Pass PECB GDPR PDF Dumps | Recently Updated 84 Questions
Updated Test Engine to Practice GDPR Dumps & Practice Exam
NEW QUESTION # 48
Question:
What is themain purpose of conducting a DPIA?
- A. Toidentify the causesof the identified risks.
- B. Toeliminate all risksassociated with processing personal data.
- C. Toextensively assess the impactsof the identified risks on individuals.
- D. Tomeasure the potential consequencesof the identified risks on the organization.
Answer: C
Explanation:
UnderArticle 35 of GDPR, a DPIA's primary goal is toassess the risks to individuals' rights and freedoms arising from data processing.
* Option B is correctbecauseDPIAs focus on evaluating and mitigating risks to data subjects.
* Option A is incorrectbecauseDPIAs are not just about identifying causes but about assessing and mitigating risks.
* Option C is incorrectbecauseGDPR prioritizes risks to individuals, not just organizations.
* Option D is incorrectbecauseeliminating all risks is not possible-DPIAs aim to manage and minimize risks.
References:
* GDPR Article 35(1)(DPIA requirement for high-risk processing)
* Recital 84(DPIAs help protect individuals' rights)
NEW QUESTION # 49
Scenario 9:Soin is a French travel agency with the largest network of professional travel agents throughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.
As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers' data.
Data collected by Soin includes customer's ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin's data processing activities are built based on customer's consent.
At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin.
However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin's data processing activities.
The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices.
The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin's clients claiming that they do not have access in their personal data stored by Soin. Soin's Customer Service Department answered the emails saying that, based on Soin's policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.
All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions.
Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.
Based on this scenario, answer the following question:
According to scenario 9, the DPO drafted and implemented all action plans to resolve the nonconformities found. Is this acceptable?
- A. No, the DPO should implement action plans as arranged in order of priority by top management
- B. No, the DPO should only evaluate and follow up on action plans submitted in response to nonconformities
- C. Yes, the DPO is responsible for drafting, implementing, and reviewing corrections and corrective actions
Answer: B
Explanation:
According to GDPR Article 39(1), the DPO's role is to monitor compliance, provide advice, and act as a point of contact for supervisory authorities. However, the DPO should not directly implement action plans, as this could create a conflict of interest (Recital 97). The responsibility for implementation lies with the controller or relevant departments, while the DPO ensures that the corrective actions align with GDPR requirements.
NEW QUESTION # 50
Scenario3:
COR Bank is an international banking group that operates in 31 countries. It was formed as the merger of two well-known investment banks in Germany. Their two main fields of business are retail and investment banking. COR Bank provides innovative solutions for services such as payments, cash management, savings, protection insurance, and real-estate services. COR Bank has a large number of clients and transactions.
Therefore, they process large information, including clients' personal data. Some of the data from the application processes of COR Bank, including archived data, is operated by Tibko, an IT services company located in Canada. To ensure compliance with the GDPR, COR Bank and Tibko have reached a data processing agreement Based on the agreement, the purpose and conditions of data processing are determined by COR Bank. However, Tibko is allowed to make technical decisions for storing the data based on its own expertise. COR Bank aims to remain a trustworthy bank and a long-term partner for its clients. Therefore, they devote special attention to legal compliance. They started the implementation process of a GDPR compliance program in 2018. The first step was to analyze the existing resources and procedures. Lisa was appointed as the data protection officer (DPO). Being the information security manager of COR Bank for many years, Lisa had knowledge of the organization's core activities. She was previously involved in most of the processes related to information systems management and data protection. Lisa played a key role in achieving compliance to the GDPR by advising the company regarding data protection obligations and creating a data protection strategy. After obtaining evidence of the existing data protection policy, Lisa proposed to adapt the policy to specific requirements of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of departments. As the DPO, she had access to several departments,including HR and Accounting Department. This assured the organization that there was a continuous cooperation between them. The activities of some departments within COR Bank are closely related to data protection. Therefore, considering their expertise, Lisa was advised from the top management to take orders from the heads of those departments when taking decisions related to their field. Based on this scenario, answer the following question:
Question:
According to scenario 3,Lisa was appointed as the Data Protection Officer (DPO)of COR Bank. Is this action in compliance with GDPR?
- A. Yes, the DPO must be a staff member of the controller or processor in all cases when processing includes special categories of data.
