SCENARIO
Please use the following to answer the next question:
T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies.
T-C raze also opened various office locations throughout Europe to help expand its business. While Germany Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T- Craze, though with much less success.
The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze.
What is the best option for the lead regulator when responding to the Spanish supervisory authority’s notice that it plans to take action regarding Sofia’s complaint?

1. A. Accept, because it did not receive any complaints.
2. B. Accept, because GDPR permits non-lead authorities to take action for such complaints.
3. C. Reject, because Right Target’s processing was conducted throughout Europe.
4. D. Reject, because GDPR does not allow other supervisory authorities to take action if there is a lead authority.

Correct Answer: D

Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?

1. A. The group of undertakings must obtain approval from a supervisory authority.
2. B. The group of undertakings must be comprised of organizations of similar sizes and functions.
3. C. The data protection officer must be located in the country where the data controller has its main establishment.
4. D. The data protection officer must be easily accessible from each establishment where the undertakings are located.

Correct Answer: D

Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?

1. A. The European Parliament
2. B. The European Commission
3. C. The Article 29 Working Party
4. D. The European Council

Correct Answer: B

What is the consequence if a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller?

1. A. The controller will be liable to pay an administrative fine
2. B. The processor will be liable to pay compensation to affected data subjects
3. C. The processor will be considered to be a controller in respect of the processing concerned
4. D. The controller will be required to demonstrate that the unauthorized processing negatively affected oneor more of the parties involved

Correct Answer: B

SCENARIO
Please use the following to answer the next question:
Zandelay Fashion (‘Zandelay’) is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company’s compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company’s customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures, Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay’s business plan and associated processing activities.
What would MOST effectively assist Zandelay in conducting their data protection impact assessment?

1. A. Information about DPIAs found in Articles 38 through 40 of the GDPR.
2. B. Data breach documentation that data controllers are required to maintain.
3. C. Existing DPIA guides published by local supervisory authorities.
4. D. Records of processing activities that data controllers are required to maintain.

Correct Answer: A