Why is advisable to avoid consent as a legal basis for an employer to process employee data?

• A.An employer might have difficulty obtaining consent from every employee.
• B.Employee data can only be processed if there is an approval from the data protection officer.
• C.Data protection laws do not apply to processing of employee data.
• D.Consent may not be valid if the employee feels compelled to provide it.

Comment: *

Name: *

Email: *

Verification: *

SCENARIO
Please use the following to answer the next question:
Zandelay Fashion ('Zandelay') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay's business plan and associated processing activities.
What would MOST effectively assist Zandelay in conducting their data protection impact assessment?

• A.Data breach documentation that data controllers are required to maintain.
• B.Existing DPIA guides published by local supervisory authorities.
• C.Records of processing activities that data controllers are required to maintain.
• D.Information about DPIAs found in Articles 38 through 40 of the GDPR.

Comment: *

Name: *

Email: *

Verification: *

Which is the best way to view an organization's privacy framework?

• A.As an industry benchmark that can apply to many organizations
• B.As a living structure that aligns to changes in the organization
• C.As a fixed structure that directs changes in the organization
• D.As an aspirational goal that improves the organization

Comment: *

Name: *

Email: *

Verification: *

Which jurisdiction must courts have in order to hear a particular case?

• A.Subject matter jurisdiction and regulatory jurisdiction
• B.Subject matter jurisdiction and professional jurisdiction
• C.Personal jurisdiction and subject matter jurisdiction
• D.Personal jurisdiction and professional jurisdiction

Comment: *

Name: *

Email: *

Verification: *

SCENARIO
Please use the following to answer the next question:
TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business.
During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations.
TripBliss Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services.
Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered.
If TripBliss Inc. decides not to report the incident to the supervisory authority, what would be their BEST defense?

• A.The destruction of the stolen data makes any risk to the affected data subjects unlikely.
• B.The incident resulted from the actions of a third-party that were beyond their control.
• C.The resulting obligation to notify data subjects would involve disproportionate effort.
• D.The sensitivity of the categories of data involved in the incident was not substantial enough.

Comment: *

Name: *

Email: *

Verification: *