究極のガイド準備で無料IAPP CIPP-E試験問題と解答
合格させるIAPP CIPP-EテストエンジンPDFで完全版無料問題集
認定情報プライバシープロフェッショナル/ヨーロッパ（CIPP/E）認定試験は、専門家がヨーロッパのデータプライバシーと保護の分野で知識とスキルを向上させるために設計された世界的に認められた認定プログラムです。この試験では、欧州連合の一般データ保護規則（GDPR）およびヨーロッパのその他のプライバシー法と規制に関連するさまざまなトピックを対象としています。 CIPP/E認定は、個人データを扱い、組織内のプライバシー法のコンプライアンスを確保する責任を負う専門家にとって理想的です。
IAPP CIPP-E認定試験は、情報プライバシーの分野における専門家の知識と専門知識を検証する業界に認識された認定です。この試験は、欧州連合（EU）のデータ保護に関連する法律および規制に関する候補者の理解を評価し、これらの法律を実際のシナリオに適用できるようにするように設計されています。
IAPP CIPP-E（Certified Information Privacy Professional / Europe）試験は、データ保護とプライバシーの分野で働く専門家向けに設計された、世界的に認知された認定プログラムです。欧州のデータ保護法、規制、およびベストプラクティスの理解を証明したい個人にとって、必須の認定資格です。
質問 # 79
Pursuant to Article 4(5) of the GDPR, data is considered "pseudonymized" if?
- A. It cannot be attributed to a data subject without the use of additional information.
- B. It can only be attributed to a person by the controller.
- C. It cannot be attributed to a person under any circumstances.
- D. It can only be attributed to a person by a third party.
正解：A
解説：
Reference https://dataprivacymanager.net/pseudonymization-according-to-the-gdpr/
質問 # 80
What is the primary purpose of Convention 108+, which amends the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data?
- A. To establish new data subject rights and safeguards for consumers in the EU member states.
- B. To strengthen data protection in line with the European and international regulatory framework.
- C. To issue updated guidelines for data transfers from the EU to third-country signatories to the Convention.
- D. To modify the process for third countries to obtain an adequacy decision from the European Commission.
正解：B
解説：
Convention 108+ is the modernised version of Convention 108, which was the first legally binding international instrument on data protection. The main purpose of Convention 108+ is to update and enhance the protection of personal data in light of the technological developments and the new challenges posed by the globalisation of data processing. Convention 108+ also aims to ensure the effective implementation and enforcement of data protection principles and rules, as well as to facilitate the free flow of data between the parties to the Convention.
Reference:
* Convention 108+ : the modernised version of a landmark instrument1
* Convention 108 and Protocols - Data Protection - The Council of Europe2
* Convention 108 - Council of Europe3
質問 # 81
What is a reason the European Court of Justice declared the Data Retention Directive invalid in 2014?
- A. The requirements affected individuals without exception.
- B. The requirements had limitations on how national authorities could use data.
- C. The requirements were financially burdensome to EU businesses.
- D. The requirements specified that data must be held within the EU.
正解：A
解説：
The Data Retention Directive was a EU law that required providers of electronic communications services to retain certain data, such as traffic and location data, for a period of between six months and two years, for the purpose of preventing, investigating, detecting and prosecuting serious crime1. However, in 2014, the Court of Justice of the European Union declared the Directive invalid, because it violated the fundamental rights to respect for private life and to the protection of personal data, as enshrined in the Charter of Fundamental Rights of the EU2. The Court found that the Directive entailed a wide-ranging and particularly serious interference with those rights, without being limited to what is strictly necessary3. One of the reasons for this finding was that the Directive applied to all individuals, all means of electronic communication and all traffic data without any differentiation, limitation or exception, thus affecting the entire population of the EU4. The Court also noted that the Directive did not provide sufficient safeguards to ensure effective protection of the data against the risk of abuse and unlawful access, and did not require the data to be retained within the EU5. Reference: 1 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC2 Charter of Fundamental Rights of the European Union3 Press release No 54/14 - Judgment in Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others4 Judgment of the Court (Grand Chamber) of 8 April 2014. Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others and Karntner Landesregierung and Others. Requests for a preliminary ruling from the High Court (Ireland) and the Verfassungsgerichtshof (Austria). Joined cases C-293/12 and C-594/125 Ibid.
