Compliance with European Data Protection Law and Regulation

International data transfers, supervision and enforcement, sector-specific rules, and emerging topics including AI compliance.

5 minutes 5 Questions

Compliance with European Data Protection Law and Regulation is a foundational concept within the Certified Information Privacy Professional/Europe (CIPP/E) framework. It primarily revolves around adherence to the General Data Protection Regulation (GDPR), which came into effect on May 25, 2018, and…

Concepts covered
AI Ethics and Machine Learning Compliance IssuesAdequacy Decisions (Article 45)Binding Corporate Rules (BCRs)EU-U.S. Data Privacy FrameworkOne-Stop-Shop Mechanism (Article 56)Fines and Penalties (Article 83)Processing Employee Data Under GDPRDirect Marketing and ePrivacyEU Data Act and AI Act ImplicationsInternational Data Transfers Framework (Chapter V)Standard Contractual Clauses (SCCs)Schrems I and Schrems II RulingsTransfer Derogations (Article 49)Data Protection Authorities (DPAs)European Data Protection Board (EDPB) and EDPSCooperation and Consistency MechanismsCorrective Measures and Enforcement PowersCookies and Tracking TechnologiesAI Compliance Under GDPR
Test mode:
Start practice test

CIPP/E - Compliance with European Data Protection Law and Regulation Example Questions

Test your knowledge of Compliance with European Data Protection Law and Regulation

Question 1

A supervisory authority investigates a company and finds multiple GDPR violations: unlawful processing of special category data, failure to appoint a DPO when required, and inadequate data breach notification procedures. The authority must decide on corrective measures. The company argues that a single warning should suffice since it has begun remediation efforts. Considering Article 58(2) and Article 83 GDPR, which approach best reflects the supervisory authority's powers in this situation?

Correct Answer: The authority may impose a combination of corrective measures, such as ordering compliance changes alongside an administrative fine, calibrated to each specific infringement's nature and severity

Article 58(2) GDPR grants supervisory authorities a broad toolkit of corrective powers that can be applied cumulatively, meaning they may impose orders to bring processing into compliance alongside administrative fines under Article 83, with each measure tailored to the nature, gravity, and circumstances of each individual infringement.

The option suggesting only one corrective measure per investigation is wrong because Article 58(2) explicitly allows multiple concurrent measures. The option deferring fines until remediation review is wrong because the GDPR does not require a phased approach or mandate deferral of fines. The option requiring a processing ban first is wrong because there is no prescribed sequence of corrective measures under the GDPR.

Key concept tested: cumulative and discretionary nature of supervisory authority corrective powers under Articles 58(2) and 83 GDPR.

Question 2

What enforcement action can the European Commission take under Article 45 if it determines that a third country no longer ensures an adequate level of data protection?

Correct Answer: It repeals, amends, or suspends the existing decision by adopting a formal implementing act.

The correct answer is right because Article 45 of the GDPR explicitly grants the European Commission the power to repeal, amend, or suspend an adequacy decision via an implementing act if the third country no longer provides adequate protection.
Referring the decision to the European Court of Justice is incorrect because the Commission modifies its own acts directly without judicial annulment. Requiring the European Data Protection Board to issue a directive is wrong since the Board only provides advisory opinions rather than binding invalidations. Instructing supervisory authorities pending a parliamentary vote is false because the Commission relies strictly on implementing acts, not parliamentary votes.
The key concept tested is the modification and revocation of GDPR adequacy decisions.

Question 3

Under the General Data Protection Regulation, what ongoing obligation binds the staff of a supervisory authority regarding confidential information obtained during their duties?

Correct Answer: They must maintain strict confidentiality regarding sensitive organizational details and practices even after their employment term ends.

Under Article 54 of the General Data Protection Regulation, supervisory authority members and staff are bound by a strict duty of professional secrecy regarding confidential information, which applies both during and after their term of office.
Requiring the disclosure of internal business methodologies to the European Data Protection Board violates this professional secrecy rule. Forcing the publication of proprietary trade secrets directly contradicts the mandate to protect confidential enterprise information. Permitting the sharing of classified intelligence during joint operations ignores the broader, ongoing obligation of absolute secrecy.
The key concept tested is the statutory duty of professional secrecy for supervisory authorities.

More Compliance with European Data Protection Law and Regulation questions
485 questions (total)
Practice 100 questions
One session at a time, always new questions