Updated May-2024 Official licence for CIPP-E Certified by CIPP-E Dumps PDF [Q94-Q118]

NO.94 SCENARIO
Please use the following to answer the next question:
BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information – name, location, and prior purchase history – with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.
Prior to sharing its customer list, BHealthy conducted a review of Natural Insight’s security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy’s data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight’s machine learning algorithms.
Under the GDPR, what are Natural Insight’s security obligations with respect to the customer information it received from BHealthy?

Appropriate security that takes into account the industry practices for protecting customer contact information and purchase history.

Only the security measures assessed by BHealthy prior to entering into the data processing contract.

Absolute security since BHealthy is sharing personal data, including purchase history, with Natural Insight.

The level of security that a reasonable data subject whose data is processed would expect in relation to the data subject’s purchase history.

NO.95 An unforeseen power outage results in company Z’s lack of access to customer data for six hours. According to article 32 of the GDPR, this is considered a breach. Based on the WP 29’s February, 2018 guidance, company Z should do which of the following?

Notify affected individuals that their data was unavailable for a period of time.

Document the loss of availability to demonstrate accountability

Notify the supervisory authority about the loss of availability

Conduct a thorough audit of all security systems

NO.96 In 2016’s Guidance, the United Kingdom’s Information Commissioner’s Office (ICO) reaffirmed the importance of using a “layered notice” to provide data subjects with what?

A privacy notice containing brief information whilst offering access to further detail.

A privacy notice explaining the consequences for opting out of the use of cookies on a website.

An explanation of the security measures used when personal data is transferred to a third party.

An efficient means of providing written consent in member states where they are required to do so.

NO.97 SCENARIO
Please use the following to answer the next question:
ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage’s sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth’s health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage’s Human Resources department and Ruth’s Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth’s last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorage In support of Ruth’s strategic goals of hiring more sales representatives, the Human Resources team is focused on improving its processes to ensure that new employees are sourced, interviewed, hired, and onboarded efficiently. To help with this, Mary identified two vendors, HRYourWay, a German based company, and InstaHR, an Australian based company. She decided to have both vendors go through ProStorage’s vendor risk review process so she can work with Ruth to make the final decision. As part of the review process, Jackie, who is responsible for maintaining ProStorage’s privacy program (including maintaining controller BCRs and conducting vendor risk assessments), reviewed both vendors but completed a transfer impact assessment only for InstaHR. After her review of both boasted a more established privacy program and provided third-party attestations, whereas HRYourWay was a small vendor with minimal data protection operations.
Thus, she recommended InstaHR.
ProStorage’s marketing team also worked to meet the strategic goals of the company by focusing on industries where it needed to grow its market share. To help with this, the team selected as a partner UpFinance, a US based company with deep connections to financial industry customers. During ProStorage’s diligence process, Jackie from the privacy team noted in the transfer impact assessment that UpFinance implements several data protection measures including end-to-end encryption, with encryption keys held by the customer.
Notably, UpFinance has not received any government requests in its 7 years of business. Still, Jackie recommended that the contract require UpFinance to notify ProStorage if it receives a government request for personal data UpFinance processes on its behalf prior to disclosing such data.
What transfer mechanism should Jackie recommend for using InstaHR?

Adequacy

Binding corporate rules.

Explicit consent of employees.