Reference:
%20the%20Grand,proportionality%20in%20forging%20the%20Directive.
質問 # 82
What is the consequence if a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller?
- A. The controller will be required to demonstrate that the unauthorized processing negatively affected one or more of the parties involved
- B. The processor will be liable to pay compensation to affected data subjects
- C. The controller will be liable to pay an administrative fine
- D. The processor will be considered to be a controller in respect of the processing concerned
正解：D
解説：
According to the UK GDPR, a processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller1. A processor must act only on the documented instructions of the controller and must not process the data for its own purposes or in a way that is incompatible with the controller's purposes1. If a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller, it will be considered to be a controller in respect of that processing and will be subject to the same obligations and liabilities as a controller under the UK GDPR1. This means that the processor will have to comply with the data protection principles, ensure the rights of data subjects, implement appropriate technical and organisational measures, report data breaches, conduct data protection impact assessments, appoint a data protection officer if required, and cooperate with the supervisory authority1. The processor will also be exposed to the risk of administrative fines, compensation claims, and reputational damage1. Reference: 1
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/
質問 # 83
SCENARIO
Please use the following to answer the next question:
Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a few months ago.
Although no one was hurt, Louis has been plagued by texts and calls from a company called Accidentable offering to help him recover compensation for personal injury. Louis has heard about insurance companies selling customers' data to third parties, and he's convinced that Accidentable must have gotten his information from Bedrock Insurance.
Louis has also been receiving an increased amount of marketing information from Bedrock, trying to sell him their full range of their insurance policies.
Perturbed by this, Louis has started looking at price comparison sites on the internet and has been shocked to find that other insurers offer much cheaper rates than Bedrock, even though he has been a loyal customer for many years. When his Bedrock policy comes up for renewal, he decides to switch to Zantrum Insurance.
In order to activate his new insurance policy, Louis needs to supply Zantrum with information about his No Claims bonus, his vehicle and his driving history. After researching his rights under the GDPR, he writes to ask Bedrock to transfer his information directly to Zantrum. He also takes this opportunity to ask Bedrock to stop using his personal data for marketing purposes.
Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his No Claims Certificate, but tells Louis it cannot transfer his data directly to Zantrum as this is not technically feasible.
Bedrock also explains that Louis's contract included a provision whereby Louis agreed that his data could be used for marketing purposes; according to Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which was filled with legal jargon and very confusing.
In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He writes to Accidentable to ask for the name of the organization that supplied his details to them. He warns Accidentable that he plans to complain to the data protection authority, because he thinks their company has been using his data unlawfully. His letter states that he does not want his data being used by them in any way.
Accidentable's response letter confirms Louis's suspicions. Accidentable is Bedrock Insurance's wholly owned subsidiary, and they received information about Louis's accident from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis that there has been no breach of the GDPR, as Louis's contract included, a provision in which he agreed to share his information with Bedrock's affiliates for business purposes.
Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them insisting that all his information be erased from their computer system.
After Louis has exercised his right to restrict the use of his data, under what conditions would Accidentable have grounds for refusing to comply?
- A. If Accidentable also uses the data to conduct public health research.
- B. If the accuracy of the data is not an aspect that Louis is disputing.
- C. If the data becomes necessary to defend Accidentable's legal rights.
- D. If Accidentable is entitled to use of the data as an affiliate of Bedrock.
正解：D
解説：
Explanation/Reference:
質問 # 84
A data controller appoints a data protection officer. Which of the following conditions would NOT result in an infringement of Articles 37 to 39 of the GDPR?
- A. If the data protection officer receives instructions from the data controller.
- B. If the data protection officer also manages the marketing budget.
