Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

IAPP CIPP-E Exam - Topic 4 Question 115 Discussion

Actual exam question for IAPP's CIPP-E exam
Question #: 115
Topic #: 4
[All CIPP-E Questions]

SCENARIO

Please use the following to answer the next question:

T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies.

T-Craze also opened various office locations throughout Europe to help expand its business. While Germany continued to host T-Craze's headquarters and main product-design office, its French affiliate became responsible for all marketing and sales activities. The French affiliate recently procured the services of Right Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T- Craze, though with much less success.

The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze.

Why does the Spanish supervisory authority notify the French supervisory authority when it opens an investigation into T-Craze based on Sofia's complaint?

Show Suggested Answer Hide Answer
Suggested Answer: C

According to the CIPP/E study guide, Article 56 of the GDPR establishes the concept of the lead supervisory authority, which is the supervisory authority of the main or single establishment of the data controller or processor in the EU1.The lead supervisory authority has the primary responsibility for dealing with cross-border data processing, in cooperation with other concerned supervisory authorities1.Article 60 of the GDPR requires the lead supervisory authority to cooperate with the other supervisory authorities concerned in an endeavour to reach consensus2.The other supervisory authorities concerned are those that are established in a Member State where the data controller or processor has an establishment or where data subjects are substantially affected or likely to be substantially affected by the processing2. In the scenario, T-Craze is a German-headquartered company that has a French affiliate responsible for all marketing and sales activities. Therefore, the French supervisory authority is the lead supervisory authority for the processing of personal data related to the marketing and sales activities of T-Craze, as it is the supervisory authority of the main establishment of the data controller in the EU. The Spanish supervisory authority is a concerned supervisory authority, as it is the supervisory authority of the Member State where data subjects are likely to be substantially affected by the processing, such as Sofia who filed a complaint.Therefore, the Spanish supervisory authority notifies the French supervisory authority when it opens an investigation into T-Craze based on Sofia's complaint, in order to cooperate with the lead supervisory authority and seek consensus on the action to be taken2.Reference:1: CIPP/E study guide, page 87;Art. 56 GDPR;Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)2: CIPP/E study guide, page 88;Art. 60 GDPR;Guidelines 3/2018 on the territorial scope of the GDPR (Article 3).


by Mollie at Nov 22, 2025, 05:00 AM

Limited Time Offer

25%

Off

Get Premium CIPP-E Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Paola
13 days ago
I agree with A. It's all about the affiliate's influence.
upvoted 0 times
...
Frederick
18 days ago
I see D as a possibility. Just a courtesy call.
upvoted 0 times
...
Danilo
24 days ago
I lean towards C. Marketing activities in France matter.
upvoted 0 times
...
Marvel
29 days ago
Definitely A. The affiliate's role is crucial.
upvoted 0 times
...
Adrianna
1 month ago
I think it's A. The French affiliate is key here.
upvoted 0 times
...
Lucina
1 month ago
I disagree, the complaint should stay in Spain only.
upvoted 0 times
...
Kanisha
1 month ago
Wait, why is Spain involved if T-Craze is French?
upvoted 0 times
...
Karol
2 months ago
Totally makes sense, they need to notify France!
upvoted 0 times
...
Tambra
2 months ago
Ah, the joys of cross-border data protection regulations. I wonder if T-Craze has a dedicated GDPR compliance team on payroll.
upvoted 0 times
...
Cordie
2 months ago
I think the correct answer is B. The French affiliate's involvement with the Philippine marketing firm is the key here.
upvoted 0 times
...
Helaine
3 months ago
Haha, I bet the Spanish data protection authority is really cracking down on those pesky unsubscribe requests. Gotta love those bureaucratic headaches!
upvoted 0 times
...
William
3 months ago
Hmm, I'm not sure. Wouldn't the Spanish supervisory authority notify the German supervisory authority since T-Craze is a German-headquartered company?
upvoted 0 times
...
Albina
3 months ago
The answer is B. The French affiliate procured the services of Right Target, a Philippine-based marketing firm, so the Spanish supervisory authority would notify the French supervisory authority about the investigation.
upvoted 0 times
...
Dorsey
3 months ago
I lean towards A as well, but I wonder if B could also be a factor since Right Target is involved. It's tricky!
upvoted 0 times
...
Kimbery
3 months ago
I feel like I saw a similar question about cross-border data issues in our practice exams. Could it be D, just a courtesy notification?
upvoted 0 times
...
Vallie
3 months ago
I'm not entirely sure, but I remember something about how GDPR requires cooperation between authorities when companies operate in multiple countries. Maybe it's C?
upvoted 0 times
...
Youlanda
4 months ago
I think the answer might be A because T-Craze has a French affiliate, which could make it relevant for the French authority.
upvoted 0 times
...
Reita
4 months ago
Hmm, I'm not totally sure. The fact that the complaint came from Spain makes me think there might be more to it. Maybe the Spanish authority is just being courteous in notifying the French one, even though they don't have to? I'm leaning towards D, but I'm not 100% certain.
upvoted 0 times
...
Valentine
4 months ago
I feel pretty confident about this. The French affiliate hired the marketing firm that caused the issue, so the Spanish authority needs to coordinate with the French one since they're responsible for the marketing activities. I'll go with B.
upvoted 0 times
...
Cherrie
4 months ago
I'm a bit confused about why the Spanish supervisory authority would notify the French one. Wouldn't they just handle the complaint directly with T-Craze's French affiliate? I'm not sure about this one.
upvoted 0 times
...
Maryanne
5 months ago
T-Craze has a French affiliate, right?
upvoted 0 times
...
Laurel
5 months ago
A makes sense. The affiliate ties it all together.
upvoted 0 times
...
Tricia
5 months ago
I think it's because of GDPR rules.
upvoted 0 times
...
Chaya
5 months ago
Okay, let's see. The key seems to be that the French affiliate is responsible for the marketing and sales activities, even though the complaint came from Spain. I think the answer is B.
upvoted 0 times
...
Helga
6 months ago
Hmm, this seems like a tricky one. I'll need to carefully read through the details to understand the scenario and the relevant GDPR regulations.
upvoted 0 times
Steffanie
3 days ago
I wonder if the GDPR really requires that notification.
upvoted 0 times
...
Willow
8 days ago
Yeah, but T-Craze's marketing in France is also important.
upvoted 0 times
...
Xochitl
4 months ago
I think the French affiliate plays a big role here.
upvoted 0 times
...
William
5 months ago
This is definitely a complex situation.
upvoted 0 times
...
...

Save Cancel