European Data Protection: Scope and Accountability

Accountability mechanisms including DPOs, DPIAs, processing records, data protection by design, and main establishment determination.

5 minutes 5 Questions

European Data Protection: Scope and Accountability is a foundational concept within the CIPP/E certification framework, addressing how the General Data Protection Regulation (GDPR) and related European privacy laws define their reach and establish responsibility for data handling. **Scope** refers…

Concepts covered
Data Protection Impact Assessments (Article 35)Data Protection Officers (Articles 37-39)Joint Controllers (Article 26)Codes of Conduct and Certification Mechanisms (Articles 40-43)Data Protection by Design and by Default (Article 25)Records of Processing Activities (Article 30)Main Establishment Determination (EDPB Opinion 04/2024)Data Processing Agreements
Test mode:
Start practice test

CIPP/E - European Data Protection: Scope and Accountability Example Questions

Test your knowledge of European Data Protection: Scope and Accountability

Question 1

A group of companies shares a single DPO across all entities. One subsidiary's management team requests the DPO to sign a non-disclosure agreement preventing the DPO from reporting data protection concerns to the lead supervisory authority. The DPO refuses, and the subsidiary threatens to exclude the DPO from future board meetings. Under Articles 37-39, what is the most appropriate course of action?

Correct Answer: The subsidiary must ensure the DPO retains access to senior management and cannot restrict the DPO's ability to communicate with supervisory authorities

Under Articles 38 and 39 GDPR, the DPO must not receive any instructions regarding the exercise of their tasks, must report directly to the highest level of management, and has the explicit right to communicate with and act as a contact point for supervisory authorities. Requiring the DPO to sign an NDA restricting communication with the supervisory authority and threatening to exclude the DPO from board meetings both violate these protections.

Appointing a separate DPO does not address the underlying violation of DPO independence protections. Requiring internal grievance escalation before contacting a supervisory authority improperly restricts the DPO's direct communication right under Article 39. Routing reporting through a legal department is not an acceptable substitute for direct senior management access, as Article 38(3) requires reporting to the highest management level.

Key concept tested: DPO independence, non-interference with DPO tasks, and the DPO's protected right to communicate with supervisory authorities under Articles 38 and 39 GDPR.

Question 2

A company is launching a new health tracking application that processes large volumes of special category data. Management wants to understand the correct timeline for evaluating the potential privacy risks associated with this new processing activity to ensure full compliance with regulatory requirements. When must the team conduct this formal evaluation?

Correct Answer: Before the start of any data collection or processing activities related to the application.

Under the GDPR, a Data Protection Impact Assessment must be conducted prior to the start of any data processing activities to proactively identify and mitigate high risks to individuals' rights.
Evaluating risks during the initial launch phase is incorrect because processing has already commenced. Waiting until after pilot testing is too late since pilot testing itself constitutes data processing. Concluding the assessment after receiving supervisory authority approval is backwards, as supervisory consultation occurs only if the assessment identifies high unmitigated risks prior to processing.
Key concept tested: Timing requirements for conducting a Data Protection Impact Assessment.

Question 3

Under EDPB Opinion 04/2024, what characterizes the 'power to have decisions implemented' requirement for an EU main establishment?

Correct Answer: The entity possesses sufficient legal and factual authority over local processing activities to enforce the required privacy compliance measures.

The correct answer accurately reflects EDPB Opinion 04/2024, which clarifies that an EU main establishment must possess both the legal authority and practical capability to ensure data protection decisions are effectively executed.

Relying on a non-EU parent for enforcement contradicts the requirement for the EU establishment itself to hold this active power, merely allocating budgets does not equate to having actual implementation authority, and delegating statutory accountability undermines the centralized control required of a main establishment.

The key concept tested is the criteria for determining a main establishment under the GDPR One-Stop-Shop mechanism.

More European Data Protection: Scope and Accountability questions
213 questions (total)
Practice 100 questions
One session at a time, always new questions