Free FIP sample questions

Correct answer: Whether the specific data transferred is subject to EO 12333 or FISA Section 702 and if the importer provides supplementary measures to prevent access.

Under the CJEU's Schrems II ruling and subsequent EDPB recommendations, the core issue is whether the laws in the third country (specifically US surveillance laws like FISA 702 and EO 12333) impinge on the effectiveness of the transfer tool (like SCCs). The TIA must assess if the importer is a 'communications service provider' subject to these laws and if technical supplementary measures (like encryption where the keys are held in the EU) can effectively prevent access.

Correct answer: The processing is necessary for the performance of a contract, or is authorized by Union/Member state law, or is based on explicit consent.

GDPR Article 22 prohibits automated decision-making (ADM) that produces legal or similarly significant effects unless one of three exceptions applies: it is necessary for entering into or performance of a contract, authorized by law, or based on the data subject's explicit consent. For a marketing loyalty program, explicit consent is the most likely valid basis.

Correct answer: Reduction in the percentage of applications deployed without a completed Privacy Impact Assessment (PIA) compared to the previous quarter.

This is an outcome-based metric (Key Risk Indicator or KRI) that measures the effectiveness of the 'Privacy by Design' process. It directly correlates to the reduction of compliance risk (unassessed apps entering production). The other options are activity metrics (completion rates) or operational efficiency metrics (time to close), rather than risk outcome metrics.

Correct answer: A lower epsilon value results in more noise being added, providing stronger privacy guarantees but reduced data utility.

In differential privacy, 'epsilon' (ε) quantifies the privacy loss. A smaller epsilon means stricter privacy (less information leakage), which is achieved by adding more random noise to the data. This increased noise reduces the utility (accuracy) of the dataset for the researchers. Conversely, a higher epsilon adds less noise (better utility) but offers weaker privacy guarantees.

Correct answer: Unacceptable Risk (Prohibited, with narrow exceptions)

Under the EU AI Act, 'real-time' remote biometric identification in publicly accessible spaces for law enforcement purposes is classified as an Unacceptable Risk and is prohibited in principle (Article 5). There are very narrow exceptions (e.g., searching for missing children, preventing imminent terrorist threats) which require judicial authorization, but the baseline classification is prohibited/unacceptable.

Correct answer: Conduct a data inventory and mapping exercise to identify data types, locations, and legal obligations before defining a retention schedule.

As a leader, you cannot make arbitrary decisions (like deleting data older than 2 years) without understanding the data. The first step in post-acquisition integration is to understand what you have acquired. A data inventory/mapping exercise is necessary to determine what data exists, why it is held, and what legal or business requirements dictate its retention. Only then can a compliant retention schedule be enforced.