BONUS！！！ CertShiken CIPP-Eダンプの一部を無料でダウンロード：https://drive.google.com/open?id=1QJF9gvPT8NqOt0RAYHmX6MDNt-9444pt
IAPPのCIPP-E試験は国際的に認可られます。これがあったら、よい高い職位の通行証を持っているようです。CertShikenの提供するIAPPのCIPP-E試験の資料とソフトは経験が豊富なITエリートに開発されて、何回も更新されています。何十ユーロだけでこのような頼もしいIAPPのCIPP-E試験の資料を得ることができます。試験に合格してからあなたがよりよい仕事と給料がもらえるかもしれません。
CIPP/E認定は、プライバシー業界で高く評価されており、世界中の多くの組織によって認められています。個人は、ヨーロッパのプライバシーリスクとコンプライアンス要件を効果的に管理するための知識とスキルを持っていることを示しています。この認定は、プライバシー分野でのキャリアを促進しようとしている専門家にとっても貴重な資産です。プライバシーの専門家に対する需要の高まりに伴い、CIPP/E認定を取得することで、キャリアの成長と進歩のための新しい機会を開くことができます。
この試験は、GDPRとデータ保護原則に関する候補者の知識をテストするように設計された90の複数選択の質問で構成されています。この試験は開かれた本です。つまり、候補者はテスト中にメモや学習資料を参照できます。 CIPP/E試験の合格スコアは、500ポイントのうち300ポイントです。この試験は、英語、フランス語、ドイツ語、イタリア語、スペイン語、ポルトガル語、オランダ語など、複数の言語で利用できます。
CertShikenはIT試験問題集を提供するウエブダイトで、ここによく分かります。最もよくて最新で資料を提供いたします。こうして、君は安心で試験の準備を行ってください。弊社の資料を使って、１００％に合格を保証いたします。もし合格しないと、われは全額で返金いたします。CertShikenはずっと君のために最も正確なIAPPのCIPP-E「Certified Information Privacy Professional/Europe (CIPP/E)」試験に関する資料を提供して、君が安心に選択することができます。君はオンラインで無料な練習問題をダウンロードできて、１００％で試験に合格しましょう。
CIPP-E認定は、プライバシー、コンプライアンス、法律、ITなどの様々な分野で働くプロフェッショナルに適しています。また、データ保護責任者、データプライバシーコンサルタント、データ保護法や規制に準拠する責任を持つプロフェッショナルにも役立ちます。この認定は、候補者がデータ保護に対する取り組みや複雑なデータ保護の問題を扱う能力を示すものであり、プライバシーとデータ保護の分野で知識やスキルを向上させたいプロフェッショナルにとって貴重な資格となります。
質問 # 80
Article 29 Working Party has emphasized that the GDPR forbids "forum shopping", which occurs when companies do what?
正解：A
解説：
The GDPR aims to harmonize the data protection rules across the EU and to ensure consistent and effective enforcement of those rules. However, the GDPR also recognizes that there may be some differences in the interpretation and application of the law among the member states, depending on their national legislation, culture and practices. Therefore, the GDPR introduces the concept of the "main establishment" of a controller or processor, which is the place where the decisions on the purposes and means of the processing of personal data are taken in the EU1. The main establishment determines which national supervisory authority will act as the lead authority for the cross-border processing activities of that controller or processor, and which national law will apply in case of a dispute or a complaint2. The Article 29 Working Party, which is an advisory body composed of representatives of the national supervisory authorities, the European Data Protection Supervisor and the European Commission, has issued guidelines on how to identify the main establishment of a controller or processor under the GDPR3. The guidelines emphasize that the main establishment must reflect the reality of the processing activities and the effective and real exercise of management power over those activities. The guidelines also warn against the practice of "forum shopping", which occurs when a controller or processor designates its main establishment in a member state with the most flexible or lenient data protection regime, regardless of the actual location of the decision-making or the data processing. The guidelines state that such a practice is forbidden under the GDPR, and that the supervisory authorities will closely monitor and verify the criteria used by the controllers or processors to determine their main establishment. If the supervisory authorities find that the main establishment does not correspond to the factual situation, they may challenge the designation and apply the relevant corrective measures4. References: 1 Art. 4 (16) GDPR - Definitions - General Data Protection Regulation (GDPR)
2 Art. 56-58 GDPR - Cooperation and consistency - General Data Protection Regulation (GDPR)3 Guidelines
3/2018 on the territorial scope of the GDPR (Article 3) - European Data Protection Board4 Ibid, p. 14-15.
質問 # 81
SCENARIO
Please use the following to answer the next question:
Due to rapidly expanding workforce, Company A has decided to outsource its payroll function to Company B.
Company B is an established payroll service provider with a sizable client base and a solid reputation in the industry.
Company B's payroll solution for Company A relies on the collection of time and attendance data obtained via a biometric entry system installed in each of Company A's factories. Company B won't hold any biometric data itself, but the related data will be uploaded to Company B's UK servers and used to provide the payroll service. Company B's live systems will contain the following information for each of Company A's employees:
* Name
* Address
* Date of Birth
* Payroll number
* National Insurance number
* Sick pay entitlement
* Maternity/paternity pay entitlement
* Holiday entitlement
* Pension and benefits contributions
* Trade union contributions
Jenny is the compliance officer at Company A.
She first considers whether Company A needs to carry out a data protection impact assessment in relation to the new time and attendance system, but isn't sure whether or not this is required.
