CIPP-E Dumps With Exact Questions and Answers

The CJEU ruled that the consent required by the ePrivacy Directive for the use of cookies must comply with the conditions laid down in the GDPR, which means that it must be specific, informed, unambiguous, and freely given. Therefore, pre-checked boxes or implied consent by scrolling are not valid forms of consent for cookies. The CJEU also clarified that the ePrivacy Directive applies to any information stored or accessed on a user’s device, regardless of whether it is personal data or not. Furthermore, the CJEU stated that the information provided to users about cookies must include the duration of the operation of cookies and the possibility of third parties accessing them.

Cross-border processing is defined in Article 4(23) of the GDPR as either:

• processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or

• processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

Therefore, the factors that are relevant for identifying whether the processing could be considered a cross-border processing are:

• the location and number of establishments of the controller or processor in the EU;

• the connection between the processing and the activities of the establishments;

• the substantial effect or likelihood of substantial effect on data subjects in more than one Member State.

The total number of the data subjects interested is not necessarily a factor, as the processing could affect only a few data subjects but still have a substantial impact on them. For example, a processing that involves the disclosure of sensitive personal data of a small group of data subjects in different Member States could be considered a cross-border processing.

 The GDPR states that the parental consent mechanism generally applies when the child is younger than 16 years 1 .  Processing personal data will be lawful only if the child’s parent or custodian has consented to such processing 2 .  However, Member States are allowed to lower this threshold in national legislation up to 13 years old 3 . This means that Member States have some choice regarding the age limit for children’s consent, as long as it is not below 13 years.  The GDPR also requires that the consent request is clear and understandable for the child, and that the controller makes reasonable efforts to verify that the consent is given or authorised by the holder of parental responsibility 4 .  References:   CIPP/E Certification - International Association of Privacy Professionals ,  Free CIPP/E Study Guide - International Association of Privacy Professionals ,  GDPR - EUR-Lex ,  Complying with the GDPR when vulnerable people use smart devices

I hope this helps. If you have any other questions, please let me know. ???? .