model Contractual Clauses to Data Subjects

Provide the Union with the necessary impetus for its development and shall define the general political directions and priorities thereof

Ensure the consistent application of the EU GDPR across the EU

Exercise legislative functions over the Supervisory Authorities

38) Which of the following is not part of the responsibilities of a Local Data Protection Supervisory Authority?

make decisions on the application of the EU GDPR, which are binding on those supervisory authorities

handling complaints lodged by a data subject

conducting investigations on the application of this Regulation

promoting public awareness of the risks, rules, safeguards and rights in relation to the processing of personal data.

39) Use the scenario below to answer questions 39 to 41.

---

A hotel in Cornwall takes direct bookings from individuals across Europe, which includes their names, addresses and other personal information. It receives personal data from those individuals and sends personal data back to them.

The hotel also uses a marketing company that makes bookings online on behalf of the hotel. This marketing company is based in France and uses a cloud IT service of a US based provider to store customers details.

Recently there was a data breach when the US provider's servers were hacked.

Question:

Which of the following should occur following the breach?

The US service provider must immediately get certified under the Privacy Shield in order to avoid any fines.

The US service provider should report to the Lead Supervisory Authority within 72 hours from when being aware of the data breach

The marketing company should report to the UK hotel without undue delay, once it has been made aware of the data breach.

The marketing company should report to the Lead Supervisory Authority within 72 hours from when being aware of the data breach

40) Use the scenario below to answer questions 39 to 41.

---

A hotel in Cornwall takes direct bookings from individuals across Europe, which includes their names, addresses and other personal information. It receives personal data from those individuals and sends personal data back to them.

The hotel also uses a marketing company that makes bookings online on behalf of the hotel. This marketing company is based in France and uses a cloud IT service of a US based provider to store customers details.

Recently there was a data breach when the US provider's servers were hacked.

Question:

Which of the following should NOT be included in the Hotel's Record of Processing Activities.

a description of the categories of data subjects

the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations

the name and contact details of their processor’s representative and/or data protection officer

the categories of personal data

41) Use the scenario below to answer questions 39 to 41.

---

A hotel in Cornwall takes direct bookings from individuals across Europe, which includes their names, addresses and other personal information. It receives personal data from those individuals and sends personal data back to them.

The hotel also uses a marketing company that makes bookings online on behalf of the hotel. This marketing company is based in France and uses a cloud IT service of a US based provider to store customers details.

Recently there was a data breach when the US provider's servers were hacked.

Question:

What should be included in the Record of Processing Activities of the marketing company?

a description of the categories of data subjects and of the categories of personal data

the purposes of the processing

transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation

where possible, the envisaged time limits for erasure of the different categories of data

42)Use the scenario below to answer questions 42 and 43.

---
A company based in France passes employee information to a centralised group human resources service provided by its parent company in Germany.

The company is considering transferring their HR operations to their office in Israel. The company is also considering opening an office in China, UK and Austria and it is expected that there would be regular transfer across between all offices.

Question

Which of the following statement is correct?

The Company should have the Privacy Shield Certification in order to have the office in Israel transfer their data as Isreal is not in the EEA

The Company can transfer data to their office in Isreal, there is no restrictions for transfer to Israel under the GDPR

The Company should have the Binding Corporate Rule in order to have the office in Israel transfer their data as Israel is not in the EEA

None of the above

43) Use the scenario below to answer questions 42 and 43.

---
A company based in France passes employee information to a centralised group human resources service provided by its parent company in Germany.

The company is considering transferring their HR operations to their office in Israel. The company is also considering opening an office in China, UK and Austria and it is expected that there would be regular transfer across between all offices.

Question

What would you recommend the company does, in order to ensure cross-border data transfer under the GDPR?

The company should consider having its Binding Corporate Rules approved before opening the China Office

There company can transfer data to China without any restrictions as their head office is in the EU

The company should consider having an EU Representative or a DPO in China in order for China to be considered as an Adequate country

None of the above

44) Which of the following controller/processing scenarios in principle CAN use the Public Interest legal basis?

A vehicle licensing agency selling owner names and contact details to the private sector in exchange for money

A company director credit checking agency republishing the contents of a Mandatory Public Register of directors which is already in the public domain publishing the names and addresses of directors on the internet

A registered and regulated charity receiving information from any public sector body as part of a lawful Data Sharing Agreement

None of the above

45) Where the data subject is a child, what steps must controllers take in respect of consent, within the constraints of available technology?

Controllers must make best efforts to verify the consent

Controllers must make reasonable efforts to verify the consent

Controllers must make best efforts to request the consent in clear and plain language, in the context of the age of the child

Controllers must make reasonable efforts to request the consent in clear and plain language, in the context of the age of the child

46) Under the GDPR in which of the following situations are there derogations, where each member state can make adjustment to their national laws.