Jenny does know, however, that under the GDPR there must be a formal written agreement requiring Company B to use the time and attendance data only for the purpose of providing the payroll service, and to apply appropriate technical and organizational security measures for safeguarding the data. Jenny suggests that Company B obtain advice from its data protection officer. The company doesn't have a DPO but agrees, in the interest of finalizing the contract, to sign up for the provisions in full. Company A enters into the contract.
Weeks later, while still under contract with Company A, Company B embarks upon a separate project meant to enhance the functionality of its payroll service, and engages Company C to help. Company C agrees to extract all personal data from Company B's live systems in order to create a new database for Company B.
This database will be stored in a test environment hosted on Company C's U.S. server. The two companies agree not to include any data processing provisions in their services agreement, as data is only being used for IT testing purposes.
Unfortunately, Company C's U.S. server is only protected by an outdated IT security system, and suffers a cyber security incident soon after Company C begins work on the project. As a result, data relating to Company A's employees is visible to anyone visiting Company C's website. Company A is unaware of this until Jenny receives a letter from the supervisory authority in connection with the investigation that ensues. As soon as Jenny is made aware of the breach, she notifies all affected employees.
Under the GDPR, which of Company B's actions would NOT be likely to trigger a potential enforcement action?
正解：C
質問 # 82
How is the retention of communications traffic data for law enforcement purposes addressed by European data protection law?
正解：D
解説：
The ePrivacy Directive is a European Union (EU) directive that aims to protect the confidentiality of electronic communications and prevent their indiscriminate interception or monitoring. It was adopted in 2002 and amended in 2009. It applies to all providers of electronic communication services, such as internet service providers, mobile network operators, and online platforms12.
One of the main objectives of the ePrivacy Directive is to ensure that the retention of communications traffic data for law enforcement purposes is subject to strict conditions and safeguards. Communications traffic data refers to any information relating to the transmission or routing of electronic communications, such as IP addresses, timestamps, and metadata3. Such data can be used by competent national authorities for the prevention, investigation, detection or prosecution of criminal offences and safeguarding national security4.
However, the ePrivacy Directive does not allow individual EU member states to engage in such data retention without harmonizing their rules. Article 6(1)(b) of the directive states that "Member States shall ensure that any measures taken by them in relation to the retention of traffic data are consistent with this Directive". Therefore, each EU member state must adopt a national law that complies with the requirements and limitations set by the directive12.
The Data Retention Directive (DRD) was a previous EU directive that aimed to establish a common framework for the retention of communications traffic data for law enforcement purposes across all EU member states. It was adopted in 2006 and amended in 2010. However, it was annulled by the Court of Justice of the European Union (CJEU) in 2014 on procedural grounds. The CJEU found that some provisions of the DRD were inconsistent with other EU directives and principles, such as Article 8(2) of the Charter of Fundamental Rights (CFR), which protects individuals from arbitrary interference with their privacy56.
The GDPR is a new EU regulation that implements some aspects of the DRD into national law through its provisions on processing personal data. However, it does not address directly the issue of communications traffic data retention for law enforcement purposes. Instead, it requires providers to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk involved in processing personal data. These measures include encryption, pseudonymisation, access control, and accountability7 . The GDPR also grants individuals certain rights regarding their personal data, such as access, rectification, erasure, portability, and objection7 .
Therefore, under current EU law, there is no single legal basis for retaining communications traffic data for law enforcement purposes across all EU member states. Each member state must adopt its own national law that respects the principles and limitations established by the ePrivacy Directive.
References:
* ePrivacy Directive
* ePrivacy Regulation
* What is Communications Traffic Data?
* How is Communications Traffic Data Retained?
* Data Retention Directive
* Data Retention Directive annulled by CJEU
* General Data Protection Regulation
* What are your rights regarding your personal data?
質問 # 83
Company X has entrusted the processing of their payroll data to Provider Y.
Provider Y stores this encrypted data on its server.
The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server.
In this scenario, whom does Provider Y have the obligation to notify?
正解：C
質問 # 84
What was the main failing of Convention 108 that led to the creation of the Data Protection Directive (Directive 95/46/EC)?
正解：C
解説：
Convention 108 was the first legally binding international instrument in the data protection field, adopted by the Council of Europe in 19811. However, it had some limitations that led to the creation of the Data Protection Directive (Directive 95/46/EC) by the European Union in 19952. One of the main failings of Convention 108 was that it was implemented in a fragmented manner by a small number of states, resulting in divergent and inconsistent national laws and practices3. The Data Protection Directive aimed to harmonize the data protection rules within the EU and to ensure a high level of protection for individuals' rights and freedoms2. Therefore, option C is the correct answer. Option A is incorrect because Convention 108 did account for the rapid growth of the Internet by allowing for amendments and protocols to adapt to technological developments1. Option B is incorrect because Convention 108 did include protections for sensitive personal data, such as those revealing racial origin, political opinions, religious beliefs, health, or sexual life1. Option D is incorrect because Convention 108 did not prescribe specific penalties for violations of data protection rights, but left it to the Parties to adopt appropriate sanctions and remedies1. References:
* Convention 108 and Protocols
* CIPP/E Certification
* Convention 108+ and the Data Protection Framework of the EU
質問 # 85
......
CIPP-E試験感想: https://www.certshiken.com/CIPP-E-shiken.html
ちなみに、CertShiken CIPP-Eの一部をクラウドストレージからダウンロードできます：https://drive.google.com/open?id=1QJF9gvPT8NqOt0RAYHmX6MDNt-9444pt