IAPP CIPP-E Exam - Topic 2 Question 102 Discussion

Actual exam question for IAPP's CIPP-E exam

Question #: 102
Topic #: 2

SCENARIO - Please use the following to answer the next question:

It has been a tough season for the Spanish Handball League, with acts of violence and racism having increased exponentially during their last few matches.

In order to address this situation, the Spanish Minister of Sports, in conjunction with the National Handball League Association, issued an Administrative Order (the "Act") obliging all the professional clubs to install a fingerprint-reading system for accessing some areas of the sports halls, primarily the ones directly behind the goalkeepers. The rest of the areas would retain the current access system, which allows any spectators access as long as they hold valid tickets.

The Act named a selected hardware and software provider, New Digital Finger, Ltd., for the creation of the new fingerprint system. Additionally, it stipulated that any of the professional clubs that failed to install this system within a two-year period would face fines under the Act.

The Murla HB Club was the first to install the new system, renting the New Digital Finger hardware and software. Immediately afterward, the Murla HB Club automatically renewed current supporters' subscriptions, while introducing a new contractual clause requiring supporters to access specific areas of the hall through the new fingerprint reading system installed at the gates.

After the first match hosted by the Murla HB Club, a local supporter submitted a complaint to the club and to the Spanish Data Protection Authority (the AEPD), claiming that the new access system violates EU data protection laws. Having been notified by the AEPD of the upcoming investigation regarding this complaint, the Murla HB Club immediately carried out a Data Protection Impact Assessment (DPIA), the conclusions of which stated that the new access system did not pose any high risks to data subjects' privacy rights.

The Murla HB Club should have carried out a DPIA before the installation of the new access system and at what other time?

AAfter the complaint of the supporter.

BPeriodically, when new risks were foreseen.

CAt the end of every match of the season.

DAfter the AEPD notification of the investigation.

Show Suggested Answer

Suggested Answer: B

A DPIA is not a one-time activity. While it's crucial to conduct a DPIA before implementing a new system that processes personal data (like the fingerprint system), the GDPR requires organizations to review and update their DPIAs periodically, especially when there are changes that might affect the risk to data subjects.

Here's why the other options are incorrect:

A . After the complaint of the supporter: While a complaint might trigger a review of the processing, the DPIA should have been done proactively before any issues arose.

C . At the end of every match of the season: This frequency is excessive and doesn't align with the idea of assessing risks when changes occur.

D . After the AEPD notification of the investigation: Similar to option A, this is reactive rather than proactive.

GDPR Article 35 - Data protection impact assessment

IAPP CIPP/E textbook, Chapter 4: Accountability and Data Governance (specifically, sections on DPIAs and ongoing review)

WP29 Guidelines on Data Protection Impact Assessment (DPIA)

by Aja at Jan 27, 2025, 03:34 PM

Limited Time Offer

25%

Off

Get Premium CIPP-E Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Miesha

3 months ago

Not sure if fingerprinting is the best solution for this issue...

upvoted 0 times

...

Meghann

4 months ago

I think they should do it periodically, not just after complaints.

upvoted 0 times

...

Refugia

4 months ago

Wait, they didn't do a DPIA before installing? That's a huge oversight!

upvoted 0 times

...

Chau

4 months ago

Totally agree, something had to be done!

upvoted 0 times

...

Luis

4 months ago

Did you see the violence in the last matches? It's out of control!

upvoted 0 times

...

Launa

5 months ago

I thought we learned that DPIAs are required when there's a high risk to privacy rights. So, I guess they should have done one after the complaint, which makes me think option A could be correct.

upvoted 0 times

...

Casandra

5 months ago

This situation reminds me of a practice question we had about data protection assessments. I think the DPIA should be done after any significant changes, but I’m not confident about the timing.

upvoted 0 times

...

