Which of the following is NOT recognized as being a common characteristic of cloud-computing services?

• A. The supplier allows customer data to be transferred around the infrastructure according to capacity.
• B. The supplier determines the location, security measures, and service standards applicable to the processing.
• C. The service's infrastructure is shared among the supplier's customers and can be located in a number of countries.
• D. The supplier assumes the vendor's business risk associated with data processed by the supplier.

A multinational company is appointing a mandatory data protection officer. In addition to considering the rules set out in Article 37 (1) of the GDPR, which of the following actions must the company also undertake to ensure compliance in all EU jurisdictions in which it operates?

• A. Consult national derogations to evaluate if there are additional cases to be considered in relation to the matter.
• B. Revise the data processing activities of the company that affect more than one jurisdiction to evaluate whether they comply with the principles of privacy by design and bydefault.
• C. Conduct a Data Protection Privacy Assessment on the processing operations of the company in all the countries it operates.
• D. Assess whether the company has more than 250 employees in each of the EU member-states in which it is established.

SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location.
During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
What would be the MOST APPROPRIATE way for Building Block to handle the situation with the employee from Italy?

• A. Since the GDPR does not apply to this situation, the company would be entitled to apply any disciplinary measure authorized under Italian labor law.
• B. Since the employee was the cause of a serious risk for the server performance and their data, the company would be entitled to apply disciplinary measures to this employee, including fair dismissal.
• C. Since this was a serious infringement, but the employee was not appropriately informed about the consequences the new security measures, the company would be entitled to apply some disciplinary measures, but not dismissal.
• D. Since the employee was not informed that the security measures would be used for other purposes such as monitoring, the company could face difficulties in applying any disciplinary measures to this employee.

What is the most frequently used mechanism for legitimizing cross-border data transfer?

• A. Standard Contractual Clauses.
• B. Approved Code of Conduct.
• C. Binding Corporate Rules.
• D. Derogations.

A Spanish electricity customer calls her local supplier with Questions: about the company's upcoming merger. Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?

• A. Verify that the identity of the customer can be proven by other means.
• B. Verify that the request is applicable to the data collected before the GDPR entered into force.
• C. Verify that the personal data has not already been sent to the customer.
• D. Verify that the purpose of the request from the customer is in line with the GDPR.