Standard contractual clauses

According to the GDPR, any transfer of personal data to a third country or an international organisation must be based on an adequacy decision by the Commission, appropriate safeguards by the data exporter and importer, or derogations for specific situations1. In this scenario, InstaHR is an Australian based company that processes personal data on behalf of ProStorage, a Dutch based company. Australia is not recognised by the Commission as a country that provides an adequate level of data protection2, so the adequacy option is not available. Binding corporate rules (BCRs) are internal rules adopted by multinational groups of companies or organisations that define their global policy with regard to the international transfers of personal data within the same corporate group to entities located in countries that do not provide an adequate level of protection3. However, BCRs are not applicable in this case, as InstaHR is not part of the same corporate group as ProStorage. Explicit consent of employees is a possible derogation for specific situations, but it is not a reliable or practical transfer mechanism, as it must be freely given, specific, informed and unambiguous, and it can be withdrawn at any time4. Therefore, the most suitable transfer mechanism for using InstaHR is standard contractual clauses (SCCs). SCCs are contractual clauses that have been pre-approved by the Commission and that provide appropriate safeguards for data protection when transferring personal data from the EU/EEA to third countries. SCCs are legally binding and enforceable by data subjects, and they impose obligations on both the data exporter and the data importer. SCCs are widely used by data controllers and processors as a transfer mechanism under the GDPR. Reference: 1: Art. 44 GDPR – General principle for transfers22: Adequacy decisions – European Commission13: Binding corporate rules – European Commission14: Article 7 of the GDPR. : Standard Contractual Clauses (SCC) – European Commission1.

NO.98 Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?

The European Parliament

The European Commission

The Article 29 Working Party

The European Council

NO.99 The GDPR specifies fines that may be levied against data controllers for certain infringements. Which of the following infringements would be subject to the less severe administrative fine of up to 10 million euros (or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year)?

Failure to demonstrate that consent was given by the data subject to the processing of their personal data where it is used as the basis for processing.

Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default.

Failure to process personal information in a manner compatible with its original purpose.

Failure to provide the means for a data subject to rectify inaccuracies in personal data.

NO.100 The origin of privacy as a fundamental human right can be found in which document?

Universal Declaration of Human Rights 1948.

European Convention of Human Rights 1953.

OECD Guidelines on the Protection of Privacy 1980.

Charier of Fundamental Rights of the European Union 2000.

NO.101 Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?

Data subjects must be sufficiently informed of the purposes for which their personal data is processed.

Processing of special categories of personal data on a large scale requires appointing a DPO.

Personal data of data subjects must always be accurate and kept up to date.

Data controllers must be in control of the data they hold at all times.

NO.102 A U.S.-based online shop uses sophisticated software to track the browsing behavior of its European customers and predict future purchases. It also shares this information with third parties. Under the GDPR, what is the online shop’s PRIMARY obligation while engaging in this kind of profiling?

It must solicit informed consent through a notice on its website

It must seek authorization from the European supervisory authorities

It must be able to demonstrate a prior business relationship with the customers

It must prove that it uses sufficient security safeguards to protect customer data

NO.103 When assessing the level of risk created by a data breach, which of the following would NOT have to be taken into consideration?

The ease of identification of individuals.

The size of any data processor involved.

The special characteristics of the data controller.

The nature, sensitivity and volume of personal data.

When assessing the level of risk created by a data breach, the size of any data processor involved would not have to be taken into consideration. According to the GDPR, a data breach is “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed” 1. The GDPR requires data controllers and processors to notify the relevant supervisory authority of a data breach within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons 2. The GDPR also requires data controllers to communicate the data breach to the affected data subjects without undue delay, if the breach is likely to result in a high risk to their rights and freedoms 3.
The GDPR does not specify the exact criteria for determining the level of risk, but it provides some guidance in Recital 85, which states that “the likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing” . The recital also mentions some factors that could increase the risk, such as the ease of identification of individuals, the special categories of personal data, the large scale of the processing, or the special characteristics of the data controller . Therefore, these factors should be taken into consideration when assessing the level of risk created by a data breach.
However, the size of any data processor involved is not relevant for the risk assessment, as it does not affect the impact of the breach on the data subjects. The data processor is only responsible for processing the personal data on behalf of the data controller, and has no direct relationship with the data subjects . The data processor’s obligations in case of a data breach are to notify the data controller without undue delay, and to assist the data controller in complying with its obligations under the GDPR . The data processor’s size may affect its ability to fulfill these obligations, but it does not change the level of risk created by the data breach itself. Reference: 1: Article 4(12) of the GDPR 2: Article 33 of the GDPR 3: Article 34 of the GDPR : Recital 85 of the GDPR : Article 4(8) of the GDPR : Article 28 of the GDPR I hope this helps. If you have any other questions, please feel free to ask.