- B. Yes, the DPO may be a staff member of the controller or processor or fulfill the tasks based on a service contract.
- C. No, Lisa cannot be appointed as a DPO because she was already an information security officer.
- D. No, an external DPO must be contracted when personal data is collected or processed by an organization that is not established in the European Union.
Answer: B
Explanation:
UnderArticle 37(6) of GDPR, theDPO can be an employeeof the company oran external contractor. Lisa's appointmentcomplieswith GDPR because she is a staff member withdata protection expertise.
* Option A is correctbecause GDPR allows organizations to appoint aninternal or external DPO.
* Option B is incorrectbecause a DPOdoes not have to be an internal staff membereven for special categories of data.
* Option C is incorrectbecause a company canappoint an internal DPO even if it operates internationally.
* Option D is incorrectbecause having another roledoes not disqualify someone from being a DPO, as long as there isno conflict of interest.
References:
* GDPR Article 37(6)(DPO may be an employee or external contractor)
* Recital 97(DPO qualifications and independence)
NEW QUESTION # 51
Scenario:
BookStis anonline bookshopthat collectspersonal databefore selling its products.Sarah signed up for an account, providing hername, email, and password. To purchase a book, Sarah was required to provide her shipping address and payment information, which isneeded to calculate shipping costsandcomplete the transaction.
Question:
Does the company have alegal basisfor processing Sarah's data?
- A. No, the processing isnot legally justifiedif it is only for sales purposes.
- B. Yes, but only if Sarah providesexplicit consentfor her data to be processed.
- C. No, the processing is legally justified only if it is necessary toprotect the vital interests of the data subject.
- D. Yes, the processing is necessary for theperformance of a contractto which the data subject is a party.
Answer: D
Explanation:
References:
* GDPR Article 6(1)(b)(Processing necessary for contract performance)
* Recital 44(Contractual necessity as a legal basis)
NEW QUESTION # 52
Scenario 7: EduCCS is an online education platform based in Netherlands. EduCCS helps organizations find, manage, and deliver their corporate training. Most of EduCCS's clients are EU residents. EduCCS is one of the few education organizations that have achieved GDPR compliance since 2019. Their DPO is a full-time employee who has been engaged in most data protection processes within the organization. In addition to facilitating GDPR compliance, the DPO acts as an intermediary point between EduCCS and other relevant interested parties. EduCCS's users can benefit from the variety of up-to-date training library and the possibility of accessing it through their phones, tablets, or computers. EduCCS's services are offered through two main platforms: online learning and digital training. To use one of these platforms, users should sign on EduCCS's website by providing their personal information. Online learning is a platform in which employees of other organizations can search for and request the training they need. Through its digital training platform, on the other hand, EduCCS manages the entire training and education program for other organizations.
Organizations that need this type of service need to provide information about their core activities and areas where training sessions are needed. This information is then analyzed by EduCCS and a customized training program is provided. In the beginning, all IT-related services were managed by two employees of EduCCS.
However, after acquiring a large number of clients, managing these services became challenging That is why EduCCS decided to outsource the IT service function to X-Tech. X-Tech provides IT support and is responsible for ensuring the security of EduCCS's network and systems. In addition, X-Tech stores and archives EduCCS's information including their training programs and clients' and employees' data. Recently, X-Tech made headlines in the technology press for being a victim of a phishing attack. A group of three attackers hacked X-Tech's systems via a phishing campaign which targeted the employees of the Marketing Department. By compromising X-Tech's mail server, hackers were able to gain access to more than 200 computer systems. Consequently, access to the networks of EduCCS's clients was also allowed. Using EduCCS's employee accounts, attackers installed a remote access tool on EduCCS'scompromised systems. By doing so, they gained access to personal information of EduCCS's clients, training programs, and other information stored in its online payment system. The attack was detected by X-Tech's system administrator.
After detecting unusual activity in X-Tech's network, they immediately reported it to the incident management team of the company. One week after being notified about the personal data breach, EduCCS communicated the incident to the supervisory authority with a document that outlined the reasons for the delay revealing that due to the lack of regular testing or modification, their incident response plan was not adequately prepared to handle such an attack.Based on this scenario, answer the following question:
Question:
Based on scenario 7, didEduCCS comply with GDPRregardingdata breach notification requirements?
