Free Certified Information Privacy Professional / Europe (CIPP/E) practice test: 30 questions with answers

Convention 108 (1981) is the first legally binding international instrument on data protection. The OECD Guidelines are non-binding recommendations, the Universal Declaration is not a treaty, and Directive 95/46/EC is an EU instrument from 1995 rather than a Council of Europe treaty.

Article 8 of the ECHR protects private and family life, and individual complaints after domestic remedies are heard by the European Court of Human Rights, a Council of Europe body separate from the EU. The CJEU answers preliminary questions on EU law, the EDPS supervises EU institutions, and the EDPB resolves GDPR consistency disputes, so none of them takes this complaint.

Under Article 267 TFEU a national court may ask the CJEU to interpret EU law, and the interpretation binds the referring court, which then applies it to its own case. The CJEU does not decide the national dispute, does not act as an appeal court for national judgments, and does not give non-binding advice to regulators.

Article 5(3) of the ePrivacy Directive requires prior, informed consent before storing or reading information on a user's terminal equipment, with an exception for storage strictly necessary to provide a service the user has requested. An opt-out link, supervisory approval, or pseudonymised identifiers do not replace the consent requirement.

In Schrems I (C-362/14) the CJEU held that the Commission's Safe Harbour adequacy decision did not ensure an adequate level of protection, because US public authorities could access data beyond what was necessary and individuals had no effective legal remedy. The other options misstate how the arrangement was adopted and what it required.

A regulation applies directly, so the GDPR needs no national implementing acts, whereas Directive 95/46/EC had to be transposed and so produced divergent national laws. The GDPR is an EU regulation rather than a separately ratified treaty, and it keeps specific opening clauses that allow limited national variation, so the other statements are wrong.

Recital 26 and the CJEU in Breyer (C-582/14) treat an identifier as personal data where the controller has legal means reasonably likely to be used to identify the person, including through a third party such as an ISP. Requiring registration or actual disclosure, or ignoring identification through a third party, does not reflect that test.

Under Article 4(11) GDPR consent must be a clear affirmative act, and a pre-ticked box does not meet that test (see Planet49, C-673/17). Silence, visibility, or acceptance of general terms cannot replace consent, and for direct email marketing the ePrivacy Directive generally requires consent anyway.

Article 5(1)(c) requires personal data to be adequate, relevant and limited to what is necessary for the purpose, and a monthly email needs only an email address. Accuracy, storage limitation and security are separate principles that may also apply, but the core breach here is collecting data the purpose does not need.

Article 21(2) and (3) give the data subject an absolute right to object to direct marketing, so processing for that purpose must stop and no balancing test applies. Proof of harm, a supervisory authority review, or a channel-by-channel stop is not what the GDPR requires.

EDPB guidelines are issued under Article 70 GDPR to promote consistent application and are authoritative interpretive guidance, but they are not themselves legally binding. Controllers and courts must still apply the GDPR text and the case law of the CJEU, and Article 58 concerns supervisory authority powers rather than EDPB guidance.

Under Article 18(1)(a) processing must be restricted while the accuracy of contested data is checked, and Article 18(2) allows restricted data to be stored while other processing is limited. Erasure is not automatically triggered by the dispute, and the GDPR itself contains no credit-sector exemption from Article 18.

Article 6(1)(b) allows processing necessary for the performance of a contract with the data subject, and delivering a placed order needs the address. Consent is not the right basis where processing is necessary for the contract, legitimate interests is unnecessary for this core need, and vital interests covers only life-threatening emergencies.

Article 14 applies where data is not obtained from the data subject, and Article 14(3) requires the information within a reasonable period, at most one month, and at the latest at the first communication with the person. Prior consent is not a precondition for this notice, notice to the source alone is insufficient, and Article 13 covers data collected directly from the individual.

In Schrems II (C-311/18) the CJEU confirmed that standard clauses remain available, but the exporter must check case by case that the clauses can be complied with in practice and add supplementary measures where the destination's law undermines them. Government certification and Article 49 derogations for occasional transfers are not the required step, and per-employee consent is not the general solution.

