What is the CIPP-E certification and who should take it?

The CIPP-E is a professional certification offered by the International Association of Privacy Professionals (IAPP) that validates expertise in European privacy laws and regulations, particularly the GDPR. It is ideal for privacy professionals, data protection officers, compliance managers, and legal professionals working in or with European organizations who need to demonstrate their knowledge of EU privacy requirements.

What are the prerequisites for taking the CIPP-E exam?

There are no formal prerequisites to take the CIPP-E exam; anyone can register and sit for the test. However, IAPP recommends that candidates have practical experience in privacy or data protection roles and suggests taking their official CIPP-E training course to adequately prepare for the comprehensive exam content.

How long is the CIPP-E exam and what is the passing score?

The CIPP-E exam consists of 100 multiple-choice questions and candidates have 120 minutes to complete it. A passing score of 75% or higher is required to earn the certification.

What topics are covered on the CIPP-E exam?

The CIPP-E exam covers the GDPR, European data protection principles, lawful basis for processing, individual rights, data protection impact assessments, and remedies for violations. It also addresses privacy by design, international data transfers, and sector-specific requirements across EU member states and other European privacy frameworks.

How much does the CIPP-E certification cost and how long is it valid?

The CIPP-E exam typically costs around $395 USD for IAPP members and slightly more for non-members, though prices may vary by region. The certification is valid for three years, after which professionals must renew through continuing education credits or retake the exam to maintain their active certification status.

Free IAPP CIPP-E Exam Questions

Q1 MultipleChoice

Which sentence best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?

AEmployees must sign an ad hoc contractual agreement each time personal data is exported.

BAll employees are subject to the rules in their entirety, regardless of where the work is taking place.

CAll employees must follow the privacy regulations of the jurisdictions where the current scope of their work is established.

DEmployees who control personal data must complete a rigorous certification procedure, as they are exempt from legal enforcement.

Correct Answer: B

Explanation:

According to Article 47(2)(a) of the GDPR, binding corporate rules (BCRs) must be legally binding and apply to and be enforced by every member concerned of the group of undertakings, or group of enterprises engaged in a joint economic activity, including their employees1. This means that all employees within the group must comply with the BCRs, irrespective of their location or the jurisdiction where they operate.The other options are incorrect, as they do not reflect the requirements of the GDPR or the guidance of the European Data Protection Board (EDPB) on BCRs23.Reference:

GDPR Article 47(2)(a)

EDPB Guidelines 3/2018 on the territorial scope of the GDPR

EDPB Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

Q2 MultipleChoice

In the Planet 49 case, what was the man judgement of the Coon of Justice of the European Union (CJEU) regarding the issue of cookies?

AIf the cookies do not track personal data, then pre-checked boxes are acceptable.

BIf the ePrivacy Directive requires consent for cookies, then the GDPR's consent requirements apply.

CIf a website's cookie notice makes clear the information gathered and the lifespan of the cookie, then pre-checked boxes are acceptable.

DIf a data subject continues to scroll through a website after reading a cookie banner, this activity constitutes valid consent for the tracking described in the cookie banner.

Correct Answer: B

Explanation:

According to the CJEU, the ePrivacy Directive does not define the concept of consent, but refers to the GDPR for its interpretation1. Therefore, the GDPR standard of consent applies to the use of cookies and similar technologies that require consent under the ePrivacy Directive.The GDPR defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her2.The CJEU also clarified that the consent requirements apply regardless of whether the cookies constitute personal data or not, as the ePrivacy Directive covers any information stored or accessed on the user's device1.The other options are incorrect, as the CJEU ruled that pre-checked boxes, implicit consent by scrolling, and insufficient information on the cookies do not meet the GDPR standard of consent1.Reference:

Free CIPP/E Study Guide, page 14, section 2.3

GDPR, Article 4 (11)

ePrivacy Directive, Article 5 (3)

Planet49: CJEU Rules on Cookie Consent

CURIA - List of results

Q3 MultipleChoice

SCENARIO

Please use the following to answer the next question:

Sandy recently joined Market4U, an advertising technology company founded in 2016, as their VP of Privacy and Data Governance. Through her first initiative in conducting a data inventory, Sandy learned that Market4U maintains a list of 19 million global contacts that were collected throughout the course of Market4U's existence. Knowing the risk of having such a large amount of data, Sandy wanted to purge all contacts that were entered into Market4U's systems prior to May 2018, unless such contacts had a more recent interaction with Market4U content. However, Dan, the VP of Sales, informed Sandy that all of the contacts provide useful information regarding successful marketing campaigns and trends in industry verticals for Market4U's clients.