- A. Yes, EduCCS actedin compliancewith GDPR bynotifying the supervisory authority one week after the violation.
- B. No, EduCCS should havereported the breach directly to affected clientsbefore informing the supervisory authority.
- C. No, EduCCS' notification to thesupervisory authorityafterone weekviolates GDPR's requirementfor timely notification.
- D. Yes, EduCCS wasnot obligated to notifythe supervisory authority about the breach, since it occurred at itsIT service provider, X-Tech.
Answer: C
Explanation:
UnderArticle 33(1) of GDPR, controllers mustreport a personal data breach to the supervisory authority within 72 hoursof becoming aware of it.EduCCS delayed notification beyond this timeframe, violating GDPR.
* Option A is correctbecauseEduCCS failed to notify the authority within 72 hours.
* Option B is incorrectbecauseEduCCS remains responsible for reporting the breach, even if it occurred atX-Tech.
* Option C is incorrectbecauseone-week delay violates GDPR's 72-hour requirement.
* Option D is incorrectbecausenotifying the supervisory authority is required first, unless the breach is unlikely to impact data subjects.
References:
* GDPR Article 33(1)(72-hour breach notification)
* Recital 85(Timely response to data breaches)
NEW QUESTION # 53
Scenario5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies,providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared.
The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identified risks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond.Based on this scenario, answer the following question:
Question:
Recpondstores files of candidates who are not selectedin its databases,even if they withdraw consent. Is this acceptable under GDPR?
- A. No, Recpond must retain candidate data for statistical analysis but must anonymize it.
- B. Yes, the GDPR allows personal data to be processedeven after consent is withdrawnso organizations can use the data for future recruitment opportunities.
- C. Yes, the GDPR only requires the controller tostop processing the datawhen consent is withdrawn but does not require its deletion.
- D. No, the GDPR requires the controller to erase personal data if the data subject withdraws their consent for data processing.
Answer: D
Explanation:
UnderArticle 17 of GDPR(Right to Erasure), data subjectshave the right to request deletionof their personal data whenconsent is withdrawn, unlessa legal obligation or legitimate interest requires retention.
* Option A is correctbecause Recpond musterase personal dataif consent is withdrawn and no other lawful basis exists.
* Option B is incorrectbecauseGDPR requires deletion, not just stopping processing.
* Option C is incorrectbecauseorganizations cannot retain data for future purposes without an explicit legal basis.
* Option D is incorrectbecausestatistical use must involve anonymization, which is not mentioned in Recpond's process.
References:
* GDPR Article 17(1)(b)(Right to be forgotten when consent is withdrawn)
* Recital 65(Obligation to erase personal data when processing is no longer necessary)
NEW QUESTION # 54
An organization suffered a personal data breach. The attackers gained access to their database through a user account that had unlimited access to data. What should the DPO advise the organization to do in order to prevent the recurrence of similar scenarios?
- A. Create and use shared accounts for several users in order to minimize the number of user accounts
- B. Use cloud computing services to mitigate the risk of personal data breaches
- C. Review if the access control system allows the creation, approval, review, and deletion of user accounts
Answer: C
Explanation:
GDPR Article 32(1)(b) emphasizes implementing access controls to ensure data security. Reviewing and restricting account permissions using the principle of least privilege (PoLP) helps prevent unauthorized access. Shared accounts (option C) increase security risks, and using cloud computing (option B) does not directly address access control vulnerabilities.
NEW QUESTION # 55
Scenario 9:Soin is a French travel agency with the largest network of professional travel agents throughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.
As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers' data.
Data collected by Soin includes customer's ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin's data processing activities are built based on customer's consent.
At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin.
However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin's data processing activities.
The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices.
The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin's clients claiming that they do not have access in their personal data stored by Soin. Soin's Customer Service Department answered the emails saying that, based on Soin's policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.
All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions.
Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.
Based on this scenario, answer the following question:
Can the DPO appointed by Soin carry out the data protection external audit requested by the supervisory authority?
- A. Yes, Soin's DPO is allowed to conduct a data protection external audit but only if requested by the supervisory authority
- B. No, data protection external audits should be conducted by independent auditors who are not part of the company being audited
- C. Yes, data protection external audits should be conducted by auditors contracted by Soin who can be employees of the company
Answer: B
Explanation:
GDPR Article 58(1) gives supervisory authorities the power to conduct external audits, which mustbe independent and unbiased. A company's internal DPO cannot conduct an external audit, as this would pose a conflict of interest (Recital 97). External audits should be conducted by supervisory authorities or third-party auditors, ensuring objectivity.
