Pay attention on Pass-king CIPP-E Practice Materials, clear exam 100% for sure

Scenario Recap:
WeScanYou provides diagnostic tools (Scan4You) used by hospitals in the EU, UK, India, and Australia.
Data is processed on servers inIreland.
* Central administration: Germany
* IT development: Australia
* Data strategy: India
* EU implementation & GDPR compliance: France
After asoftware engineer sabotage, imaging data and automated diagnoses (no names/contact details) are exposed.
Question:
Based on theEDPB Opinion 04/2024 on the notion of main establishments, in which country would a potential data breach have to be reported?

• A. Ireland, because it is the location where data processing occurs.
• B. Germany, because it is the location of the central administration.
• C. Each EU member state where patients reside, because there is no main establishment inside of the EU.
• D. France, because it is the location where implementation and compliance with the GDPR is handled.

SCENARIO
Please use the following to answer the next question:
Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located in Greece (5), Italy (15) and Spain (1), have registered their most profitable results ever. To celebrate this achievement, ARRA Hotels' Human Resources office, based in ARRA's main Italian establishment, has organized a team event for its 420 employees and their families at its hotel in Spain.
Upon arrival at the hotel, each employee and family member is given an electronic wristband at the reception desk. The wristband serves a number of functions:
. Allows access to the "party zone" of the hotel, and emits a buzz if the user approaches any unauthorized areas
. Allows up to three free drinks for each person of legal age, and emits a buzz once this limit has been reached
. Grants a unique ID number for participating in the games and contests that have been planned.
Along with the wristband, each guest receives a QR code that leads to the online privacy notice describing the use of the wristband. The page also contains an unchecked consent checkbox. In the case of employee family members under the age of 16, consent must be given by a parent.
Among the various activities planned for the event, ARRA Hotels' HR office has autonomously set up a photocall area, separate from the main event venue, where employees can come and have their pictures taken in traditional carnival costume.
The photos will be posted on ARRA Hotels' main website for general marketing purposes.
On the night of the event, an employee from one of ARRA's Greek hotels is displeased with the results of the photos in which he appears. He intends to file a complaint with the relevant supervisory authority in regard to the following:
. The lack of any privacy notice in the separate photocall area
The unlawful cross-border processing of his personal data
. The unacceptable aesthetic outcome of his photos
Which of the following principles has likely been violated in the processing of the photocall photos containing personal data?

• A. Adequacy.
• B. Data minimization.
• C. Transparency.
• D. Lawfulness.

Under the GDPR, which of the following is true in regard to adequacy decisions involving cross-border transfers?

• A. To be considered as adequate, third countries must implement the EU General Data Protection Regulation into their national legislation.
• B. EU member states are vested with the power to accept or reject a European Commission adequacy decision.
• C. The European Commission can adopt, repeal or amend an existing adequacy decision.
• D. The European Commission can adopt an adequacy decision for individual companies.

An online company's privacy practices vary due to the fact that it offers a wide variety of services. How could it best address the concern that explaining them all would make the policies incomprehensible?

• A. Provide only general information about its processing activities and offer a toll-free number for more information.
• B. Place a banner on its website stipulating that visitors agree to its privacy policy and terms of use by visiting the site.
• C. Identify uses of data in a privacy notice mailed to the data subject.
• D. Use a layered privacy notice on its website and in its email communications.

SCENARIO
Please use the following to answer the next question:
Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA analysis. The company is headquartered in Montreal, and all of its employees are located there. The company offers its services to Canadians only: Its website is in English and French, it accepts only Canadian currency, and it blocks internet traffic from outside of Canada (although this solution doesn't prevent all non-Canadian traffic). It also declines to process orders that request the DNA report to be sent outside of Canada, and returns orders that show a non-Canadian return address.
Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU, and the company is exploring a number of plans to expand its customer base.
The first plan, collegially called We-Track-U, will use an app to collect information about its current Canadian customer base. The expansion will allow its Canadian customers to use the app while traveling abroad. He suggests that the company use this app to gather location information. If the plan shows promise, Bob proposes to use push notifications and text messages to encourage existing customers to pre-register for an EU version of the service. Bob calls this work plan, We-Text-U. Once the company has gathered enough pre- registrations, it will develop EU-specific content and services.
Another plan is called Customer for Life. The idea is to offer additional services through the company's app, like storage and sharing of DNA information with other applications and medical providers. The company's contract says that it can keep customer DNA indefinitely, and use it to offer new services and market them to customers. It also says that customers agree not to withdraw direct marketing consent. Paul, the marketing director, suggests that the company should fully exploit these provisions, and that it can work around customers' attempts to withdraw consent because the contract invalidates them.
The final plan is to develop a brand presence in the EU. The company has already begun this process. It is in the process of purchasing the naming rights for a building in Germany, which would come with a few offices that Who-R-U executives can use while traveling internationally. The office doesn't include any technology or infrastructure; rather, it's simply a room with a desk and some chairs.
On a recent trip concerning the naming-rights deal, Bob's laptop is stolen. The laptop held unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of Canada. The reports include customer name, birthdate, ethnicity, racial background, names of relatives, gender, and occasionally health information.
The Customer for Life plan may conflict with which GDPR provision?

• A. Article 16, which provides data subjects with a rights to rectification.
• B. Article 20, which gives data subjects a right to data portability.
• C. Article 6, which requires processing to be lawful.
• D. Article 7, which requires consent to be as easy to withdraw as it is to give.