Berry

5 months ago

I'm not entirely sure, but I feel like they should have done another DPIA after the AEPD notification. That seems like a critical moment for reassessing risks. Maybe option D?

upvoted 0 times

...

Leonie

5 months ago

I remember we discussed DPIAs in class, and I think they should be done periodically, especially when new risks come up. So, I might lean towards option B.

upvoted 0 times

...

Armando

5 months ago

The key here is that the club was required to install the new system within a 2-year period. So I think the DPIA should have been done before the installation, not just after the complaint. That way they could have identified and addressed any issues upfront.

upvoted 0 times

...

Mi

5 months ago

I feel pretty confident about this one. Based on the information provided, the club should have conducted the DPIA before installing the new fingerprint system, not just after the complaint was filed. That seems like the logical time to assess the potential privacy risks.

upvoted 0 times

...

Dottie

5 months ago

Hmm, I'm a bit confused on the timing here. The question mentions the club should have done the DPIA at another time, but I'm not sure if that's before the installation or at some other point. I'll need to re-read the details carefully to figure out the right answer.

upvoted 0 times

...

Verona

5 months ago

Okay, I think I've got this. The club should have done the DPIA before installing the new system, since that's when the potential risks would have been identified. The fact that they only did it after the complaint is a bit concerning.

upvoted 0 times

...

Asuncion

5 months ago

This question seems straightforward, but I want to make sure I understand the key details before answering. The new fingerprint system was mandated by the government, and the club conducted a DPIA after a complaint was filed. I'll need to carefully consider when the DPIA should have been done based on the requirements.

upvoted 0 times

...

Rosio

1 year ago

I think they should have done it periodically, to stay ahead of any new risks that may arise.

upvoted 0 times

...

Lucina

1 year ago

Haha, imagine if they had to do a DPIA after every single match. The poor data protection officer would never get a break!

upvoted 0 times

Shawn

12 months ago

B) Periodically, when new risks were foreseen.

upvoted 0 times

...

Kandis

12 months ago

A) After the complaint of the supporter.

upvoted 0 times

...

Emmett

1 year ago

Hmm, I'd say the club should do the DPIA periodically, not just once. Technology and data protection laws are always evolving, so they need to stay on top of it.

upvoted 0 times

Reiko

11 months ago

Absolutely, staying ahead of any potential risks is crucial in this situation.

upvoted 0 times

...

Dick

11 months ago

I think that would be the best approach to ensure they are always in compliance with data protection laws.

upvoted 0 times

...

Noe

12 months ago

Yeah, it's better to be proactive and prevent any potential issues.

upvoted 0 times

...

Veronika

12 months ago

I agree, they should definitely do it periodically to stay compliant.

upvoted 0 times

...

Cordelia

1 year ago

I believe they should have, to address any potential privacy concerns raised by the complaint.

upvoted 0 times

...

Roosevelt

1 year ago

I agree, the DPIA should have been done before the installation. The club can't just wait for a complaint or an investigation to start - they need to be proactive in protecting people's privacy.

upvoted 0 times

Salome

11 months ago

It's important to take action when notified by the authorities.

upvoted 0 times

...

Willodean

11 months ago

D) After the AEPD notification of the investigation.

upvoted 0 times

...

Jacquelyne

12 months ago

That's a good point, they should regularly assess the risks.

upvoted 0 times

...

Andrew

12 months ago

B) Periodically, when new risks were foreseen.

upvoted 0 times

...

Denae

1 year ago

I think they should have done it before installing the system.

upvoted 0 times

...

Ruth

1 year ago

A) After the complaint of the supporter.

upvoted 0 times

...

Glen

1 year ago

But what about after the complaint of the supporter? Shouldn't they have done a DPIA then too?

upvoted 0 times

...

Lorriane

1 year ago

The Murla HB Club should have conducted the DPIA before installing the new access system. That's the whole point of a DPIA - to assess the risks before implementing a new technology that processes personal data.

upvoted 0 times