NEW QUESTION # 56
Which of the statements below related to compliance monitoring is correct?
- A. The DPO should monitor and measure all activities of the organization in order to ensure the suitability and effectiveness of the GDPR compliance program
- B. The DPO should assign roles and responsibilities to monitor GDPR compliance
- C. The DPO should monitor internal compliance of the organization with applicable data protection laws
Answer: C
Explanation:
GDPR Article 39(1)(b) states that the DPO is responsible for monitoring internal compliance with data protection laws, rather than assigning responsibilities or measuring all activities.
NEW QUESTION # 57
Scenario:
Bankbiois a financial institution that handlespersonal dataof its customers. Itsdata processing activities involve processingthat is necessary for thelegitimate interestspursued by the institution. In such cases, Bankbio processes personal datawithout obtaining consent from data subjects.
Question:
Is the data processinglawful under GDPR?
- A. No, the processing is lawfulonly if the data subject has given explicit consentto the processing of personal data for the specified purpose.
- B. No, financial institutionsmust always obtain explicit consentbefore processing personal data.
- C. Yes, GDPR allows the processing of personal data for thelegitimate interest pursued by the controller or by a third party in all cases.
- D. Yes, processing is lawful when it is necessary for thelegitimate interestspursued by the controller, except where such interests are overridden by the interests of fundamental rights.
Answer: D
Explanation:
UnderArticle 6(1)(f) of GDPR, processing is lawful if it isnecessary for the legitimate interests of the controller, unlessoverridden by the data subject's rights and freedoms.
* Option A is correctbecauselegitimate interest is a valid legal basis for processingunder GDPR.
* Option B is incorrectbecauseexplicit consent is not requiredif another legal basis (such as legitimate interest) applies.
* Option C is incorrectbecauselegitimate interest does not apply in all cases-the rights of the data subject may override it.
* Option D is incorrectbecausefinancial institutions are not required to obtain explicit consent for all processing activities.
References:
* GDPR Article 6(1)(f)(Legitimate interest as a lawful basis)
* Recital 47(Legitimate interest includes preventing fraud and ensuring security)
NEW QUESTION # 58
Scenario 9:Soin is a French travel agency with the largest network of professional travel agents throughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.
As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers' data.
Data collected by Soin includes customer's ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin's data processing activities are built based on customer's consent.
At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin.
However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin's data processing activities.
The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices.
The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin's clients claiming that they do not have access in their personal data stored by Soin. Soin's Customer Service Department answered the emails saying that, based on Soin's policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.
All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions.
Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.
Based on this scenario, answer the following question:
To whom should the DPO of Soin report the situations observed during the data protection internal audit?
- A. Soin's internal auditor
- B. Soin's top management
- C. Supervisory authority
Answer: B
Explanation:
Under GDPR Article 38(3), the DPO must report directly to the highest level of management. The DPO provides guidance and recommendations but does not report directly to the supervisory authority unless required under Article 58 (e.g., in case of noncompliance or high-risk processing activities). Internal auditors may be involved, but the primary responsibility for GDPR compliance lies with top management.
NEW QUESTION # 59
Question:
In whichphase of the incident management planshould the process owner define theessential information needed for identifying and classifying security incidents, while thepoint of contact and response team conduct assessments and determine actions?
- A. Remediation and recovery phase.
- B. Detection and reporting phase.
- C. Plan and prepare phase.
- D. Assessment and decision phase.
Answer: D
Explanation:
TheAssessment and Decision Phaseis wherepotential security incidents are reviewed, classified, and appropriate response actions are determined.
* Option B is correctbecausethis phase focuses on analyzing threats and deciding how to mitigate risks.
* Option A is incorrectbecauseplanning and preparation occur before an incident is detected.
* Option C is incorrectbecausedetection focuses on identifying possible breaches, not classifying them.
* Option D is incorrectbecauseremediation happens after decisions on response actions have been made.
