IAPP CIPP-E 問題集

質問 1：
A German data subject was the victim of an embarrassing prank 20 years ago. A newspaper website published an article about the prank at the time, and the article is still available on the newspaper's website.
Unfortunately, the prank is the top search result when a user searches on the victim's name. The data subject requests that SearchCo delist this result. SearchCo agrees, and instructs its technology team to avoid scanning or indexing the article. What else must SearchCo do?
A. Identify other controllers who are processing the same information and inform them of the delisting request.
B. Notify the newspaper that its article it is delisting the article.
C. Fully erase the URL to the content, as opposed to delist which is mainly based on data subject's name.
D. Prevent the article from being listed in search results no matter what search terms are entered into the search engine.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
SCENARIO
Please use the following to answer the next question:
Zandelay Fashion ('Zandelay') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures. Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay's business plan and associated processing activities.
What must Zandelay provide to the supervisory authority during the prior consultation?
A. Certificates that prove Martin's professional qualities and expert knowledge of data protection law.
B. Records showing that customers have explicitly consented to the intended profiling activities.
C. An evaluation of the complexity of the intended processing.
D. An explanation of the purposes and means of the intended processing.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A grade school is planning to use facial recognition to track student attendance. Which of the following may provide a lawful basis for this processing?
A. Processing is necessary for the legitimate interests pursed by the school.
B. The school gets explicit consent from the students.
C. The school places a notice near each camera.
D. A state law requires facial recognition to verify attendance.
正解：B

質問 4：
SCENARIO
Please use the following to answer the next question:
T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies.
T-Craze also opened various office locations throughout Europe to help expand its business. While Germany continued to host T-Craze's headquarters and main product-design office, its French affiliate became responsible for all marketing and sales activities. The French affiliate recently procured the services of Right Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T- Craze, though with much less success.
The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze.
Why does the Spanish supervisory authority notify the French supervisory authority when it opens an investigation into T-Craze based on Sofia's complaint?
A. T-Craze conducts its marketing and sales activities in France.
B. The French affiliate procured the services of Right Target.
C. The Spanish supervisory authority is providing a courtesy notification not required under the GDPR.
D. T-Craze has a French affiliate.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
A key component of the OECD Guidelines is the "Individual Participation Principle". What parts of the General Data Protection Regulation (GDPR) provide the closest equivalent to that principle?
A. The breach notification requirements specified in Articles 33 and 34
B. The lawful processing criteria stipulated by Articles 6 to 9
C. The information requirements set out in Articles 13 and 14
D. The rights granted to data subjects under Articles 12 to 22
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
According to the GDPR, when should the processing of photographs be considered processing of special categories of personal data?
A. When processed with the intent to publish information regarding a natural person on publicly accessible media.
B. When processed with the intent to proceed to scientific or historical research projects.
C. When processed with the intent to comply with a law.
D. When processed with the intent to uniquely identify or authenticate a natural person.
正解：D