Discuss IAPP CIPP/E Exam Topic 8 Question 85

A company plans to transfer employee health information between two of its entities in France. To maintain the security of the processing, what would be the most important security measure to apply to the health data transmission?

AInform the data subject of the security measures in place.

BEnsure that the receiving entity has signed a data processing agreement.

CEncrypt the transferred data in transit and at rest.

DConduct a data protection impact assessment.

Suggested Answer: A

According to the EDPB Guidelines 05/2020 on consent under Regulation 2016/6791, valid consent for the use of cookies must meet the following conditions:

* It must be freely given, which means that the data subject must have a genuine choice and the ability to refuse or withdraw consent without detriment.

* It must be specific, which means that the data subject must give consent for each distinct purpose of the processing and for each type of cookie.

* It must be informed, which means that the data subject must receive clear and comprehensive information about the identity of the controller, the purposes of the processing, the types of cookies used, the duration of the cookies, and the possibility of withdrawing consent.

* It must be unambiguous, which means that the data subject must express their consent by a clear affirmative action, such as clicking on an ''I agree'' button or selecting specific settings in a cookie banner.

* It must be granular, which means that the data subject must be able to consent to different types of cookies separately, such as essential, functional, performance, or marketing cookies.

Therefore, a ''Cookies Settings'' button is not a necessary element to collect valid consent for the use of cookies, as long as the data subject can exercise their choice and preference through other means, such as a cookie banner with different options. However, a ''Cookies Settings'' button may be a good practice to enhance transparency and user control, as it allows the data subject to access and modify their consent settings at any time.

On the other hand, a ''Reject All'' cookies button is a necessary element to collect valid consent for the use of cookies, as it ensures that the data subject can freely refuse consent without detriment. A list of cookies that may be placed and information on the purpose of the cookies are also necessary elements to collect valid consent for the use of cookies, as they ensure that the data subject is informed and can give specific consent for each type of cookie.

Get Premium CIPP/E Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Amalia 11 months ago

C all the way! Can't be too careful with sensitive info.

Patti 11 months ago

A is nice, but it doesn't really protect the data itself.

Darrin 12 months ago

Surprised that people overlook D, impact assessments are crucial!

Hannah 12 months ago

I think B is super important too, gotta have that agreement.

Tegan 1 year ago

Definitely C, encryption is key for health data!

Tiffiny 1 year ago

Conducting a data protection impact assessment sounds important, but I wonder if it’s as immediate as ensuring data is encrypted during transfer.

Kattie 1 year ago

I vaguely recall something about informing data subjects, but I'm not convinced that's the most critical measure. It seems more like a formality.

Vanesa 1 year ago

I'm not entirely sure, but I feel like a data processing agreement is crucial too. Maybe option B could be a strong contender?

Garry 1 year ago

I remember we discussed the importance of encryption in our last class. I think option C might be the best choice here.

Jodi 1 year ago

Hmm, this is a tricky one. I'm leaning towards the encryption option, but I'm not 100% sure. I'll have to review the material on data security measures again to make sure I'm making the right call here.

Torie 1 year ago

Encrypting the data is definitely the way to go. That will ensure the information is protected during the transfer between the two entities. The other options, like informing the data subject or signing a data processing agreement, are important but not as critical for the actual security of the transmission.

Elsa 1 year ago

I'm a bit unsure about this one. I know we need to ensure the security of the data, but I'm not sure if informing the data subject or conducting a data protection impact assessment would be the most important step here. I'll have to think this through carefully.

Emilio 1 year ago

Hmm, this seems like a tricky one. I think the key here is to focus on the security of the data transmission itself. Encrypting the data in transit and at rest seems like the most important measure to me.

Norah 1 year ago

This looks like a tricky question on cloud governance. I'll need to carefully read through the options and think about the key requirements for a multinational company's IT governance.

Hui 1 year ago

I'm a little confused by the wording here. Is the question asking about the reason the team failed to implement multitopology, or the reason multitopology itself failed? I'll need to re-read this carefully.

Melvin 1 year ago

I feel like 20% sounds familiar from a practice question we did, but then again, the 2000 Census could have different numbers than what we covered.

Carlota 2 years ago

Conduct a data protection impact assessment? What is this, a security quiz for rocket scientists? Encrypt the data, and call it a day!

Dorothea 1 year ago

↳ replying to Carlota

Ensure that the receiving entity has signed a data processing agreement.

Rosalyn 1 year ago

↳ replying to Carlota

Inform the data subject of the security measures in place.

Luis 1 year ago

↳ replying to Carlota

Encrypt the transferred data in transit and at rest.

Theresia 2 years ago

Haha, informing the data subject is like telling a bank robber where the gold is buried. Encryption is the way to go, my friends!

Skye 1 year ago

↳ replying to Theresia

D: It's important to take all necessary measures to protect sensitive information.

Meghann 1 year ago

↳ replying to Theresia

C: Encrypting the data in transit and at rest is crucial for maintaining security.

Benedict 2 years ago

↳ replying to Theresia

B: I agree, informing the data subject could pose a security risk.

Jess 2 years ago

↳ replying to Theresia

A: Encryption is definitely the best way to protect the health data.

Ona 2 years ago

A data processing agreement is important, but encryption is the real deal-breaker here. Gotta keep that data locked down tight!

Mila 2 years ago

I'd go with option C. Encrypting the data both in transit and at rest is crucial to maintaining the security and privacy of the health information.

Dona 1 year ago

↳ replying to Mila

I agree, it's important to protect sensitive health information with encryption.

An 1 year ago

↳ replying to Mila

Option C is definitely the way to go. Encrypting the data will keep it safe.

Sherron 2 years ago

I also believe that conducting a data protection impact assessment would be crucial to identify and mitigate any potential risks.

Leigha 2 years ago

I agree with Adelaide, encrypting the data would ensure the security of the health information during transmission.

Malcolm 2 years ago

Encrypt the data, of course! That's the most important thing to protect sensitive health information. Anything less and it's like leaving the front door wide open.

Adelaide 2 years ago

I think the most important security measure would be to encrypt the transferred data in transit and at rest.

IAPP CIPP/E Exam - Topic 8 Question 85 Discussion