CIPP-E 무료 덤프문제 온라인 액세스

What should a controller do after a data subject opts out of a direct marketing activity?

• A.Without exception, securely delete all personal data relating to the data subject.
• B.Without undue delay, provide information to the data subject on the action that will be taken.
• C.Take reasonable steps to inform third-party recipients that the data subject's personal data should be deleted and no longer processed.
• D.Refrain from processing personal data relating to the data subject for the relevant type of communication.

SCENARIO
Please use the following to answer the next question:
Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.
After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient's name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissed Jack's lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of "all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents. In relation to the emails Jack listed six members of the management team whose inboxes the required access.
How should the company respond to Jack's request to be forgotten?

• A.The company should claim that the right to be forgotten is not applicable to them, as only a fraction of their global workforce resides in the European Union.
• B.The company should ensure that the information is stored outside of the European Union so that the right to be forgotten under the GDPR does not apply.
• C.The company should not erase the data at this time as it may be required to defend a legal claim of unfair dismissal.
• D.The company should erase all data relating to Jack without undue delay as the right to be forgotten is an absolute right.

SCENARIO
Please use the following to answer the next question:
BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information - name, location, and prior purchase history - with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.
Prior to sharing its customer list, BHealthy conducted a review of Natural Insight's security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy's data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight's machine learning algorithms.
Under the GDPR, what are Natural Insight's security obligations with respect to the customer information it received from BHealthy?

• A.The level of security that a reasonable data subject whose data is processed would expect in relation to the data subject's purchase history.
• B.Absolute security since BHealthy is sharing personal data, including purchase history, with Natural Insight.
• C.Only the security measures assessed by BHealthy prior to entering into the data processing contract.
• D.Appropriate security that takes into account the industry practices for protecting customer contact information and purchase history.

SCENARIO
Please use the following to answer the next question:
Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B.
Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.
Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees:
* Name
* Address
* Date of Birth
* Payroll number
* National Insurance number
* Sick pay entitlement
* Maternity/paternity pay entitlement
* Holiday entitlement
* Pension and benefits contributions
* Trade union contributions
Jenny is the compliance officer at Company A. She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required.
Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.
Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B.
This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.
Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues.
As soon as Jenny is made aware of the breach, she notifies all affected employees.
Under the GDPR, which of Company B's actions would NOT be likely to trigger a potential enforcement action?

• A.Their decision to operate without a data protection officer.
• B.Their failure to provide sufficient security safeguards to Company A's data.
• C.Their engagement of Company C to improve their payroll service.
• D.Their omission of data protection provisions in their contract with Company C.

Since blockchain transactions are classified as pseudonymous, are they considered to be within the material scope of the GDPR or outside of it?

• A.Outside the material scope of the GDPR, because transactions are for personal or household purposes
• B.Within the material scope of the GDPR to the extent that transactions include data subjects in the European Union.
• C.Outside the material scope of the GDPR, because transactions do not include personal data about data subjects m the European Union.
• D.Within the material scope of the GDPR but outside of the territorial scope, because blockchains are decentralized.