nerdexam
IAPP

CIPP-E · Question #176

CIPP-E Question #176: Real Exam Question with Answer & Explanation

The correct answer is D. ABC Hotel Chain and XYZ Travel Agency are joint controllers.. ABC Hotel Chain and XYZ Travel Agency are joint controllers in this relationship, because they jointly determine the purposes and means of the processing of personal data of their customers. According to Article 26 of the GDPR, joint controllers are two or more controllers who jo

Question

SCENARIO Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data. Mike, an EU resident, has booked travel itineraries in the past through XYZ Travel Agency to stay at ABC Hotel Chain's locations. XYZ Travel Agency offers a rewards program that allows customers to sign up to accumulate points that can later be redeemed for free travel. Mike has signed the agreement to be a rewards program member. Now Mike wants to know what personal information the company holds about him. He sends an email requesting access to his data, in order to exercise what he believes are his data subject rights. What are ABC Hotel Chain and XYZ Travel Agency's roles in this relationship?

Options

  • AABC Hotel Chain is the controller and XYZ Travel Agency is the processor.
  • BXYZ Travel Agency is the controller and ABC Hotel Chain is the processor.
  • CABC Hotel Chain and XYZ Travel Agency are independent controllers.
  • DABC Hotel Chain and XYZ Travel Agency are joint controllers.

Explanation

ABC Hotel Chain and XYZ Travel Agency are joint controllers in this relationship, because they jointly determine the purposes and means of the processing of personal data of their customers. According to Article 26 of the GDPR, joint controllers are two or more controllers who jointly participate in the decision-making process regarding the processing of personal data. In this scenario, ABC Hotel Chain and XYZ Travel Agency use a common platform for collecting and sharing customer data, and they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data. Therefore, they have a common influence on the processing of personal data and share a common objective of integrating their marketing efforts. Moreover, they offer a rewards program that allows customers to sign up to accumulate points that can be redeemed for free travel, which implies a joint benefit from the processing of

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CIPP-E Practice