NO.104 Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?

Carry out an exercise that weighs the interests of the controller and the basis for the data subject’s objection.

Consider the impact of the profiling on the data subject’s interest, rights and freedoms.

Demonstrate that the profiling is for the purposes of direct marketing.

Consider the importance of the profiling to their particular objective.

NO.105 The European Parliament jointly exercises legislative and budgetary functions with which of the following?

The European Commission.

The Article 29 Working Party.

The Council of the European Union.

The European Data Protection Board.

NO.106 Which sentence best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?

Employees must sign an ad hoc contractual agreement each time personal data is exported.

All employees are subject to the rules in their entirety, regardless of where the work is taking place.

All employees must follow the privacy regulations of the jurisdictions where the current scope of their work is established.

Employees who control personal data must complete a rigorous certification procedure, as they are exempt from legal enforcement.

NO.107 Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?

The European Parliament

The European Commission

The Article 29 Working Party

The European Council

NO.108 How is the retention of communications traffic data for law enforcement purposes addressed by European data protection law?

The ePrivacy Directive allows individual EU member states to engage in such data retention.

The ePrivacy Directive harmonizes EU member states’ rules concerning such data retention.

The Data Retention Directive’s annulment makes such data retention now permissible.

The GDPR allows the retention of such data for the prevention, investigation, detection or prosecution of criminal offences only.

The ePrivacy Directive is a European Union (EU) directive that aims to protect the confidentiality of electronic communications and prevent their indiscriminate interception or monitoring. It was adopted in 2002 and amended in 2009. It applies to all providers of electronic communication services, such as internet service providers, mobile network operators, and online platforms12.
One of the main objectives of the ePrivacy Directive is to ensure that the retention of communications traffic data for law enforcement purposes is subject to strict conditions and safeguards. Communications traffic data refers to any information relating to the transmission or routing of electronic communications, such as IP addresses, timestamps, and metadata3. Such data can be used by competent national authorities for the prevention, investigation, detection or prosecution of criminal offences and safeguarding national security4.
However, the ePrivacy Directive does not allow individual EU member states to engage in such data retention without harmonizing their rules. Article 6(1)(b) of the directive states that “Member States shall ensure that any measures taken by them in relation to the retention of traffic data are consistent with this Directive”. Therefore, each EU member state must adopt a national law that complies with the requirements and limitations set by the directive12.
The Data Retention Directive (DRD) was a previous EU directive that aimed to establish a common framework for the retention of communications traffic data for law enforcement purposes across all EU member states. It was adopted in 2006 and amended in 2010. However, it was annulled by the Court of Justice of the European Union (CJEU) in 2014 on procedural grounds. The CJEU found that some provisions of the DRD were inconsistent with other EU directives and principles, such as Article 8(2) of the Charter of Fundamental Rights (CFR), which protects individuals from arbitrary interference with their privacy56.
The GDPR is a new EU regulation that implements some aspects of the DRD into national law through its provisions on processing personal data. However, it does not address directly the issue of communications traffic data retention for law enforcement purposes. Instead, it requires providers to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk involved in processing personal data. These measures include encryption, pseudonymisation, access control, and accountability7 . The GDPR also grants individuals certain rights regarding their personal data, such as access, rectification, erasure, portability, and objection7 .
Therefore, under current EU law, there is no single legal basis for retaining communications traffic data for law enforcement purposes across all EU member states. Each member state must adopt its own national law that respects the principles and limitations established by the ePrivacy Directive.
Reference:
ePrivacy Directive
ePrivacy Regulation
What is Communications Traffic Data?
How is Communications Traffic Data Retained?
Data Retention Directive
Data Retention Directive annulled by CJEU
General Data Protection Regulation
What are your rights regarding your personal data?

