Discuss IAPP CIPM Exam Topic 6 Question 77

The General Data Protection Regulation (GDPR) specifies fines that may be levied against data controllers for certain infringements. Which of the following will be subject to administrative fines of up to 10 000 000 EUR, or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year?

AFailure to demonstrate that consent was given by the data subject to the processing of their personal data where it is used as the basis for processing

BFailure to implement technical and organizational measures to ensure data protection is enshrined by design and default

CFailure to process personal information in a manner compatible with its original purpose

DFailure to provide the means for a data subject to rectify inaccuracies in personal data

Suggested Answer: C

Types of privacy program metrics include business enablement metrics, data enhancement metrics, and commercial metrics. Business enablement metrics measure the effectiveness of the privacy program in enabling the business to function without compromising privacy. Data enhancement metrics measure the effectiveness of the privacy program in enhancing data protection, such as through data minimization, access controls, and data security. Commercial metrics measure the effectiveness of the privacy program in creating value, such as through the development of new products, services, and customer experiences.

Privacy program metrics are used to assess the effectiveness of a privacy program and measure its progress. These metrics can include business enablement metrics, data enhancement metrics, and commercial metrics. Value creation metrics, however, are not typically used as privacy program metrics.

Get Premium CIPM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

39 comments · newest first

Graciela 11 months ago

Wait, 10 million EUR for not proving consent? That’s wild!

Marta 11 months ago

D is crucial too, but I didn't realize it could lead to such high fines!

Willodean 12 months ago

C seems a bit vague, not sure how that would be enforced.

Matthew 12 months ago

I think B is just as serious, though.

Marvel 1 year ago

A is definitely a big one for fines!

Temeka 1 year ago

I’m leaning towards option D since we talked about data subject rights, but I can't recall if it specifically mentions fines like the others do.

Marla 1 year ago

I feel like option C relates to purpose limitation, which is important, but I'm not confident if it carries the same fine level as the others.

Jacqueline 1 year ago

I remember practicing a question about technical measures, and I think option B might be the one that leads to higher fines, but I could be mixing it up with another regulation.

Minna 1 year ago

I think option A sounds familiar because we discussed consent requirements in class, but I'm not entirely sure if it falls under the 10 million EUR fines.

Regenia 1 year ago

Ugh, GDPR questions are the worst. There are so many nuances to remember. I'll just try to eliminate the answers that seem clearly wrong and then guess from the remaining options.

Gabriele 1 year ago

Okay, let me think this through step-by-step. The question is asking about the GDPR fines, so I need to focus on the key GDPR principles and match them to the answer choices. I've got this!

Jolene 1 year ago

Hmm, I'm a bit unsure about this one. The GDPR has a lot of specific requirements, I'll need to review my notes to make sure I understand which ones are subject to the 10 million EUR fines.

Denae 1 year ago

This question seems straightforward, I think I can handle it. I'll carefully read through the GDPR details and match them to the answer choices.

Lavonna 1 year ago

I hope the exam doesn't have any 'trick questions' like this one. It's making my head spin just reading it!

Lezlie 1 year ago

↳ replying to Lavonna

D) Failure to provide the means for a data subject to rectify inaccuracies in personal data

Paris 1 year ago

↳ replying to Lavonna

C) Failure to process personal information in a manner compatible with its original purpose

Therese 1 year ago

↳ replying to Lavonna

B) Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default

Lisbeth 1 year ago

↳ replying to Lavonna

C) Failure to process personal information in a manner compatible with its original purpose

Caprice 1 year ago

↳ replying to Lavonna

A) Failure to demonstrate that consent was given by the data subject to the processing of their personal data where it is used as the basis for processing

Tuyet 1 year ago

↳ replying to Lavonna

B) Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default

Evelynn 1 year ago

↳ replying to Lavonna

A) Failure to demonstrate that consent was given by the data subject to the processing of their personal data where it is used as the basis for processing

Nenita 1 year ago

Wait, is the answer supposed to be the one that will get me the biggest fine? Might as well go big or go home!

Nada 1 year ago

Failure to implement technical and organizational measures? That sounds like the right answer to me. Let's go with B!

Ivette 2 years ago

Ooh, a European data privacy regulation question. I better brush up on my GDPR knowledge before the exam.

Emilio 1 year ago

↳ replying to Ivette

C) Failure to process personal information in a manner compatible with its original purpose

Freida 1 year ago

↳ replying to Ivette

B) Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default

Susana 1 year ago

↳ replying to Ivette

A) Failure to demonstrate that consent was given by the data subject to the processing of their personal data where it is used as the basis for processing

Bettye 1 year ago

↳ replying to Ivette

B) Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default

Melina 1 year ago

↳ replying to Ivette

A) Failure to demonstrate that consent was given by the data subject to the processing of their personal data where it is used as the basis for processing

Ezekiel 2 years ago

Hmm, this question is quite specific. I'll have to really focus on the details of the GDPR to get this one right.

Nan 1 year ago

↳ replying to Ezekiel

D) Failure to provide the means for a data subject to rectify inaccuracies in personal data

Janae 1 year ago

↳ replying to Ezekiel

C) Failure to process personal information in a manner compatible with its original purpose

Tyisha 1 year ago

↳ replying to Ezekiel

B) Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default

Gerald 1 year ago

↳ replying to Ezekiel

A) Failure to demonstrate that consent was given by the data subject to the processing of their personal data where it is used as the basis for processing

Evan 2 years ago

↳ replying to Ezekiel

B) Failure to implement technical and organizational measures to ensure data protection is enshrined by design and default

Jettie 2 years ago

↳ replying to Ezekiel

A) Failure to demonstrate that consent was given by the data subject to the processing of their personal data where it is used as the basis for processing

Alyce 2 years ago

I'm not sure, but I think it's either A or B. We need to be careful with how we handle personal data.

Nicholle 2 years ago

I agree with Lucille, but I also think option B is important for ensuring data protection.

Lucille 2 years ago

I think it's option A, because consent is a key aspect of GDPR compliance.

IAPP CIPM Exam - Topic 6 Question 77 Discussion