nerdexam
IAPP

CIPP-E · Question #242

CIPP-E Question #242: Real Exam Question with Answer & Explanation

The correct answer is A. The total number of the data subjects interested.. Cross-border processing is defined in Article 4(23) of the GDPR as either: - processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor

Question

SCENARIO Please use the following to answer the next question: Financially, it has been a very good year at ARRA Hotels: Their 21 hotels, located in Greece (5), Italy (15) and Spain (1), have registered their most profitable results ever. To celebrate this achievement, ARRA Hotels' Human Resources office, based in ARRA's main Italian establishment, has organized a team event for its 420 employees and their families at its hotel in Spain. Upon arrival at the hotel, each employee and family member is given an electronic wristband at the reception desk. The wristband serves a number of functions: - Allows access to the "party zone" of the hotel, and emits a buzz if the user approaches any unauthorized areas - Allows up to three free drinks for each person of legal age, and emits a buzz once this limit has been reached - Grants a unique ID number for participating in the games and contests that have been planned. Along with the wristband, each guest receives a QR code that leads to the online privacy notice describing the use of the wristband. The page also contains an unchecked consent checkbox. In the case of employee family members under the age of 16, consent must be given by a parent. Among the various activities planned for the event, ARRA Hotels' HR office has autonomously set up a photocall area, separate from the main event venue, where employees can come and have their pictures taken in traditional carnival costume. The photos will be posted on ARRA Hotels' main website for general marketing purposes. On the night of the event, an employee from one of ARRA's Greek hotels is displeased with the results of the photos in which he appears. He intends to file a complaint with the relevant supervisory authority in regard to the following: - The lack of any privacy notice in the separate photocall area - The unlawful cross-border processing of his personal data - The unacceptable aesthetic outcome of his photos Which of the following is NOT necessarily considered a factor in identifying whether the processing could be considered a "cross-border processing"?

Options

  • AThe total number of the data subjects interested.
  • BThe potential harm for the data subjects affected.
  • CThe limitation of rights of the data subjects concerned.
  • DThe exposure of the information of the data subjects involved.

Explanation

Cross-border processing is defined in Article 4(23) of the GDPR as either: - processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or - processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State. Therefore, the factors that are relevant for identifying whether the processing could be considered a cross-border processing - the location and number of establishments of the controller or processor in the EU; - the connection between the processing and the activities of the establishments; - the substantial effect or likelihood of substantial effect on data subjects in more than one The total number of the data subjects interested is not necessarily a factor, as the processing could affect only a few data subjects but still have a substantial impact on them. For example, a processing that involves the disclosure of sensitive personal data of a small group of data subjects in different Member States could be considered a cross-border processing.

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CIPP-E Practice