Article 28(2) requires the processor to obtain prior specific or general written authorisation from the controller before engaging a sub-processor, and Article 28(4) requires the same data protection obligations to be imposed on that sub-processor. Supervisory approval is not required, customers do not authorise the subcontractor, and the processor stays liable to the controller.

Article 26 requires joint controllers to determine their respective responsibilities transparently, with the essence of the arrangement made available to data subjects, and data subjects may exercise their rights against each controller. Limiting responsibility to each party's own systems, keeping the arrangement from data subjects, and assigning controllership by size are all wrong.

Article 6(1)(f) requires the controller to identify a legitimate interest, show the processing is necessary for it, and balance that interest against the individuals' rights, freedoms and reasonable expectations. Explicit consent, public-authority orders and anonymisation are not requirements of this basis.

Article 3(2)(a) extends the GDPR to controllers without an EU establishment that offer goods or services to data subjects in the Union, and the EDPB territorial scope guidance treats EU delivery, euro pricing and local language as indicators of targeting. Lacking an EU office does not exclude the GDPR, and designation by an authority is not a condition for applicability.

Article 35(3)(b) and (c) require a DPIA for large-scale processing of special category data, including biometrics used to identify individuals, and for systematic monitoring of publicly accessible areas on a large scale. Public authorities are not exempt, and the assessment must be done before processing starts rather than after a complaint.

Article 37(1)(b) requires a DPO where core activities consist of processing that requires regular and systematic large-scale monitoring of data subjects, which describes large-scale profiling for advertising. The requirement is not limited to public authorities, does not depend on employee requests, and behavioural data about web visits is personal data.

Article 33(1) requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk. Waiting for recovery, a 30-day period or a court order is not the rule, and the breach is reportable even though the thief holds the data.

Article 83(5) sets the higher maximum at 20 million euros or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. The maximum is not a fixed sum regardless of size, worldwide turnover (not only EU turnover) is used, and the 10 million euro tier is a lower maximum rather than a cap for all infringements.

Article 2(2)(c) excludes purely personal or household activity, and in Ryneš (C-212/13) the CJEU held that camera recording of a public space is not covered. Being installed on one's own property, or not sharing footage, does not by itself bring the activity within the exemption.

Employee monitoring must be lawful, transparent and proportionate, which means assessing necessity, balancing the employer's interest against staff privacy, and using the least intrusive means. Consent in an employment contract is generally not freely given, continuous reading of all emails is disproportionate, and no prior approval by a supervisory authority is needed.

Article 13(2) of the ePrivacy Directive lets a seller use contact details obtained in a sale for direct marketing of its own similar products, provided the customer was given a free and easy way to object at collection and in each message. Separate notarised contracts, supervisory review of purchase history, or paper-catalogue consent are not required.

Deceptive design that makes refusing much harder than accepting can make consent invalid, since consent must be freely given and refusing should not be more burdensome than accepting. Being able to refuse in a hidden menu does not make the design lawful, and the GDPR's consent rules apply to interface design, not only the ePrivacy Directive.

The AI Act is an EU regulation that sorts AI systems by risk and sets obligations accordingly, and it sits alongside the GDPR rather than replacing it. Personal data used in AI still needs a lawful basis and GDPR compliance. The AI Act does not replace the GDPR, ban all personal data processing, or operate as a directive.

Article 7(3) GDPR requires that withdrawing consent be as easy as giving it, and withdrawal does not affect processing carried out before it. A letter-only route for a one-tap consent is likely to breach that rule, while no record-keeping duty or supervisory approval is a condition for withdrawal.

Health data is a special category under Article 9, so an employer may process it only where an Article 9(2) condition applies, such as employment law obligations, and must limit requests to what is necessary and keep them confidential. Free requests for full medical histories are not justified, employee consent is generally not freely given in employment, and limited sickness records may be kept for lawful purposes.