CIPP E EXAM STUDY GUIDE 2026
COMPLETE QUESTIONS AND ANSWERS
GRADED A+
⩥ What are main points of CLOUD Act? Answer: 1. Applies to
information anywhere in the world if data is in the "possession, custody
or control" of the recipient of the warrant.
2. A recipient can seek to quash the subpoena if it can show that the
affected individual is not a United States person and that the required
disclosure of that individual's data would violate the laws of a
"qualifying foreign government".
3. Third, requires courts considering a motion to quash to conduct a
comity analysis.
⩥ What is a "qualifying foreign government" under the CLOUD Act?
Answer: Those who have signed an executive agreement with the United
States to cooperate in cross-border data access. To qualify, a foreign
government would need the approval of the State Department and the
U.S. Department of Justice. They would also have to agree to adhere to
significant substantive and procedural privacy and civil liberties
protections.
⩥ What factors are considered in a comity analysis under the CLOUD
Act? Answer: 1. Location of the target
2. Nationalities involved
,3. Alternative avenues to the data
4. Interests of the United States
5. Interests of the foreign sovereign
⩥ What are the 6 European Institutions Answer: 1. Council of Europe
2. European Court of Human Rights
3. European Parliament
4. European Commission
5. European Council
6. European Court of Justice
⩥ What is the legislative Framework for EU Privacy? Answer: 1. The
Council of Europe Convention for the Protection of Individuals with
Regard to the Automatic Processing of Personal Data of 1981 (CoE
Convention)
2. EU Data Protection Directive (95/46/EC)
3. EU Directive on Privacy and Electronic Communications
(2002/58/EC), as amended
4. EU Directive on Electronic Commerce (2000/31/EC)
5. European data retention regimes
6. GDPR
,⩥ What are the 6 data protection principles Answer: 1. Fairness and
lawfulness
2. Purpose limitation
3. Proportionality
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
⩥ What are the 5 Legitimate Processing Criteria? Answer: 1. Consent
2. Contractual necessity
3. Legal obligation, vital interests, public interests
4. Legitimate interests
5. Special categories of processing
⩥ What are 7 Data Subject Rights? Answer: 1. Access
2. Rectification
3. Erasure and Right to be Forgotten
4. Restriction and objection
5. Automated decision making, including profiling
6. Data portability
7. Restrictions
, ⩥ What is the Treaty of Lisbon? Answer: "On 13 December 2007, the
Treaty of Lisbon ('Lisbon Treaty') was signed by the EU member states;
it became effective 1 December 2009. Its main aim is to strengthen and
improve the core structures of the European Union to enable it to
function more efficiently."
⩥ Article 1 Answer: Subject matter and objectives
⩥ Article 2 Answer: Material scope
⩥ Article 3 Answer: Territorial scope
⩥ Article 4 Answer: Definitions
⩥ Article 5 Answer: Principles relating to processing of personal data
⩥ Article 6 Answer: Lawfulness of processing
⩥ Article 7 Answer: Conditions for consent
⩥ Article 8 Answer: Conditions applicable to child's consent in relation
to information society services
COMPLETE QUESTIONS AND ANSWERS
GRADED A+
⩥ What are main points of CLOUD Act? Answer: 1. Applies to
information anywhere in the world if data is in the "possession, custody
or control" of the recipient of the warrant.
2. A recipient can seek to quash the subpoena if it can show that the
affected individual is not a United States person and that the required
disclosure of that individual's data would violate the laws of a
"qualifying foreign government".
3. Third, requires courts considering a motion to quash to conduct a
comity analysis.
⩥ What is a "qualifying foreign government" under the CLOUD Act?
Answer: Those who have signed an executive agreement with the United
States to cooperate in cross-border data access. To qualify, a foreign
government would need the approval of the State Department and the
U.S. Department of Justice. They would also have to agree to adhere to
significant substantive and procedural privacy and civil liberties
protections.
⩥ What factors are considered in a comity analysis under the CLOUD
Act? Answer: 1. Location of the target
2. Nationalities involved
,3. Alternative avenues to the data
4. Interests of the United States
5. Interests of the foreign sovereign
⩥ What are the 6 European Institutions Answer: 1. Council of Europe
2. European Court of Human Rights
3. European Parliament
4. European Commission
5. European Council
6. European Court of Justice
⩥ What is the legislative Framework for EU Privacy? Answer: 1. The
Council of Europe Convention for the Protection of Individuals with
Regard to the Automatic Processing of Personal Data of 1981 (CoE
Convention)
2. EU Data Protection Directive (95/46/EC)
3. EU Directive on Privacy and Electronic Communications
(2002/58/EC), as amended
4. EU Directive on Electronic Commerce (2000/31/EC)
5. European data retention regimes
6. GDPR
,⩥ What are the 6 data protection principles Answer: 1. Fairness and
lawfulness
2. Purpose limitation
3. Proportionality
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
⩥ What are the 5 Legitimate Processing Criteria? Answer: 1. Consent
2. Contractual necessity
3. Legal obligation, vital interests, public interests
4. Legitimate interests
5. Special categories of processing
⩥ What are 7 Data Subject Rights? Answer: 1. Access
2. Rectification
3. Erasure and Right to be Forgotten
4. Restriction and objection
5. Automated decision making, including profiling
6. Data portability
7. Restrictions
, ⩥ What is the Treaty of Lisbon? Answer: "On 13 December 2007, the
Treaty of Lisbon ('Lisbon Treaty') was signed by the EU member states;
it became effective 1 December 2009. Its main aim is to strengthen and
improve the core structures of the European Union to enable it to
function more efficiently."
⩥ Article 1 Answer: Subject matter and objectives
⩥ Article 2 Answer: Material scope
⩥ Article 3 Answer: Territorial scope
⩥ Article 4 Answer: Definitions
⩥ Article 5 Answer: Principles relating to processing of personal data
⩥ Article 6 Answer: Lawfulness of processing
⩥ Article 7 Answer: Conditions for consent
⩥ Article 8 Answer: Conditions applicable to child's consent in relation
to information society services