References:
* ISO/IEC 27035-1:2016(Incident management process stages)
* GDPR Article 32(1)(d)(Security measures should ensure quick response to incidents)
NEW QUESTION # 60
Question:
Based onArticle 58 of GDPR, whatpowersmust thesupervisory authorityhave?
- A. Toobtain access to any premisesof the controller and processor, including data processing equipment.
- B. Toapprove all privacy policiesbefore they are implemented.
- C. Toassign the tasks of the controller or the processorand monitor their implementation.
- D. Toappoint a single DPOin a group of undertakings.
Answer: A
Explanation:
UnderArticle 58 of GDPR,supervisory authorities have investigative and corrective powers, includingthe ability to access premises and equipmentused for personal data processing.
* Option B is correctbecausesupervisory authorities can investigate controllers and processors, including accessing IT systems.
* Option A is incorrectbecausesupervisory authorities do not appoint DPOs; controllers and processors must do this themselves.
* Option C is incorrectbecausesupervisory authorities do not manage controllers' or processors' tasks.
* Option D is incorrectbecausesupervisory authorities do not pre-approve privacy policies.
References:
* GDPR Article 58(1)(f)(Supervisory authorities can access premises and data)
* Recital 129(Authorities must have investigation powers)
NEW QUESTION # 61
Scenario1:
MED is a healthcare provider located in Norway. It provides high-quality and affordable healthcare services, including disease prevention, diagnosis, and treatment. Founded in 1995, MED is one of the largest health organizations in the private sector. The company has constantly evolved in response to patients' needs.
Patients that schedule an appointment in MED's medical centers initially need to provide their personal information, including name, surname, address, phone number, and date of birth. Further checkups or admission require additional information, including previous medical history and genetic data. When providing their personal data, patients are informed that the data is used for personalizing treatments and improving communication with MED's doctors. Medical data of patients, including children, are stored in the database of MED's health information system. MED allows patients who are at least 16 years old to use the system and provide their personal information independently. For children below the age of 16, MED requires consent from the holder of parental responsibility before processing their data.
MED uses a cloud-based application that allows patients and doctors to upload and access information.
Patients can save all personal medical data, including test results, doctor visits, diagnosis history, and medicine prescriptions, as well as review and track them at any time. Doctors, on the other hand, can access their patients' data through the application and can add information as needed.
Patients who decide to continue their treatment at another health institution can request MED to transfer their data. However, even if patients decide to continue their treatment elsewhere, their personal data is still used by MED. Patients' requests to stop data processing are rejected. This decision was made by MED's top management to retain the information of everyone registered in their databases.
The company also shares medical data with InsHealth, a health insurance company. MED's data helps InsHealth create health insurance plans that meet the needs of individuals and families.
MED believes that it is its responsibility to ensure the security and accuracy of patients' personal data. Based on the identified risks associated with data processing activities, MED has implemented appropriate security measures to ensure that data is securely stored and processed.
Since personal data of patients is stored and transmitted over the internet, MED uses encryption to avoid unauthorized processing, accidental loss, or destruction of data. The company has established a security policy to define the levels of protection required for each type of information and processing activity. MED has communicated the policy and other procedures to personnel and provided customized training to ensure proper handling of data processing.
Question:
If a patient requests MED to permanently erase their data, MED should:
- A. Erase the personal data if it is no longer needed for its original purpose.
- B. Reject the request since the medical history of patients cannot be permanently erased.
- C. Erase the personal data only if required to comply with a legal obligation.
- D. Refuse the request because medical data must be retained indefinitely for future reference.
Answer: A
Explanation:
Under Article 17 of theGeneral Data Protection Regulation (GDPR), also known as the "Right to be Forgotten," data subjects have the right to request the erasure of their personal data when:
* The data is no longer necessary for the purpose for which it was collected.
* The data subject withdraws consent (where processing was based on consent).
* The data was processed unlawfully.
In this scenario, if the data is no longer necessary for the original purpose (e.g., if the patient has completed their treatment and there are no legal retention obligations), MED should erase the data. However, there are exceptions under GDPR, such as legal retention requirements for medical records under national healthcare regulations.
Rejecting the request outright (Option A) is incorrect because GDPR requires controllers to assess whether retention is still necessary. Similarly,Option Cis too restrictive because GDPR allows deletion even if no legal obligation mandates it.Option Dis incorrect because indefinite retention is not permitted unless a valid justification exists.