NO.109 SCENARIO
Please use the following to answer the next question:
Sandy recently joined Market4U, an advertising technology company founded in 2016, as their VP of Privacy and Data Governance. Through her first initiative in conducting a data inventory, Sandy learned that Market4U maintains a list of 19 million global contacts that were collected throughout the course of Market4U’s existence. Knowing the risk of having such a large amount of data, Sandy wanted to purge all contacts that were entered into Market4U’s systems prior to May 2018, unless such contacts had a more recent interaction with Market4U content. However, Dan, the VP of Sales, informed Sandy that all of the contacts provide useful information regarding successful marketing campaigns and trends in industry verticals for Market4U’s clients.
Dan also informed Sandy that he had wanted to focus on gaining more customers within the sports and entertainment industry. To assist with this behavior, Market4U’s marketing team decided to add several new fields to Market4U’s website forms, including forms for downloading white papers, creating accounts to participate in Market4U’s forum, and attending events. Such fields include birth date and salary.
What should Sandy give as feedback to Dan and the marketing team regarding the new fields Dan wants to add to Market4U’s forms?

Make all the fields optional.

Only request the information in brackets (i.e., age group and salary range).

Eliminate the fields, as they are not proportional to the services being offered.

Eliminate the fields as they are not necessary for the purposes of providing white papers or registration for events.

NO.110 In the event of a data breach, which type of information are data controllers NOT required to provide to either the supervisory authorities or the data subjects?

The predicted consequences of the breach.

The measures being taken to address the breach.

The type of security safeguards used to protect the data.

The contact details of the appropriate data protection officer.

NO.111 After leaving the EU under the terms of Brexit, the United Kingdom will seek an adequacy determination. What is the reason for this?

The Insurance Commissioner determined that an adequacy determination is required by the Data Protection Act.

Adequacy determinations automatically lapse when a Member State leaves the EU.

The UK is now a third country because it’s no longer subject to the GDPR.

The UK is less trustworthy now that its not part of the Union.

NO.112 Please use the following to answer the next question:
Javier is a member of the fitness club EVERFIT. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in France. Javier lives in Newry, Northern Ireland (part of the U.K.), and commutes across the border to work in Dundalk, Ireland. Two years ago while on a business trip, Javier was photographed while working out at a branch of EVERFIT in Frankfurt, Germany. At the time, Javier gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only. Since then, the photograph has been used in the club’s U.K. brochures, and it features in the landing page of its U.K. website. However, the fitness club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states. As a result, Javier no longer feels comfortable with his photograph being publicly associated with the fitness club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Javier sends a letter to EVETFIT requesting that his image be removed from the website and all promotional materials. Months pass and Javier, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact EVETFIT through alternate channels, he decides to take action against the company.
Javier contacts the U.K. Information Commissioner’s Office (‘ICO’ – the U.K.’s supervisory authority) to lodge a complaint about this matter. The ICO, pursuant to Article 56 (3) of the GDPR, informs the CNIL (i.e. the supervisory authority of EVERFIT’s main establishment) about this matter. Despite the fact that EVERFIT has an establishment in the U.K., the CNIL decides to handle the case in accordance with Article 60 of the GDPR. The CNIL liaises with the ICO, as relevant under the cooperation procedure. In light of issues amongst the supervisory authorities to reach a decision, the European Data Protection Board becomes involved and, pursuant to the consistency mechanism, issues a binding decision.
Additionally, Javier sues EVERFIT for the damages caused as a result of its failure to honor his request to have his photograph removed from the brochure and website.
Under the cooperation mechanism, what should the lead authority (the CNIL) do after it has formed its view on the matter?

Submit a draft decision to other supervisory authorities for their opinion.

Request that the other supervisory authorities provide the lead authority with a draft decision for its consideration.

Submit a draft decision directly to the Commission to ensure the effectiveness of the consistency mechanism.

