CIPP/E CASE STUDIES

PART 1
QUESTION 1:
According to the General Data Protection Regulation (GDPR), when does an
organisation need to take action to legitimise cross-border data transfers of
personal data?
a) when the data is routed through another jurisdiction in or outside the European Union
b) when the data is transferred from one jurisdiction in the European Union to another
c) when the data is transferred from a jurisdiction outside the European Union to a member state of the
European Union
d) when the data is transferred from a jurisdiction in the European Union to a third country which is not
deemed adequate
QUESTION 2:
The GDPR and its predecessor, the Data Protection Directive 95/46/EC, were
allowed to be set up as a harmonisation measure for European member states by
which?
a) Lisbon Treaty
b) Treaty of Rome
c) Council of Europe Convention
d) European Convention on Human Rights
QUESTION 3:
Which is an example of direct marketing?
a) an email sent to an individual about an order she has placed for a book
b) an email sent to an individual promoting a new book which is on sale
c) a letter addressed to ‘the household’ about a charity bookstore
d) an advertisement on a website promoting a new book which is on sale
QUESTION 4:
The e-Privacy Directive 2002/58/EC contains which provision?
a) Location data may be freely processed.
b) Unsolicited commercial telephone calls, emails and faxes need opt-out consent.
c) Corporate communication systems must have adequate security .
d) Cookies require prior information and consent.
QUESTION 5:
Which statement describes a European best practices approach to the protection of
employment data held by an organisation?
a) Employers should avoid all types of monitoring when collecting employee information
within the workplace.
b) Organisations should seek legal advice from a privacy lawyer before processing
employee data.
c) Employee data should not be processed without expressed, verbal permission by the
employee.
d) Employers should consult with regulatory bodies such as works councils about
proposed data processing activity.