- C. If the data protection officer lacks ISO 27001 auditor certification.
- D. If the data protection officer is provided by the data processor.
正解：A
質問 # 85
A company would like to implement CCTV monitoring in its offices for safety and security purposes. Which of the following would be the best legal basis for the company to rely upon?
- A. Legitimate interest.
- B. Individual consent
- C. Public interest.
- D. Exercise of pubic authority.
正解：C
質問 # 86
A worker in a European Union (EU) member state has ceased his employment with a company. What should the employer most likely do in regard to the worker's personal data?
- A. Store all of the data in case the departing worker makes a subject access request.
- B. Securely store the data that is required to be kept under local law.
- C. Provide the employee the reasons for retaining the data.
- D. Destroy sensitive information and store the rest per applicable data protection rules.
正解：B
解説：
The GDPR requires that personal data be kept for no longer than is necessary for the purposes for which the personal data are processed1. However, the GDPR also allows member states to provide for more specific rules on the processing of employees' personal data in the employment context, including the retention periods for erasure and deletion of categories of personal data2. Therefore, the employer should securely store the data that is required to be kept under local law, such as tax records, pension records, or health and safety records34. The employer should also ensure that the data is protected from unauthorized or unlawful access, accidental loss, destruction, or damage1. The employer should not store the data for longer than necessary or for purposes other than those for which the data was collected, unless the employee has given consent or there is another legal basis for doing so13. Reference: 1: Article 5 of the GDPR 2: Article 88 of the GDPR 3: Data Protection and GDPR in the Workplace | Factsheets | CIPD 4: How to Manage the Retention of Employee Data | GDPR Blog
質問 # 87
Which judicial body makes decisions on actions taken by individuals wishing to enforce their rights under EU law?
- A. European Data Protection Board
- B. European Court of Human Rights
- C. Court of Auditors
- D. Court of Justice of European Union
正解：D
解説：
Reference https://europa.eu/european-union/about-eu/institutions-bodies/court-justice_en
質問 # 88
Article 58 of the GDPR describes the power of supervisory authorities. Which of the following is NOT among those granted?
- A. Authorization and advisory powers.
- B. Corrective powers.
- C. Legislative powers.
- D. Investigatory powers.
正解：C
解説：
Reference:
Article 58 of the GDPR lists the powers of supervisory authorities, which include investigative, corrective, and authorization and advisory powers. However, legislative powers are not among those granted to supervisory authorities, as they belong to the EU and the member states. Therefore, option A is the correct answer. Reference: Art. 58 GDPR - Powers, Article 58 Powers - GDPR, Article 58 GDPR - GDPRhub
質問 # 89
Read the following steps:
Discover which employees are accessing cloud services and from which devices and apps Lock down the data in those apps and devices Monitor and analyze the apps and devices for compliance Manage application life cycles Monitor data sharing An organization should perform these steps to do which of the following?
- A. Institute a GDPR-compliant employee monitoring process.
- B. Maintain a secure Bring Your Own Device (BYOD) program.
- C. Pursue a GDPR-compliant Privacy by Design process.
- D. Ensure cloud vendors are complying with internal data use policies.
正解：B
解説：
Reference https://www.itproportal.com/features/heading-off-the-spectre-of-gdpr-compliance-with-secure-byod/
質問 # 90
An entity's website stores text files on EU users' computer and mobile device browsers. Prior to doing so, the entity is required to provide users with notices containing information and consent under which of the following frameworks?
- A. E-Privacy Directive 2002/58/EC.
- B. Data Protection Directive 95/46/EC.
- C. E-Commerce Directive 2000/31/EC.
- D. General Data Protection Regulation 2016/679.
正解：A
質問 # 91
An employee of company ABCD has just noticed a memory stick containing records of client data, including their names, addresses and full contact details has disappeared. The data on the stick is unencrypted and in clear text. It is uncertain what has happened to the stick at this stage, but it likely was lost during the travel of an employee. What should the company do?
- A. Launch an investigation and if nothing is found within one month, notify the data protection supervisory authority.