Request that members of the seconding supervisory authority and the host supervisory authority co-draft a decision.

NO.113 Article 29 Working Party has emphasized that the GDPR forbids “forum shopping”, which occurs when companies do what?

Choose the data protection officer that is most sympathetic to their business concerns.

Designate their main establishment in member state with the most flexible practices.

File appeals of infringement judgments with more than one EU institution simultaneously.

Select third-party processors on the basis of cost rather than quality of privacy protection.

NO.114 Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3?

The behavior of suspected terrorists being monitored by EU law enforcement bodies.

Personal data of EU citizens being processed by a controller or processor based outside the EU.

The behavior of EU citizens outside the EU being monitored by non-EU law enforcement bodies.

Personal data of EU residents being processed by a non-EU business that targets EU customers.

NO.115 A company has collected personal data tor direct marketing purpose on the basis of consent. It is now considering using this data to develop new products through analytics. What is the company first required to do?

Obtain specific consent for the new processing

Only inform the data subjects of the new purpose.

Proceed no further, as such repurposing is unlawful

Update the privacy notice upon which consent was given

NO.116 To receive a preliminary interpretation on provisions of the GDPR, a national court will refer its case to which of the following?

The Court of Justice of the European Union.

The European Data Protection Supervisor.

The European Court of Human Rights.

The European Data Protection Board.

Reference:
The Court of Justice of the European Union (CJEU) is the judicial body of the EU that makes decisions on issues of EU law and enforces European decisions either in respect to actions taken by the European Commission against a member state or actions taken by individuals to enforce their rights under EU law. The CJEU consists of two courts: the Court of Justice and the General Court. The CJEU ensures the uniform interpretation and application of EU law across the EU and settles disputes between EU institutions, member states, and individuals.
According to the EU Treaties, EU Member-States’ courts may – or, in case no appeal from their decisions is possible, must – ask the CJEU to rule on the interpretation and validity of disputed provisions of EU law. Such decisions are known as preliminary rulings, by which the CJEU expresses its ultimate authority to interpret EU law and which are binding for all national courts in the EU when they apply those specific provisions in individual cases. Since May 2018 – when the GDPR became applicable across the EU -, the CJEU has played an important role in clarifying the meaning and scope of some of its key concepts. For instance, the Court notably ruled that two parties as different as a website owner that has embedded a Facebook plugin and Facebook may be qualified as joint controllers by taking converging decisions ( Fashion ID case ), that consent for online data processing is not validly expressed through pre-ticked boxes ( Planet49 case) and that the European Commission Decision to grant adequacy to the EU-US Privacy Shield framework is invalid as a mechanism for international data transfers, and supplemental measures may be necessary to lawfully transfer data outside of the EU on the basis of Commission-vetted model clauses (in the Schrems II case ).
Therefore, to receive a preliminary interpretation on provisions of the GDPR, a national court will refer its case to the Court of Justice of the European Union, which is the ultimate authority on EU law and the GDPR.
GDPR
Court of Justice of the European Union
Court of Justice of the European Union – International Association of Privacy Professionals Judicial enforcement of EU law | European Foundation for the Improvement of Living and Working Conditions
[Competences of the Court of Justice of the European Union]

NO.117 A company wishes to transfer personal data to a country outside of the European Union/EEA In order to do so, they are planning an assessment of the country’s laws and practices, knowing that these may impinge upon the transfer safeguards they intend to use All of the following factors would be relevant for the company to consider EXCEPT’?

Any onward transfers, such as transfers of personal data to a sub-processor in the same or another third country.