The default age at which a child can give consent

The usefulness of the Principle of fairness, lawfulness and transparency

The right to erasure

All of the above

47) Which of the following is NOT categorically one of the types of Privacy?

Intellectual Privacy

Information Privacy

Bodily Privacy

Territorial Privacy

48) While implementing certain data subject rights the controller is obliged by Article 19 to inform each third party recipient of the personal data. For which of the following rights does this apply?

Restriction under Article 18

Rectification under Article 16

Erasure / "right to be forgotten" under Article 17

All of the above

49)Use the scenario below to answer questions 49 and 50.

---
An individual drops their business card into a prize draw box in a coffee shop. This is an affirmative act that clearly indicates they agree to their name and contact number being processed for the purposes of the prize draw. However, this consent does not extend to using those details for marketing BUT the coffee shop has used the details to send out Christmas Promotions and vouchers.

Question
The act of the coffee shop is in violation of which of the GDPR Principles?

Purpose Limitation

Data Minimisation

Data Accuracy

None of the above

50) Use the scenario below to answer questions 49 and 50.

---
An individual drops their business card into a prize draw box in a coffee shop. This is an affirmative act that clearly indicates they agree to their name and contact number being processed for the purposes of the prize draw. However, this consent does not extend to using those details for marketing BUT the coffee shop has used the details to send out Christmas Promotions and vouchers.

Question
The violation of the GDPR Principle(s) may lead to a penalty of what?

up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher.

up to 10 million euros, or in the case of an undertaking, up to 2 % of their total global turnover of the preceding fiscal year, whichever is higher.

up to 5 million euros, or in the case of an undertaking, up to 1 % of their total global turnover of the preceding fiscal year, whichever is higher.

none of the above

5) Which statement describes a European best practices approach to the protection of employment data held by an organisation?

12) Under the GDPR, would a European company be allowed to use video surveillance to monitor employee access to inventory?

13) Which institution is responsible for ensuring that directives are implemented properly by the member states?

14) What is true for a contract based on European Commission (EC) Standard Contractual Clauses with a processor outside the European Economic Area?

15) Which type of data subject is NOT covered by the GDPR?

16) Use the following scenario to answer questions 16-18:

18) Use the following scenario to answer questions 16-18:

Question:What should Tea & Biscuits do next to respond to Rob's request for email?

19) Which of the following is not covered in the 3-part test of the Legitimate Interest Assessment?

20) How is an employer obliged to proceed before engaging in the general monitoring of email traffic and internet use of all of its employees?

21) Which is NOT a compatible purpose for processing data beyond the purpose originally specified at the time of collection?

22) Along with legitimacy, what is another condition that must be met when carrying out employee monitoring?

23) Which is an example of cloud computing?

24) According to the GDPR, the right to data portability applies:

25) The collection is part of a historical research initiative. Which is the most accurate statement concerning the obligations imposed by the GDPR?

26) Which of the following will NOT be considered as direct marketing?

27) Which, according to the GDPR, is NOT one of the considerations that should be taken into account to determine the appropriate technical and organisational measures to ensure a level of data security appropriate to the risk?

28) Which is NOT a special category of data?

30) Which exemption to the e-Privacy Directive 2002/58/EC allows the data controller to send electronic marketing information?

31) Which of the following is NOT one of the cases where Processors and Controllers must appoint a DPO?

32) According to the Treaty of Lisbon, the majority of EU legislation cannot be adopted without the approval of which two European Institutions?

33) When would a data subject have the right to require the erasure of his or her data without undue delay?

34) In which case should a data subject’s consent be regarded as freely given under the GDPR?

35) Which of the following lists the attribute of security controls?

36) An online furniture store requires customers to consent to their details being shared with other homeware stores as part of the checkout process. The store is making consent a condition of sale – in order to share the data with other stores, which is not necessary for that sale.

37) Which of the following is a responsibility of the European Data Protection Board?

38) Which of the following is not part of the responsibilities of a Local Data Protection Supervisory Authority?

39) Use the scenario below to answer questions 39 to 41.

40) Use the scenario below to answer questions 39 to 41.

41) Use the scenario below to answer questions 39 to 41.

42)Use the scenario below to answer questions 42 and 43.

43) Use the scenario below to answer questions 42 and 43.

44) Which of the following controller/processing scenarios in principle CAN use the Public Interest legal basis?

45) Where the data subject is a child, what steps must controllers take in respect of consent, within the constraints of available technology?

46) Under the GDPR in which of the following situations are there derogations, where each member state can make adjustment to their national laws.

47) Which of the following is NOT categorically one of the types of Privacy?

48) While implementing certain data subject rights the controller is obliged by Article 19 to inform each third party recipient of the personal data. For which of the following rights does this apply?

49)Use the scenario below to answer questions 49 and 50.

50) Use the scenario below to answer questions 49 and 50.

Question:
What should Tea & Biscuits do next to respond to Rob's request for email?