Discuss IAPP CIPP/E Exam Topic 7 Question 20

In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?

AA medical organization that wants to begin genetic testing to support earlier research for which they have performed a DPIA.

BA data controller who plans to use a new technology product that has already undergone a DPIA by the product's provider.

CA marketing team that wants to collect mailing addresses of customers for whom they already have email addresses.

DA railway operator who plans to evaluate the same video surveillance in all the train stations of his company.

Suggested Answer: D

Get Premium CIPP/E Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Rueben 1 year ago

I’m leaning towards C being a no-go, that’s a bit sketchy.

Goldie 1 year ago

A and D could also be valid, depending on context.

Buck 1 year ago

Wait, can you really do that for multiple operations? Seems risky.

Quiana 1 year ago

Totally agree, B is the way to go!

Sage 1 year ago

I think option B makes sense since the product already had a DPIA.

Regenia 1 year ago

I thought option C was a bit tricky since it involves collecting more data, but I can't recall if that would allow for a single DPIA.

Geraldo 1 year ago

I'm leaning towards A, but I feel like it might depend on how closely related the genetic testing is to the previous DPIA.

Sang 1 year ago

I remember discussing something similar in class about how multiple operations could be assessed together if they are related. Maybe D is a good choice?

Felix 1 year ago

I think option B makes sense because if the technology already had a DPIA, it might cover the new use case. But I'm not entirely sure.

Flo 1 year ago

I'm a bit confused by this one. There are a lot of moving parts in the prompt, and I'm not sure which solution is the best fit. I might need to re-read it a few times to really understand what they're looking for. Any tips on how to approach this type of question?

Leanora 1 year ago

Okay, let's think this through. We want to break down the User Story into smaller, more focused pieces. Splitting it into CRUD operations seems like a good approach to me. I'm going to go with option C.

Luis 1 year ago

Hmm, I'm a bit unsure about the difference between "important risks" and "business risk." I'll need to review my notes on the evolution of the internal audit function to answer this confidently.

IAPP CIPP/E Exam - Topic 7 Question 20 Discussion