The process of modernization in the third country concerned and their access to emerging technologies that rely on international transfers of personal data

The technical, financial, and staff resources available to an authority m the third country concerned that may access the personal data to be transferred

The contractual clauses between the data controller or processor established in the European Union/EEA and the recipient of the transfer established in the third country concerned

NO.118 SCENARIO
Please use the following to answer the next question:
Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA analysis. The company is headquartered in Montreal, and all of its employees are located there. The company offers its services to Canadians only: Its website is in English and French, it accepts only Canadian currency, and it blocks internet traffic from outside of Canada (although this solution doesn’t prevent all non-Canadian traffic). It also declines to process orders that request the DNA report to be sent outside of Canada, and returns orders that show a non-Canadian return address.
Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU, and the company is exploring a number of plans to expand its customer base.
The first plan, collegially called We-Track-U, will use an app to collect information about its current Canadian customer base. The expansion will allow its Canadian customers to use the app while traveling abroad. He suggests that the company use this app to gather location information. If the plan shows promise, Bob proposes to use push notifications and text messages to encourage existing customers to pre-register for an EU version of the service. Bob calls this work plan, We-Text-U. Once the company has gathered enough pre- registrations, it will develop EU-specific content and services.
Another plan is called Customer for Life. The idea is to offer additional services through the company’s app, like storage and sharing of DNA information with other applications and medical providers. The company’s contract says that it can keep customer DNA indefinitely, and use it to offer new services and market them to customers. It also says that customers agree not to withdraw direct marketing consent. Paul, the marketing director, suggests that the company should fully exploit these provisions, and that it can work around customers’ attempts to withdraw consent because the contract invalidates them.
The final plan is to develop a brand presence in the EU. The company has already begun this process. It is in the process of purchasing the naming rights for a building in Germany, which would come with a few offices that Who-R-U executives can use while traveling internationally. The office doesn’t include any technology or infrastructure; rather, it’s simply a room with a desk and some chairs.
On a recent trip concerning the naming-rights deal, Bob’s laptop is stolen. The laptop held unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of Canad a. The reports include customer name, birthdate, ethnicity, racial background, names of relatives, gender, and occasionally health information.
If Who-R-U decides to track locations using its app, what must it do to comply with the GDPR?

Get consent from the app users.

Provide a transparent notice to users.

Anonymize the data and add latency so it avoids disclosing real time locations.

Obtain a court order because location data is a special category of personal data.

According to the GDPR, location data is a type of personal data that can reveal information about an individual’s habits, preferences, or movements1. Location data can also be considered as a special category of personal data if it reveals information about an individual’s health, ethnic origin, or religious beliefs2. Therefore, location data is subject to the GDPR’s rules on the lawful processing of personal data, which require a valid legal basis, such as consent, contract, legal obligation, vital interest, public interest, or legitimate interest2.
In this scenario, Who-R-U decides to track locations using its app, which means that it collects and processes location data from its app users. This data can be used to identify the app users, as well as to infer information about their interests, preferences, or behavior. Therefore, Who-R-U needs to comply with the GDPR, even if it only offers its services to Canadians, because it monitors the behavior of individuals in the EU2.
One of the possible legal bases for processing location data is consent, which means that the app users must give their informed, specific, and freely given agreement to the collection and use of their location data2. Consent must be obtained before the processing starts, and it must be easy to withdraw at any time2. Consent must also be granular, meaning that the app users must be able to choose which purposes and types of location data they agree to share1.
Therefore, if Who-R-U decides to track locations using its app, it must get consent from the app users, and provide them with clear and transparent information about how, why, and for how long their location data will be processed, who will have access to it, and what rights they have under the GDPR12. Who-R-U must also ensure that the consent is voluntary, and that the app users can opt out of location tracking without affecting the functionality or quality of the app12. Reference: 1 Policy Brief: Location Data Under Existing Privacy Laws | FPF. Available at: 5 (Accessed: 11 December 2023)2 What is the General Data Protection Regulation (GDPR)? | Cloudflare. Available at: 6 (Accessed: 11 December 2023).

Premium VCE Dumps

Premium VCE Dumps

Updated May-2024 Official licence for CIPP-E Certified by CIPP-E Dumps PDF [Q94-Q118]

Leave a Reply Cancel reply