IAPP CIPP/US Exam - Topic 7 Question 54 Discussion

Actual exam question for IAPP's CIPP/US exam

Question #: 54
Topic #: 7

SCENARIO

Please use the following to answer the next QUESTION:

A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.

The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal dat

a. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: ''Please act immediately by identifying all personal data received from our company.''

This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.

As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.

Under the GDPR, the complainant's request regarding her personal information is known as what?

ARight of Access

BRight of Removal

CRight of Rectification

DRight to Be Forgotten

Show Suggested Answer

Suggested Answer: B

by Novella at Mar 04, 2024, 11:40 PM

Limited Time Offer

25%

Off

Get Premium CIPP/US Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Yolande

4 months ago

Yup, Right of Removal makes sense here too!

upvoted 0 times

...

King

4 months ago

Right of Access is also a thing, but this case is about erasure.

upvoted 0 times

...

Katy

4 months ago

Wait, are we sure about that? Sounds like a tricky situation.

upvoted 0 times

...

Chantell

4 months ago

Totally agree, that’s definitely what it is.

upvoted 0 times

...

Erin

4 months ago

It's the Right to Be Forgotten under GDPR!

upvoted 0 times

...

Paola

5 months ago

I’m leaning towards "Right to Be Forgotten" since it specifically deals with erasure requests, but I could be mixing it up with another concept.

upvoted 0 times

...

Lacey

5 months ago

The "Right of Removal" sounds familiar, but I feel like it might not be the correct terminology. Maybe it’s more about the right to erase data?

upvoted 0 times

...

Aja

5 months ago

I remember practicing a question about data rights, and I think the "Right of Access" was about seeing your data, not removing it.

upvoted 0 times

...

Joanna

5 months ago

I think the request for erasure is related to the "Right to Be Forgotten," but I'm not entirely sure if that's the exact term used in the GDPR.

upvoted 0 times

...

Murray

5 months ago

I'm a bit confused on the difference between the Right to Be Forgotten and the Right of Rectification under GDPR. I'll need to make sure I understand the specifics of each one before answering this type of question.

upvoted 0 times

...

Cristal

5 months ago

Okay, I've got this. The complainant is asking for their personal data to be erased, which is the Right to Be Forgotten under GDPR. That's the correct answer here.

upvoted 0 times

...

Georgeanna

5 months ago

Hmm, I'm not totally sure about this one. The question mentions a withdrawal of consent and a request for erasure, but I'm not certain if that falls under the Right to Be Forgotten or some other GDPR right. I'll need to review the GDPR details more carefully.

upvoted 0 times

...

Emmett

5 months ago

I think this is a Right to Be Forgotten request under GDPR. The complainant is asking for their personal data to be erased, which is a key part of that right.

upvoted 0 times

...

Nicholle

6 months ago

Hmm, this is a tricky one. I remember security filters are used for access control, so that's one. They're also used to manage application users, right? And I think they provide some kind of risk governance, but I'm not 100% sure about that one. I'll have to think it through carefully.

upvoted 0 times

...

Alex

6 months ago

Ah, I see what's going on now. The question is asking if this is the expected behavior, and the solution confirms that yes, only the groups are imported during an incremental update. I'm feeling more confident about this one.

upvoted 0 times

...

Quiana

6 months ago

I'm feeling confident about this one. I just need to identify the three correct actions from the options provided.

upvoted 0 times

...

Paulene

6 months ago

Hmm, I'm a bit unsure about this one. The question is asking specifically about the operations the Manager faces with the Loader, so I'll need to think carefully about the relationship between those two components.

upvoted 0 times

...

Dalene

10 months ago

I bet the startup's CEO is wishing they could use the 'right to be forgotten' on this whole mess. Maybe they should just change their name and start over!

upvoted 0 times

Rosita

9 months ago

A: I agree, it's important to handle this situation properly to maintain the partnership and trust with their European fans.

upvoted 0 times

...

Tequila

9 months ago

B: Yeah, they should definitely cooperate with the investigation and identify all personal data received from the retailer.

upvoted 0 times

...

Lovetta

9 months ago

A: They can't just change their name and start over, they need to address the issue with the EU-based retailer.

upvoted 0 times

...

Emiko

10 months ago

D) Right to Be Forgotten, easy peasy. The EU takes this stuff seriously, so the startup better act fast or they'll be in hot water!

upvoted 0 times

Shenika

9 months ago

The Right to Be Forgotten is a key aspect of GDPR compliance, they can't ignore it.

upvoted 0 times

...

Joaquin

9 months ago

I agree, the startup company needs to act fast and comply with the request for erasure.

upvoted 0 times

...

Kristeen

10 months ago

We need to take this seriously, the EU doesn't mess around with data privacy.

upvoted 0 times

...

Edna

11 months ago

I'll have to go with D) Right to Be Forgotten. It's the only option that really fits the scenario described, where the complainant is demanding the removal of their personal data.

upvoted 0 times

Marcelle

9 months ago

Let's make sure we comply with the GDPR and address this issue promptly.

upvoted 0 times

...

Jessenia

9 months ago

The suspension of data flows could be detrimental to our partnership.

upvoted 0 times

...

Louann

9 months ago

We need to act quickly and identify all personal data received from the retailer.

upvoted 0 times

...

Stefania

10 months ago

Yes, I agree. The Right to Be Forgotten is the most relevant option here.

upvoted 0 times

...

Markus

11 months ago

This is a tricky one, but I think D) Right to Be Forgotten is the way to go. The complainant wants her data erased, so that's the right answer.

upvoted 0 times

...

Samira

11 months ago

The correct answer is D) Right to Be Forgotten. The complainant is clearly requesting the erasure of her personal data, which is a core element of the GDPR's Right to Be Forgotten.

upvoted 0 times