- B. Immediately notify all the customers of the company that their information has been accessed by an unauthorized person.
- C. Invoke the "disproportionate effort" exception under Article 33 to postpone notifying data subjects until more information can be gathered.
- D. Notify as soon as possible the data protection supervisory authority that a data breach may have taken place.
正解：D
質問 # 92
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's questions on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well.
The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's question. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
In light of the requirements of Article 32 of the GDPR (related to the Security of Processing), which practice should the company institute?
- A. Include dual-factor authentication before each use by a child in order to ensure a minimum amount of security.
- B. Encrypt the data in transit over the wireless Bluetooth connection.
- C. Insert contractual clauses into the contract between the toy manufacturer and the cloud service provider, since South Africa is outside the European Union.
- D. Include three-factor authentication before each use by a child in order to ensure the best level of security possible.
正解：B
解説：
Explanation/Reference:
質問 # 93
As a Data Protection Officer for a small bank in the European Union, you receive a data subject access request from one of your customers. The customer provides you with his name, and has used the email address registered in your system.
What would be the most appropriate way to confirm the identity of the customer?
- A. Request that the customer answer additional security questions.
- B. Request a copy of the customer's government-issued ID document.
- C. Request a copy of the customer's last bank account statement.
- D. Request that the customer provide his bank account number.
正解：A
解説：
According to the CIPP/E study guide, data controllers should use the least intrusive means of verifying the identity of data subjects who make requests under the GDPR. Asking for a copy of an ID document or a bank account statement may be disproportionate and excessive, as they contain more personal data than necessary for authentication. Asking for the bank account number may not be sufficient, as it may be easily obtained by third parties. Therefore, the most appropriate way to confirm the identity of the customer is to ask additional security questions that only the customer would know, such as the date of the last transaction, the amount of the last deposit, or the name of the beneficiary of a recurring payment.
質問 # 94
SCENARIO
Please use the following to answer the next question:
Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B. Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.
Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees:
Name
Address
Date of Birth
Payroll number
National Insurance number
Sick pay entitlement
Maternity/paternity pay entitlement
Holiday entitlement
Pension and benefits contributions
Trade union contributions
Jenny is the compliance officer at Company A.
She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required.
Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.
Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B.
This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.
Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees.
The GDPR requires sufficient guarantees of a company's ability to implement adequate technical and organizational measures. What would be the most realistic way that Company B could have fulfilled this requirement?
- A. Requesting advice and technical support from Company A's IT team.
- B. Vetting companies' measures with the appropriate supervisory authority.
- C. Hiring companies whose measures are consistent with recommendations of accrediting bodies.
- D. Avoiding the use of another company's data to improve their own services.
正解：C
質問 # 95
Why is advisable to avoid consent as a legal basis for an employer to process employee data?
- A. Consent may not be valid if the employee feels compelled to provide it.
- B. Data protection laws do not apply to processing of employee data.
- C. An employer might have difficulty obtaining consent from every employee.
- D. Employee data can only be processed if there is an approval from the data protection officer.
正解：A
質問 # 96
According to Art 23 GDPR, which of the following data subject rights can NOT be restricted?
- A. Right to restriction of processing.
- B. Right to erasure ("Right to be forgotten").
- C. Right to lodge a complaint with a supervisory authority.
- D. Right not to be subject to automated individual decision-making
正解：A
質問 # 97
Company X has entrusted the processing of their payroll data to Provider
Y. Provider Y stores this encrypted data on its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?
- A. Company X
- B. The supervisory authority
- C. Law enforcement
- D. The public
正解：C
質問 # 98
......
Certified Information Privacy Professional/Europe (CIPP/E)練習テスト2025年最新のCIPP-Eをストレスなしで合格！：https://drive.google.com/open?id=1uXJbbmW-0-QtRqErJLTZjPjFaidK-dWv
オンライン試験練習テストと詳細な解説付き！：https://www.passtest.jp/IAPP/CIPP-E-shiken.html