References:
* GDPR Article 17(Right to Erasure)
* Recital 65(Clarification on when personal data can be erased)
* Article 5(1)(e)(Storage limitation principle)
NEW QUESTION # 62
Question:
You work in a company that providestraining services. One of the clientsrequests accessto information about thecategories of recipientsto whom theirpersonal data will be disclosed.
Whatactionsshould you take to becompliant with GDPR?
- A. Verify the identityof the client by sendinglogin datato their mailing address.
- B. Inform the client thataccess to this type of information is not allowed, since it may result in ahigh risk to the rights and freedoms of recipients.
- C. Obtainauthorizationfrom the recipients before disclosing their identities.
- D. Provide theclient with the requested informationabout the recipients of their data.
Answer: D
Explanation:
UnderArticle 15(1)(c) of GDPR, data subjects have theright to accessinformation about therecipients or categories of recipientswho have received their personal data.
* Option D is correctbecauseGDPR mandates transparency regarding data sharing.
* Option A is incorrectbecauseauthorization from recipients is not requiredbefore disclosing their categories.
* Option B is incorrectbecauseidentity verification applies to access requests but is not a prerequisite for providing recipient information.
* Option C is incorrectbecause denying access to this informationviolates the data subject's right under GDPR.
References:
* GDPR Article 15(1)(c)(Right of access to recipient categories)
* Recital 63(Transparency in processing and access rights)
NEW QUESTION # 63
Scenario:2
Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings), despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth. Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information. Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number). When the user clicks the email address box, a pop-up message appears as follows: "Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy.' When the user clicks the phone number box, the following message appears: "Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier." Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app. When customers want to make a purchase, they are also required to provide their bank account details. When the user finally creates the account, the following message appears: "Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts, and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes." Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed. Based on this scenario, answer the following question:
Question:
The GDPR indicates that the processing of personal data should be based on alegal contractwith the data subject. Based on scenario 6, has Soyled fulfilled this requirement?
- A. Yes, once the account is created, Soyled informs its customers that their personal data will be shared with the network.
- B. Yes, data subjects are informed about the purpose of collecting the email address and phone number before the data is collected.
- C. No, because Soyled did not obtain explicit consent for data processing.
- D. No, data subjects are informed that the personal data will be shared with Soyled's networkonly afterthe personal data is collected.
Answer: D
Explanation:
UnderArticle 6(1) of GDPR, processing personal data must have alawful basis, such as consent, contract, legal obligation, or legitimate interest. Additionally, underArticle 13, controllers must inform usersbefore collecting their data.
Soyledfailed to disclosethat personal data would be shared with the networkbefore collection, whichviolates GDPR transparency requirements.Option C is correct.Option Ais incorrect because informing about email collection does not mean lawful processing.Option Bis incorrect because the information was not disclosed at the right time.Option Dis incorrect because explicit consent is not necessarily required if another lawful basis applies.
References:
* GDPR Article 6(1)(Lawfulness of processing)
* GDPR Article 13(1)(Transparency in data processing)
NEW QUESTION # 64
When pseudonymization is used in a dataset, the data is divided into restricted access data and non- identifiable data. This restricted access data includes gender, occupation, and age, whereas the non- identifiable data includes only nationality. Is this correct?
- A. No, only anonymization can be used to divide a dataset into restricted access data and non-identifiable data
- B. Yes, when pseudonymization is used, non-identifiable data includes only nationality, whereas restricted access data includes gender, occupation, and age
- C. No, non-identifiable data includes gender, nationality, and occupation, whereas restricted access data includes first name, last name, and age, among others
Answer: C
Explanation:
Pseudonymization does not remove data identifiability but rather reduces the direct link to anindividual (GDPR Article 4(5)). Non-identifiable data includes attributes like gender and occupation, whereas restricted access data includes directly identifying details such as names. Anonymization, not pseudonymization, ensures complete irreversibility.
NEW QUESTION # 65
Scenario 9:Soin is a French travel agency with the largest network of professional travel agentsthroughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.
As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers' data.
Data collected by Soin includes customer's ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin's data processing activities are built based on customer's consent.
At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin.
However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin's data processing activities.
The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices.
The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin's clients claiming that they do not have access in their personal data stored by Soin. Soin's Customer Service Department answered the emails saying that, based on Soin's policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.
All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions.
Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.
