Discuss IAPP CIPP/E Exam Topic 2 Question 102

SCENARIO - Please use the following to answer the next question:

It has been a tough season for the Spanish Handball League, with acts of violence and racism having increased exponentially during their last few matches.

In order to address this situation, the Spanish Minister of Sports, in conjunction with the National Handball League Association, issued an Administrative Order (the "Act") obliging all the professional clubs to install a fingerprint-reading system for accessing some areas of the sports halls, primarily the ones directly behind the goalkeepers. The rest of the areas would retain the current access system, which allows any spectators access as long as they hold valid tickets.

The Act named a selected hardware and software provider, New Digital Finger, Ltd., for the creation of the new fingerprint system. Additionally, it stipulated that any of the professional clubs that failed to install this system within a two-year period would face fines under the Act.

The Murla HB Club was the first to install the new system, renting the New Digital Finger hardware and software. Immediately afterward, the Murla HB Club automatically renewed current supporters' subscriptions, while introducing a new contractual clause requiring supporters to access specific areas of the hall through the new fingerprint reading system installed at the gates.

After the first match hosted by the Murla HB Club, a local supporter submitted a complaint to the club and to the Spanish Data Protection Authority (the AEPD), claiming that the new access system violates EU data protection laws. Having been notified by the AEPD of the upcoming investigation regarding this complaint, the Murla HB Club immediately carried out a Data Protection Impact Assessment (DPIA), the conclusions of which stated that the new access system did not pose any high risks to data subjects' privacy rights.

The Murla HB Club should have carried out a DPIA before the installation of the new access system and at what other time?

AAfter the complaint of the supporter.

BPeriodically, when new risks were foreseen.

CAt the end of every match of the season.

DAfter the AEPD notification of the investigation.

Suggested Answer: B

A DPIA is not a one-time activity. While it's crucial to conduct a DPIA before implementing a new system that processes personal data (like the fingerprint system), the GDPR requires organizations to review and update their DPIAs periodically, especially when there are changes that might affect the risk to data subjects.

Here's why the other options are incorrect:

A . After the complaint of the supporter: While a complaint might trigger a review of the processing, the DPIA should have been done proactively before any issues arose.

C . At the end of every match of the season: This frequency is excessive and doesn't align with the idea of assessing risks when changes occur.

D . After the AEPD notification of the investigation: Similar to option A, this is reactive rather than proactive.

GDPR Article 35 - Data protection impact assessment

IAPP CIPP/E textbook, Chapter 4: Accountability and Data Governance (specifically, sections on DPIAs and ongoing review)

WP29 Guidelines on Data Protection Impact Assessment (DPIA)

Get Premium CIPP/E Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

37 comments · newest first

Miesha 11 months ago

Not sure if fingerprinting is the best solution for this issue...

Meghann 11 months ago

I think they should do it periodically, not just after complaints.

Refugia 12 months ago

Wait, they didn't do a DPIA before installing? That's a huge oversight!

Chau 12 months ago

Totally agree, something had to be done!

Luis 1 year ago

Did you see the violence in the last matches? It's out of control!

Launa 1 year ago

I thought we learned that DPIAs are required when there's a high risk to privacy rights. So, I guess they should have done one after the complaint, which makes me think option A could be correct.

Casandra 1 year ago

This situation reminds me of a practice question we had about data protection assessments. I think the DPIA should be done after any significant changes, but I’m not confident about the timing.

Berry 1 year ago

I'm not entirely sure, but I feel like they should have done another DPIA after the AEPD notification. That seems like a critical moment for reassessing risks. Maybe option D?

Leonie 1 year ago

I remember we discussed DPIAs in class, and I think they should be done periodically, especially when new risks come up. So, I might lean towards option B.

Armando 1 year ago

The key here is that the club was required to install the new system within a 2-year period. So I think the DPIA should have been done before the installation, not just after the complaint. That way they could have identified and addressed any issues upfront.

Mi 1 year ago

I feel pretty confident about this one. Based on the information provided, the club should have conducted the DPIA before installing the new fingerprint system, not just after the complaint was filed. That seems like the logical time to assess the potential privacy risks.

Dottie 1 year ago

Hmm, I'm a bit confused on the timing here. The question mentions the club should have done the DPIA at another time, but I'm not sure if that's before the installation or at some other point. I'll need to re-read the details carefully to figure out the right answer.

Verona 1 year ago

Okay, I think I've got this. The club should have done the DPIA before installing the new system, since that's when the potential risks would have been identified. The fact that they only did it after the complaint is a bit concerning.

Asuncion 1 year ago

This question seems straightforward, but I want to make sure I understand the key details before answering. The new fingerprint system was mandated by the government, and the club conducted a DPIA after a complaint was filed. I'll need to carefully consider when the DPIA should have been done based on the requirements.

Rosio 2 years ago

I think they should have done it periodically, to stay ahead of any new risks that may arise.

Lucina 2 years ago

Haha, imagine if they had to do a DPIA after every single match. The poor data protection officer would never get a break!

Shawn 2 years ago

↳ replying to Lucina

B) Periodically, when new risks were foreseen.

Kandis 2 years ago

↳ replying to Lucina

A) After the complaint of the supporter.

Emmett 2 years ago

Hmm, I'd say the club should do the DPIA periodically, not just once. Technology and data protection laws are always evolving, so they need to stay on top of it.

Reiko 2 years ago

↳ replying to Emmett

Absolutely, staying ahead of any potential risks is crucial in this situation.

Dick 2 years ago

↳ replying to Emmett

I think that would be the best approach to ensure they are always in compliance with data protection laws.

Noe 2 years ago

↳ replying to Emmett

Yeah, it's better to be proactive and prevent any potential issues.

Veronika 2 years ago

↳ replying to Emmett

I agree, they should definitely do it periodically to stay compliant.

Cordelia 2 years ago

I believe they should have, to address any potential privacy concerns raised by the complaint.

Roosevelt 2 years ago

I agree, the DPIA should have been done before the installation. The club can't just wait for a complaint or an investigation to start - they need to be proactive in protecting people's privacy.

Salome 2 years ago

↳ replying to Roosevelt

It's important to take action when notified by the authorities.

Willodean 2 years ago

↳ replying to Roosevelt

D) After the AEPD notification of the investigation.

Jacquelyne 2 years ago

↳ replying to Roosevelt

That's a good point, they should regularly assess the risks.

Andrew 2 years ago

↳ replying to Roosevelt

B) Periodically, when new risks were foreseen.

Denae 2 years ago

↳ replying to Roosevelt

I think they should have done it before installing the system.

Ruth 2 years ago

↳ replying to Roosevelt

A) After the complaint of the supporter.

Glen 2 years ago

But what about after the complaint of the supporter? Shouldn't they have done a DPIA then too?

Lorriane 2 years ago

The Murla HB Club should have conducted the DPIA before installing the new access system. That's the whole point of a DPIA - to assess the risks before implementing a new technology that processes personal data.

Joaquin 2 years ago

↳ replying to Lorriane

User 2

Emerson 2 years ago

↳ replying to Lorriane

User 1

Rosio 2 years ago

I agree with Cordelia, it's important to assess data protection risks before implementing new systems.

Cordelia 2 years ago

I think the Murla HB Club should have carried out a DPIA before the installation of the new access system.

IAPP CIPP/E Exam - Topic 2 Question 102 Discussion