CIPP-E Exam QuestionsBrowse all questions from this exam

CIPP-E Exam - Question 69


SCENARIO -

Please use the following to answer the next question:

T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies.

T-Craze also opened various office locations throughout Europe to help expand its business. While Germany continued to host T-Craze’s headquarters and main product-design office, its French affiliate became responsible for all marketing and sales activities. The French affiliate recently procured the services of Right Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T-Craze, though with much less success.

The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze.

Which of the following is T-Craze’s lead supervisory authority?

Show Answer
Correct Answer: B

France is T-Craze’s lead supervisory authority because the French affiliate is responsible for all marketing and sales activities, including the processing of personal information. According to GDPR guidelines, the lead supervisory authority is usually where the main establishment involved in data processing activities is located. Since the marketing and processing of personal data are conducted by the French affiliate, France is the correct answer.

Discussion

5 comments
Sign in to comment
FDFDSFDSFOption: B
Aug 1, 2023

I agree with that. It is where the primary control of the data processing is occurring. The marketing occurs there and that office entered into the agreement, presumably specifying the terms of the processing.

FendouOption: B
Apr 30, 2023

Should be France isn't it?

Claire0911Option: B
Oct 7, 2023

The answer is B.

tubcippe
Nov 14, 2023

https://gdpr-info.eu/recitals/no-124/

hele_meneerOption: B
Jan 1, 2024

Art. 56.1 & art. 4.16 GDPR: T-Craze is controller - the French affiliate is responsible for the processing of pi. -> France is the country of main establishment.