Based on this scenario, answer the following question:
Soin's DPO conducted an internal data protection audit. Is this acceptable?
- A. No, only the supervisory authority is responsible for conducting investigations in the form of internal data protection audits
- B. Yes, the DPO can conduct an internal data protection audit as part of monitoring compliance
- C. No, the role of the DPO is to only assist the company in conducting an internal data protection audit
Answer: B
Explanation:
Under GDPR Article 39(1)(b), the DPO is responsible for monitoring compliance with GDPR, including conducting internal audits. The DPO's role includes overseeing data protection policies, raising awareness, and ensuring adherence to regulations. The internal audit conducted by the DPO at Soin aligns with these responsibilities. However, while the DPO can conduct internal audits, the supervisory authority is responsible for external investigations and enforcement actions under GDPR Article 58.
NEW QUESTION # 66
Scenario5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared.
The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identifiedrisks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond.Based on this scenario, answer the following question:
Question:
According to scenario 5, what should Recpond have considered whenassessing the risksrelated toprocessing operations?
- A. Risks should be analyzedusing a quantitative approach, sincerisk scenariosmake the evaluation process difficult.
- B. Risks should beassessed based on the risk-based approachadopted by the DPO.
- C. Risks should be identifiedbased on threats and vulnerabilitiesthat the company faces.
- D. Risks should be assessedonly when a supervisory authority requires it.
Answer: C
Explanation:
UnderArticle 32 of GDPR, risk assessments should be based onthreats, vulnerabilities, and potential impacton data subjects. Organizations must identify and mitigate risks topersonal data security.
* Option A is correctbecauserisk identification should consider threats, vulnerabilities, and impact.
* Option B is incorrectbecauserisk can be assessed qualitatively or quantitatively, depending on the approach used.
* Option C is incorrectbecauseDPOs do not define an organization's risk-based approach.
* Option D is incorrectbecauserisk assessment is mandatory under GDPR, not only when a supervisory authority requests it.
References:
* GDPR Article 32(1)(Risk-based approach to security)
* Recital 83(Risk assessment in data protection)
NEW QUESTION # 67
Scenario4:
Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social media. Berc requested that Berc's and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company.Based on this scenario, answer the following question:
Question:
Based on scenario 4, to which of the companies candata subjects exercise their rightsunder GDPR?
- A. Data subjects may exercise their rights againstonly one of the controllers, as specified in the arrangement.
- B. Data subjects may exercise their rights againstBerc onlybecause it decided to implement GDPR for data processing activities.
- C. Data subjects may exercise their rights againstboth Berc and Unty, regardless of the terms of the arrangement.
- D. None of the above.
Answer: C
Explanation:
References:
* GDPR Article 26(3)(Joint controllers must ensure data subjects can exercise their rights).
NEW QUESTION # 68
Question:
Which of the followingscenarios does NOT require conducting a DPIA?
- A. When an organizationcollects public social media profilesfor ad personalization.
- B. When an organizationinstalls AI-driven video analyticsto track employees' work patterns.
- C. When an organizationprocesses datato comply withlegal obligationsunder applicable Union law.
- D. When ahospital collects and processes genetic and health dataof its patients.
Answer: C
Explanation:
UnderArticle 35(1) of GDPR, aDPIA is not requiredwhen processing isbased on a legal obligationunder EU or national law.
* Option A is correctbecauselegal obligations provide a lawful basis for processing, making DPIAs unnecessary unless explicitly required by law.
* Option B is incorrectbecausehealth and genetic data are special categories of data, requiring a DPIA under Article 35(3)(b).
* Option C is incorrectbecauseprofiling and behavioral analysis require a DPIA, as perArticle 35(3) (a).
* Option D is incorrectbecauseworkplace surveillance with AI requires a DPIA, as it involves automated monitoring.
References:
* GDPR Article 35(1)(DPIA requirement for high-risk processing)
* Recital 91(Health data and large-scale profiling require DPIAs)
NEW QUESTION # 69
......
PECB GDPR Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
PECB GDPR Dumps Cover Real Exam Questions: https://www.real4dumps.com/GDPR_examcollection.html
Dumps Collection GDPR Test Engine Dumps Training With 84 Questions: https://drive.google.com/open?id=15qz8H5sZ-s_aON7wSFCQdWGMAdMtALWn
