IAPP Exam CIPP-E Topic 2 Question 68 Discussion

Actual exam question for IAPP's CIPP-E exam

Question #: 68
Topic #: 2

Article 9 of the GDPR lists exceptions to the general prohibition against processing biometric dat

a. Which of the following is NOT one of these exceptions?

AThe processing is done by a non-profit organization and the results are disclosed outside the organization.

BThe processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.

CThe processing is necessary for the establishment, exercise or defense of legal claims when courts are acting in a judicial capacity.

DThe processing is explicitly consented to by the data subject and he or she is allowed by Union or Member State law to lift the prohibition.

Show Suggested Answer

Suggested Answer: B

by Sabra at Mar 29, 2023, 01:26 PM

Limited Time Offer

25%

Off

Get Premium CIPP-E Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Cornell

3 months ago

Ah, the GDPR - the gift that keeps on giving when it comes to tricky exam questions. *shakes head*

upvoted 0 times

...

Felicidad

3 months ago

Wait, the GDPR has exceptions for biometric data processing? I thought it was supposed to be ironclad! *chuckles*

upvoted 0 times

Bernadine

1 months ago

D) The processing is explicitly consented to by the data subject and he or she is allowed by Union or Member State law to lift the prohibition.

upvoted 0 times

...

Alyce

1 months ago

C) The processing is necessary for the establishment, exercise or defense of legal claims when courts are acting in a judicial capacity.

upvoted 0 times

...

Kirk

1 months ago

B) The processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.

upvoted 0 times

...

Herminia

2 months ago

A) The processing is done by a non-profit organization and the results are disclosed outside the organization.

upvoted 0 times

...

Loren

3 months ago

D has to be the correct answer. If the data subject explicitly consents and the law allows it, then the processing is permitted.

upvoted 0 times

Edda

2 months ago

C) The processing is necessary for the establishment, exercise or defense of legal claims when courts are acting in a judicial capacity.

upvoted 0 times

...

Bulah

2 months ago

B) The processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.

upvoted 0 times

...

Buddy

3 months ago

A) The processing is done by a non-profit organization and the results are disclosed outside the organization.

upvoted 0 times

...

Wilda

4 months ago

I'm going with C. Processing for legal claims seems like a reasonable exception to the biometric data prohibition.

upvoted 0 times

Chana

2 months ago

User1: True, but I still think C is the most reasonable exception.

upvoted 0 times

...

Cory

2 months ago

User2: I think D is also a valid exception, if the data subject consents.

upvoted 0 times

...

Glory

3 months ago

User1: I agree, processing for legal claims makes sense.

upvoted 0 times

...

Laquanda

3 months ago

I'm not sure about option A, processing by a non-profit organization seems a bit questionable.

upvoted 0 times

...

Stefania

3 months ago

I think option D is also a valid exception, if the data subject consents.

upvoted 0 times

...

Latonia

3 months ago

I agree, processing for legal claims makes sense as an exception.

upvoted 0 times

...

Mila

4 months ago

B is the obvious choice here. The GDPR allows processing biometric data to protect the vital interests of an incapable data subject.

upvoted 0 times

...

Krissy

4 months ago

I see your point, but I still think it's A because non-profit organizations are exempt from the prohibition.

upvoted 0 times

...

Leonard

4 months ago

No, I believe the correct answer is D.

upvoted 0 times

...

Carolynn

4 months ago

Option A doesn't seem right. The GDPR has strict requirements for non-profit organizations processing biometric data, even if it's disclosed outside the organization.

upvoted 0 times

Brent

3 months ago

B) The processing is necessary to protect the vital interests of the data subject when he or she is incapable of giving consent.

upvoted 0 times

...

Eve

4 months ago

A) The processing is done by a non-profit organization and the results are disclosed outside the organization.

upvoted 0 times

...

Krissy

4 months ago

I think the answer is A.

upvoted 0 times

...