Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?

• A.The group of undertakings must obtain approval from a supervisory authority.
• B.The group of undertakings must be comprised of organizations of similar sizes and functions.
• C.The data protection officer must be located in the country where the data controller has its main establishment.
• D.The data protection officer must be easily accessible from each establishment where the undertakings are located.

Comment: *

Name: *

Email: *

Verification: *

SCENARIO
Please use the following to answer the next question:
ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data.
Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member.
Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights.
What are ABC Hotel Chain and XYZ Travel Agency's roles in this relationship?

• A.ABC Hotel Chain and XYZ Travel Agency are independent controllers.
• B.ABC Hotel Chain and XYZ Travel Agency are joint controllers.
• C.XYZ Travel Agency is the controller and ABC Hotel Chain is the processor.
• D.ABC Hotel Chain is the controller and XYZ Travel Agency is the processor.

Comment: *

Name: *

Email: *

Verification: *

How is the retention of communications traffic data for law enforcement purposes addressed by European data protection law?

• A.The ePrivacy Directive harmonizes EU member states' rules concerning such data retention.
• B.The ePrivacy Directive allows individual EU member states to engage in such data retention.
• C.The GDPR allows the retention of such data for the prevention, investigation, detection or prosecution of criminal offences only.
• D.The Data Retention Directive's annulment makes such data retention now permissible.

Comment: *

Name: *

Email: *

Verification: *

In which of the following cases would an organization MOST LIKELY be required to follow both ePrivacy and data protection rules?

• A.When creating an untargeted pop-up ad on a website.
• B.When calling a potential customer to notify her of an upcoming product sale.
• C.When emailing a customer to announce that his recent order should arrive earlier than expected.
• D.When paying a search engine company to give prominence to certain products and services within specific search results.

Comment: *

Name: *

Email: *

Verification: *

With the issue of consent, the GDPR allows member states some choice regarding what?

• A.The mechanisms through which consent may be communicated
• B.The circumstances in which silence or inactivity may constitute consent
• C.The age at which children must be required to obtain parental consent
• D.The timeframe in which data subjects are allowed to withdraw their consent

Comment: *

Name: *

Email: *

Verification: *