CIPP/E

What was the primary significance of Directive 95/46/EC in European data protection law?

• AIt created a single EU criminal code for privacy violations
• BIt harmonized Member State data protection laws and supported the free flow of personal d…
• CIt replaced all national supervisory authorities with one EU-wide regulator
• DIt introduced the right to data portability for the first time

Which body gives binding interpretations of EU law through preliminary rulings requested by national courts?

• AThe European Data Protection Board
• BThe European Court of Human Rights
• CThe Court of Justice of the European Union
• DThe European Commission

Article 8 of the European Convention on Human Rights primarily protects which interest?

• AFreedom of expression in political campaigns
• BRespect for private and family life, home, and correspondence
• CThe right to conduct a business across the EU
• DA right to compensation for any data breach

What is a distinctive feature of Convention 108+ compared with many other European privacy instruments?

• AIt applies only to private companies and not public bodies
• BIt is a binding international treaty open to countries beyond the Council of Europe
• CIt replaced the GDPR as the main EU data protection law
• DIt regulates only cookies and electronic communications

What is the primary role of the European Data Protection Board under the GDPR framework?

• ATo ensure consistent application of the GDPR through guidance and dispute resolution
• BTo replace all national supervisory authorities in cross-border cases
• CTo prosecute criminal privacy offenses across the EU
• DTo approve every controller's privacy notice before publication

In EU law, what is a key difference between a regulation and a directive?

• AA regulation applies only to public authorities, while a directive applies only to privat…
• BA regulation is directly applicable, while a directive generally requires national transp…
• CA directive always overrides a regulation in case of conflict
• DA directive applies immediately across the EU without national action

How do Articles 7 and 8 of the EU Charter of Fundamental Rights relate to one another?

• AThey create the same single right and are interchangeable
• BArticle 7 covers only state surveillance, while Article 8 covers only private-sector proc…
• CArticle 8 protects only anonymized data, while Article 7 protects identified data
• DArticle 7 protects private life broadly, while Article 8 establishes a distinct right to…

Which GDPR principle requires personal data to be adequate, relevant, and limited to what is necessary?

• AStorage limitation
• BAccuracy
• CData minimization
• DLawfulness

An online retailer needs a customer's delivery address to ship an item the customer purchased. Which lawful basis is usually the best fit?

• ALegal obligation
• BPerformance of a contract
• CLegitimate interests
• DVital interests

Which of the following is a special category of personal data under the GDPR?

• AA customer's purchase history
• BA postal code
• CA biometric template used to uniquely identify a person
• DA randomly assigned employee number

What must a controller do if a data subject objects to processing for direct marketing purposes?

• AContinue the marketing if the controller's commercial interest is strong enough
• BStop processing for direct marketing without applying a balancing test
• CPause marketing only until the next annual notice is issued
• DCharge a reasonable fee before honoring the objection

Which right allows a data subject to obtain confirmation that data are being processed and receive a copy of those data?

• ARight to erasure
• BRight of access
• CRight to restriction
• DRight to object

What is a key requirement when relying on legitimate interests under GDPR Article 6(1)(f)?

• AThe controller must obtain explicit consent first
• BThe controller must show the processing is required by statute
• CThe controller must balance its interests against the individual's rights and freedoms
• DThe controller may use the basis only for public-sector processing

Which practice is least consistent with valid GDPR consent?

• AUsing clear language and a separate opt-in box
• BAllowing consent to be withdrawn as easily as it was given
• CRelying on a pre-ticked box that the user must untick
• DRequesting consent for a specific, clearly described purpose

A fitness app wants to analyze users' heart-rate data to provide personalized insights. Beyond an Article 6 lawful basis, what is generally also needed?

• ANothing extra, because health data are ordinary personal data
• BAn Article 9 condition such as explicit consent
• CApproval from the user's employer
• DA verbal notice after processing begins

Which cookie use is most likely to fall within the strict necessity exemption under European cookie rules?

• AA behavioral advertising cookie
• BA social media tracking pixel
• CA shopping cart session cookie used to complete an online order
• DA third-party analytics cookie used for audience measurement

A mobile carrier wants to use subscribers' location data for a nearby-offers service. Under ePrivacy rules, which approach is generally most appropriate?

• AUse the data freely under legitimate interests because the carrier collected them first
• BUse the data only if they are anonymized or the subscriber has consented for the value-ad…
• CLaunch the service first and offer an opt-out later
• DShare the data with advertisers because location data are not personal data