Dan also informed Sandy that he had wanted to focus on gaining more customers within the sports and entertainment industry. To assist with this behavior, Market4U's marketing team decided to add several new fields to Market4U's website forms, including forms for downloading white papers, creating accounts to participate in Market4U's forum, and attending events. Such fields include birth date and salary.

What is the best way that Sandy can gain the insights that Dan seeks while still minimizing risks for Market4U?

AConduct analysis only on anonymized personal data.

BConduct analysis only on pseudonymized personal data.

CDelete all data collected prior to May 2018 after conducting the trend analysis.

DProcure a third party to conduct the analysis and delete the data from Market4U's systems.

Correct Answer: B

Explanation:

According to the GDPR, pseudonymization is a technique that replaces or removes information in a data set that identifies an individual.Pseudonymized data can no longer be attributed to a specific data subject without the use of additional information, which is kept separately and subject to technical and organizational measures to ensure non-attribution1.Pseudonymization is not a method of anonymization, which means that the data is irreversibly altered in such a way that a data subject can no longer be identified2.Pseudonymized data is still considered personal data and subject to the GDPR, but it benefits from some relaxations of the rules, such as the possibility of further processing for compatible purposes, the exemption from some data subject rights, and the facilitation of data transfers3.

In this scenario, Market4U is an advertising technology company that collects and processes a large amount of personal data from its contacts, including sensitive data such as birth date and salary. This data can be used to gain insights into the preferences and behavior of its potential customers, as well as to identify trends and opportunities in different industry verticals. However, this data also poses significant risks for Market4U, such as data breaches, non-compliance, reputational damage, and legal liability.Therefore, Market4U needs to apply the principle of data minimization, which means that it should only collect and process the data that is necessary and relevant for its purposes, and delete the data that is no longer needed4.

One of the ways that Market4U can achieve data minimization is by pseudonymizing the personal data that it uses for analysis. By doing so, Market4U can reduce the risks associated with the processing of personal data, while still retaining the utility and value of the data for its purposes.Pseudonymization can also help Market4U to comply with other GDPR principles, such as purpose limitation, storage limitation, and integrity and confidentiality5.Pseudonymization can also enable Market4U to rely on legitimate interests as a legal basis for the processing of personal data for analysis, as long as it conducts a balancing test and respects the rights and interests of the data subjects6.

Therefore, the best way that Sandy can gain the insights that Dan seeks while still minimizing risks for Market4U is to conduct analysis only on pseudonymized personal data. This option would allow Market4U to use the data for its legitimate business purposes, without compromising the privacy and security of the data subjects.

The other options are incorrect because:

A . Conducting analysis only on anonymized personal data would not be feasible or effective for Market4U, as anonymization is a very difficult and complex process that requires the removal or alteration of any information that can identify an individual, directly or indirectly. Anonymization may also result in the loss of accuracy, quality, and utility of the data, which would undermine the value and purpose of the analysis.Moreover, anonymization is irreversible, which means that Market4U would not be able to restore the original data if needed2.

C . Deleting all data collected prior to May 2018 after conducting the trend analysis would not be compliant with the GDPR, as it would violate the principle of storage limitation, which requires that personal data should be kept only for as long as necessary for the purposes for which it is processed. Market4U cannot justify the retention of the data for longer than needed, especially if the data is outdated, irrelevant, or excessive.Moreover, deleting the data after the analysis would not eliminate the risks associated with the processing of the data, such as data breaches or unauthorized access4.

D . Procuring a third party to conduct the analysis and delete the data from Market4U's systems would not be a good solution for Market4U, as it would involve the transfer of personal data to another data controller or processor, which would require additional safeguards and obligations under the GDPR. Market4U would still be responsible for ensuring the compliance and security of the data, and would have to enter into a data processing agreement with the third party, as well as inform and obtain the consent of the data subjects, if applicable.Furthermore, procuring a third party would entail additional costs and risks for Market4U, such as losing control and visibility over the data, or exposing the data to unauthorized or unlawful processing by the third party7.

Q4 MultipleChoice

For which of the following operations would an employer most likely be justified in requesting the data subject's consent?

APosting an employee's bicycle race photo on the company's social media.

BProcessing an employee's health certificate in order to provide sick leave.

COperating a CCTV system on company premises.

DAssessing a potential employee's job application.

Correct Answer: A

Explanation: