合格させるPDP9試験問題で実際テストエンジンPDFには42問題あります
最新をゲットせよ！PDP9認定練習テスト問題の試験問題集
BCSデータ保護実践者証明書（PDP9）認定試験は、職場でのデータ保護原則と実践の実際の適用を証明することを目的としたデータ保護分野で認められた専門家認定試験です。この認定試験は、英国のIT専門家の主要な専門団体であるBCS、The Chartered Institute for ITによって提供されています。
PDP9認定試験は、コンピュータベースのテストで、40の複数選択問題で構成されています。受験者は60分間で試験を完了する必要があり、合格点は65％以上である必要があります。
質問 # 24
Two businesses decide to work together to sell their products by mail order Orders are made via a single online website and they each use their existing employees to administer and update each other's orders on a single order system regardless of product.
Which of the below is CORRECT of the roles of the two businesses in relation to the single order system'?
- A. They are both joint controllers of the information contained in the single order system
- B. They are controllers of their own information in the single order system and processors of the information they process on behalf of the other business.
- C. The businesses are controllers of their respective information, and the staff are processors of this information
- D. They are controllers of their own information contained in the single order system only
正解：A
解説：
Explanation
The two businesses are both joint controllers of the information contained in the single order system, because they jointly determine the purposes and means of the processing. They have a shared purpose of selling their products by mail order and they agree on the means of processing by using a single online website and a single order system. Their decisions complement each other and are necessary for the processing to take place. The processing by each party is inseparable and inextricably linked. Therefore, they meet the criteria for joint controllership under the GDPR. References:
* Article 26 of the GDPR1
* Guidelines 07/2020 on the concepts of controller and processor in the GDPR2, pp. 16-24
質問 # 25
Article 57 of the UK GDPR states that the tasks of the Commissioner include -Select the INCORRECT answer
- A. Adopting consistency findings in cross-border data protection cases
- B. Handling complaints raised by individuals/data subjects
- C. Providing general guidance to clarify the law.
- D. Advising UK Parliament on issues related to the protection of personal data
正解：A
解説：
Explanation
Article 57 of the UK GDPR states that the tasks of the Commissioner include handling complaints raised by individuals/data subjects, providing general guidance to clarify the law, and advising UK Parliament on issues related to the protection of personal data, among other tasks. However, adopting consistency findings in cross-border data protection cases is not a task of the Commissioner, but of the European Data Protection Board (EDPB), which is an independent body composed of the heads of the supervisory authorities of the EU and EEA member states and the European Data Protection Supervisor. The EDPB is responsible for ensuring the consistent application of the EU GDPR across the EU and EEA, and for issuing opinions and decisions on matters of general application or affecting more than one member state. The UK is no longer part of the EU or the EEA, and therefore the EDPB does not have jurisdiction over the UK GDPR or the Commissioner. The UK has its own mechanism for ensuring consistency and cooperation with other countries, which involves the Commissioner and the Secretary of State. References:
* Article 57 of the UK GDPR1
* Article 63 and 64 of the EU GDPR4
* ICO guidance on the UK GDPR and the EU GDPR5
質問 # 26
In which of the following circumstances would Privacy and Electronic Communications Regulation (PECR) NOT apply?
- A. Email marketing communications
- B. Telephone marketing communications
- C. Text marketing communications.
- D. Postal marketing communications.
正解：D
解説：
Explanation
The Privacy and Electronic Communications Regulations (PECR) are a set of rules that regulate the use of electronic communications for marketing purposes, as well as the use of cookies and similar technologies, and the security and privacy of electronic communications services. PECR apply to all organisations that market by phone, email, text, fax, or online, or that use cookies or similar technologies on their websites or other electronic services. PECR do not apply to postal marketing communications, which are not considered electronic communications under the definition of PECR. However, postal marketing communications may still be subject to the UK GDPR and the Data Protection Act 2018, as well as other regulations, such as the Consumer Protection from Unfair Trading Regulations 2008 and the Advertising Standards Authority codes of practice. References:
* ICO Guide to PECR, What are PECR?4
* ICO Guide to PECR, Electronic and telephone marketing5
質問 # 27
When does a personal data breach need to be reported to a supervisory authority?
- A. Only where a disclosure is of special category data
- B. When the controller's right of freedom of expression outweighs the data subject's right to a private home and family life.
- C. Where the personal data breach is likely to result in a risk to the rights and freedoms of natural persons.
- D. All personal data breaches must be reported to a supervisory authority
正解：C
解説：
Explanation
Article 33 of the UK GDPR requires controllers to notify the supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. This means that not all personal data breaches need to be reported to the supervisory authority, only those that pose a risk to individuals. The risk should be assessed in terms of the potential negative consequences for individuals, such as discrimination, identity theft, fraud, financial loss, damage to reputation, loss of confidentiality, or any other significant economic or social disadvantage. The UK GDPR also requires controllers to communicate the personal data breach to the affected data subjects without undue delay, where the breach is likely to result in a high risk to their rights and freedoms. The other options are incorrect because:
* The UK GDPR does not require all personal data breaches to be reported to the supervisory authority, only those that pose a risk to individuals. However, controllers must document all personal data breaches, regardless of whether they are reported or not, as part of their accountability obligations.
* The UK GDPR does not make a distinction between personal data and special category data when it comes to reporting personal data breaches. Special category data is a type of personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or that concerns health, sex life or sexual orientation, or biometric or genetic data for the purpose of uniquely identifying a natural person. The processing of special category data is subject to stricter conditions and safeguards under the UK GDPR, but the reporting of personal data breaches involving such data is subject to the same criteria as any other personal data breach, namely the risk to individuals.
* The UK GDPR does not provide an exemption from reporting personal data breaches based on the controller's right of freedom of expression. The right of freedom of expression is a fundamental right that is recognised and protected by the UK GDPR, but it is not an absolute right that overrides the rights and freedoms of data subjects. The UK GDPR allows Member States to provide for exemptions or derogations from certain provisions of the UK GDPR for the processing of personal data carried out for journalistic purposes or the purpose of academic, artistic or literary expression, where such exemptions or derogations are necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information. However, these exemptions or derogations do not apply to the obligation to report personal databreaches to the supervisory authority, unless the Member State law specifies otherwise. References:
* UK GDPR, Article 334
* UK GDPR, Article 34
* UK GDPR, Article 9
* UK GDPR, Article 85
質問 # 28
Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?
- A. It is key to the accountability element of the GDPR.
- B. It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO
- C. It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated
- D. It fulfils a requirement that data protection is carried out by design and default.
正解：B
質問 # 29
Which of the following statements MOST accurately describes the potential impact of Al on the principle of transparency?
- A. Transparency requirements do not apply to Al, as there is a relevant exemption
- B. Data subjects should generally expect Al to be present in processing activities
- C. Al can lead to invisible processing, with data subjects not being aware of its presence.
- D. Transparency requirements do not apply to Al, as it is always compatible with original purposes
正解：C
解説：
Explanation
The principle of transparency requires that any processing of personal data is fair, lawful and transparent to the data subjects. This means that data subjects should be informed about the existence, nature, purpose and consequences of the processing, as well as their rights and choices regarding their data. Transparency is essential for ensuring accountability, trust and compliance in data processing. However, the use of AI can pose challenges to the principle of transparency, as AI can lead to invisible processing, with data subjects not being aware of its presence, or the logic, significance and implications of the processing. For example, AI can be used to profile, infer, predict or influence the behaviour, preferences, interests, emotions or personality of data subjects, without their knowledge or consent. AI can also be used to make automated decisions that affect data subjects, such as credit scoring, recruitment, health diagnosis or social benefits, without providing meaningful explanations or opportunities for human intervention. Therefore, it is important to ensure that data subjects are informed and empowered when AI is involved in the processing of their data, and that they can exercise their rights, such as the right to access, rectify, object, restrict, erase or port their data, or the right to challenge or contest automated decisions56. References:
* Guidance on AI and data protection5
* Explaining decisions made with AI6
質問 # 30
A company has twenty retail outlets in France and thirty retail outlets in Belgium The payroll department and the Data Protection Officer are based in Poland.The Company Board and administrative functions are based in Germany. Determine where the company's 'mainestablishment' would be
- A. Belgium
- B. France
- C. Poland
- D. Germany
正解：D
解説：
Explanation
The main establishment of a controller or a processor in the EU is the place where the decisions on the purposes and means of the processing of personal data are taken and implemented. According to Recital 36 of the GDPR, the main establishment of a controller with establishments in more than one Member State should be the place of its central administration in the EU, unless the decisions on the processing are taken in another establishment of the controller in the EU and the latter establishment has the power to have such decisions implemented, in which case the establishment havingtaken such decisions should be considered to be the main establishment. Similarly, the main establishment of a processor with establishments in more than one Member State should be the place of its central administration in the EU, or, if the processor has no central administration in the EU, the establishment of the processor in the EU where the main processing activities take place to the extent that the processor is subject to specific obligations under the GDPR. The main establishment is relevant for determining the lead supervisory authority, the applicable law, and the jurisdiction of the courts for cross-border processing of personal data. In this case, the company's main establishment would be Germany, as it is the place where the company board and administrative functions are based and where the decisions on the processing of personal data are likely to be taken and implemented.
References:
* Recital 36 of the GDPR8
* Article 4(16) of the GDPR9
* Article 56 of the GDPR
質問 # 31
Under which circumstances can the 'domestic purposes' exemption be used to justify non-compliance with the Data Protection Act 2018?
A)An individual sells make up products for commission and uses social media to promote products to friends and family B)A couple are planning their daughter's wedding and use excel to store contact details and dietary needs of the guests C)An individual employs a babysitter and stores her bank details in an encrypted document in order to make payments D)A pansh council keeps a spreadsheet to manage bookings of the village hall, it contains only contact information and time slots E)A group of students are arranging a house party and using social media to invite people that they do and do not know
- A. A,B, C, and E.
- B. B,and C
- C. A. B.C. and D
- D. B. C. D, and E
正解：B
解説：
Explanation
The domestic purposes exemption applies to personal data processed by an individual only for the purposes of their personal, family or household affairs. This means that theprocessing has no connection to any professional or commercial activity. Examples of such processing include writing to friends and family, taking pictures for personal enjoyment, or keeping an address book. However, the exemption does not apply if the individual processes personal data outside the reasonable expectations of the data subject, or if the processing causes unwarranted harm to the data subject's interests. Therefore, the exemption can be used to justify non-compliance with the Data Protection Act 2018 in scenarios B and C, where the processing is purely personal and does not affect the rights and freedoms of others. However, the exemption cannot be used in scenarios A, D and E, where the processing has a professional or commercial element, or involves sharing personal data with third parties without consent or legitimate interest. References:
* Data Protection Act 2018, Schedule 2, Part 1, Paragraph 21
* ICO Guide to Data Protection, Domestic Purposes2
* ICO Guide to Data Protection, Exemptions3
質問 # 32
Of the following options which is NOT a purpose of carrying out a Data Protection Impact Assessment (DPIA)?
- A. It is key to the accountability element of the GDPR.
- B. It is necessary to fulfil the requirement that all DPIAs are submitted to the ICO
- C. It assists in identifying the main risks that may exist in any use of data, so that they can be mitigated
- D. It fulfils a requirement that data protection is carried out by design and default.
正解：B
解説：
Explanation
A DPIA is not required to fulfil the requirement that all DPIAs are submitted to the ICO, because this is not a requirement under the GDPR. The GDPR only requires that the controller consults the ICO before carrying out processing that is likely to result in a highrisk to individuals, if the controller cannot mitigate that risk. This means that not all DPIAs need to be submitted to the ICO, only those that identify a high residual risk that cannot be reduced. The other options are valid purposes of carrying out a DPIA, as they help the controller to comply with the GDPR, ensure data protection by design and by default, and identify and mitigate the main risks to individuals' rights and freedoms. References:
* Article 35 and 36 of the GDPR3
* ICO guidance on DPIAs5
質問 # 33
Under the Privacy and Electronic Communications Regulations, organisations must NOT make marketing telephone calls to which of the following?
- A. Any person who has not consented to receiving marketing calls
- B. Any person outside of the United Kingdom.
- C. Any person who is registered with the Telephone Preference Service, unless they have given specific consent to receive your calls
- D. Any person under the age of 18, unless their parent or guardian has provided permission
正解：C
解説：
Explanation
The Privacy and Electronic Communications Regulations (PECR) are a set of rules that regulate the use of electronic communications for marketing purposes, such as phone calls, texts, emails and faxes. One of the rules is that organisations must not make unsolicited marketing calls to individuals who have registered their numbers with the Telephone Preference Service (TPS), unless they have given their prior consent to receive such calls from that organisation. The TPS is a free service that allows individuals to opt out of receiving any marketing calls. It is a legal requirement for organisations to check the TPS before making any marketing calls and to respect the preferences of the individuals registered on it. If an organisation fails to comply with this rule, it may face enforcement action from the Information Commissioner's Office (ICO), which is the UK's data protection authority and the regulator of PECR. References:
* Telephone Preference Service
* Marketing calls
* Enforcement action
質問 # 34
Describe the act of processing under the authority of a controller or processor as stipulated in UK GDPR Article 29.
- A. Each processor and, where applicable, the processors representative shall maintain a record of all categories of processing activities earned out on behalf of a controller.
- B. A processor shall not process those data except on instructions from the controller, unless required to do so by domestic law
- C. The processor shall consult the supervisory authority prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the processor to mitigate the risk.
- D. The processor shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.
正解：B
解説：
Explanation
Article 29 of UK GDPR states that the processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by domestic law. This means that the processor must follow the controller's directions on how to handle the personal data, and cannot use it for its own purposes or deviate from the agreed terms. The only exception is when the processor is obliged by law to process the data in a different way, for example, to comply with a court order or a legal obligation. The other options are not related to Article 29, but to other articles of UK GDPR, such as Article 25 (data protection by design and by default), Article 30 (records of processing activities), and Article 36 (prior consultation). References:
* Article 29 of UK GDPR1
* ICO guidance on controllers and processors2
質問 # 35
An individual applies for a job as a security guard The employer has had significant issues with the sickness record of past recruits They therefore decide to offer the position to the individual on the basis they request a copy of their medical record so that the employer can be assured that they are in a good state of health.
The Data Protection Officer has been asked to advise. What advice is MOST appropriate?
- A. In requesting information that is more than they necessary require to verify the medical condition of the individual they will have breached the data minimisation principle
- B. This is a criminal offence under the Data Protection Act 2018 No individual should be asked to make a subject access request in order to obtain health records in these circumstances.
- C. While requesting and viewing medical evidence may be legitimate, they should ask for evidence that the individual consents to the proposition that they make the request
- D. Providing the medical evidence is used for a legitimate purpose, and that the information is securely destroyed on verification that the employee is healthy, this is an acceptable action.
正解：B
解説：
Explanation
The Data Protection Act 2018 (DPA 2018) makes it a criminal offence for a person to require another person to make a subject access request for information about their health, convictions or cautions, or spent convictions, and to provide that information to the first person or a third person, as a condition of providing or offering to provide goods, facilities or services, or as a condition of entering into or continuing a contract. This is known as an enforced subject access request. The employer in this scenario is committing a criminal offence by offering the job to the individual on the condition that they request a copy of their medical record and provide it to the employer. The employer is also breaching the data protection principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, and storage limitation, as they are processing health data, which is a special category of personal data, without a valid legal basis, without informing the individual of the purpose and legal basis of the processing, and without limiting the processing to what is necessary and relevant for the employment relationship. The employer should instead obtain the individual's explicit consent to request the health information directly from the relevant health professional, and only request the information that is necessary and proportionate for the specific role of a security guard. References
:
* Section 184 of the DPA 20183
* ICO guidance on enforced subject access requests4
* ICO guidance on special category data5
質問 # 36
Which of the below would be the BEST example of processing that could utilise the Public Interest Task lawful basis?
- A. A debt collection agency processing information relating to unpaid fines for misuse of community council car parking.
- B. A local authority processing the personal information of the person responsible for paying council tax
- C. A tax authority drops cookies on the devices of visitors to its website
- D. A health authority processing the personal information of its staff in order to record all training undertaken
正解：B
解説：
Explanation
The public interest task lawful basis applies to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The relevant task or authority must have a clear basis in domestic law, such as a statutory power, a common law duty, or a function of the Crown, central or local government. The processing must also be necessary, meaning that there is no reasonable and less intrusive way to achieve the same purpose. The public interest task lawful basis is most relevant to public authorities, but it can also apply to any organisation that exercises official authority or carries out tasks in the public interest. In scenario C, a local authority processing the personal information of the person responsible for paying council tax is likely to rely on the public interest task lawful basis, as it is performing a task in the public interest that is laid down by law, namely the Local Government Finance Act 1992, and the processing is necessary for the collection and administration of council tax. In contrast, scenarios A, B and D are less likely to qualify for the public interest task lawful basis, as they do not involve a clear task or authority that is set out in law, or that serves the public interest. For example, a health authority processing the personal information of its staff in order to record all training undertaken may have a different lawful basis, such as legitimate interests or contractual necessity. A debt collection agency processinginformation relating to unpaid fines for misuse of community council car parking may not have any official authority or public interest justification for its processing. A tax authority dropping cookies on the devices of visitors to its website may not be able to demonstrate that the processing is necessary for its official functions, and may also need to comply with the Privacy and Electronic Communications Regulations (PECR) for the use of cookies. References:
* UK GDPR, Article 6 (1) (e) and (3)8
* ICO Guide to Data Protection, Public Task9
* Local Government Finance Act 199210
質問 # 37
Where are the definitions of "Public Authority" and "Public Bodies" found?
- A. Data Protection Act 2018 only
- B. GDPRand Data Protection Act 2018.
- C. Data Protection Act 2018 and PECR.
- D. Freedom of Information Act 2000 and Data Protection Act 2018
正解：D
解説：
Explanation
The definitions of "public authority" and "public body" for the purposes of the UK GDPR and the Data Protection Act 2018 are found in the Freedom of Information Act 2000 and the Data Protection Act 2018 respectively. Section 7 of the Data Protection Act 2018 provides that a public authority or a public body is one that is listed in Schedule 1 to the Freedom of Information Act 2000, or is designated by an order under section
5 of that Act. However, a court or tribunal acting in its judicial capacity is not considered a public authority or a public body under the Data Protection Act 2018. References:
* Section 7 of the Data Protection Act 20181
* Schedule 1 to the Freedom of Information Act 2000
質問 # 38
What factors should be considered when looking at security of processing under Article 32 of the GDPR?
Select the INCORRECT answer
- A. The most secure option available
- B. Adherence to an approved code of conduct
- C. Lawfulness of processing
- D. The likelihood of a risk to the rights of the data subjects
正解：C
解説：
Explanation
Lawfulness of processing is not a factor that should be considered when looking at security of processing under Article 32 of the GDPR. Lawfulness of processing is a separate requirement that applies to all processing of personal data, regardless of the level of security. Security of processing under Article 32 of the GDPR should be based on the following factors:
* The state of the art and the costs of implementation of the security measures;
* The nature, scope, context and purposes of the processing;
* The risk of varying likelihood and severity for the rights and freedoms of natural persons;
* Adherence to an approved code of conduct or an approved certification mechanism (as an element to demonstrate compliance). References:
* Article 32 of the GDPR1
* Guidelines 07/2020 on the concepts of controller and processor in the GDPR2, p. 36
質問 # 39
Which of the following statements MOST accurately describes why a risk-based approach to the use of Al is necessary?
- A. Al is inherently negative and its use should be limited
- B. Al's benefits make accepting all arising risks necessary.
- C. Al carries new and complex risks not present in other technologies
- D. Al is unlawful
正解：C
解説：
Explanation
Artificial intelligence (AI) is the use of digital systems to perform tasks that would normally require human intelligence, such as recognition, decision making, learning and adaptation. AI can bring many benefits to society, such as innovation, efficiency, personalisation and convenience. However, AI also carries new and complex risks that are not present in other technologies, such as opacity, unpredictability, bias, discrimination, intrusion, manipulation and harm. These risks can affect the rights and freedoms of individuals, especially their data protection rights, such as privacy, transparency, fairness, accuracy and accountability. Therefore, a risk-based approach to the use of AI is necessary, which means identifying, assessing and mitigating the potential adverse impacts of AI on individuals and society, while balancing them with the benefits and opportunities. A risk-based approach also means complying with the relevant legal and ethical frameworks, such as the UK GDPR and the DPA 2018, and following the best practices and guidance issued by the ICO and other authorities on AI and data protection234. References:
* Guidance on AI and data protection2
* Explaining decisions made with AI3
* AI auditing framework4
質問 # 40
When were data protection rights first introduced into UK law'?
- A. 1992 (Data Protection Act 1992).
- B. 2000 (Data Protection Act 1998)
- C. 2018 (Data Protection Act 2018)
- D. 1984 (Data Protection Act 1984).
正解：D
解説：
Explanation
Data protection rights were first introduced into UK law by the Data Protection Act 1984, which was enacted to implement the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 1981. The Data Protection Act 1984 established a set of principles for the processing of personal data by data users, such as obtaining consent, ensuring accuracy, and limiting retention.
It also created a system of registration for data users and a Data Protection Registrar (later renamed as the Information Commissioner) to oversee and enforce the law. The Data Protection Act 1984 was replaced by the Data Protection Act 1998, which transposed the EU Data Protection Directive 1995 into UK law and extended the scope of data protection to cover manual as well as automated processing of personal data. The Data Protection Act 1998 was further amended by the Data Protection Act 2018, which incorporated the EU General Data Protection Regulation (GDPR) and the Law Enforcement Directive into UK law and made provisions for specific processing situations, such as national security, immigration, and journalism.
References:
* Data Protection Act 19844
* Council of Europe Convention 1085
* Data Protection Act 19986
* Data Protection Act 20187
質問 # 41
......
PDP9試験問題集でPDF問題とテストエンジン：https://www.goshiken.com/BCS/PDP9-mondaishu.html
リアルPDP9試験問題集解答で有効なPDP9問題集PDF：https://drive.google.com/open?id=1RoynFAb0MjVwJjHktB214LAdC93xw8lo