Certified Information Privacy Professional – Europe (CIPP/E) — Question 48
SCENARIO -
Please use the following to answer the next question:
T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies.
T-Craze also opened various office locations throughout Europe to help expand its business. While Germany continued to host T-Craze’s headquarters and main product-design office, its French affiliate became responsible for all marketing and sales activities. The French affiliate recently procured the services of Right Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T-Craze, though with much less success.
The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze.
Which of the following is T-Craze’s lead supervisory authority?
Answer options
- A. Germany, because that is where T-Craze is headquartered.
- B. France, because that is where T-Craze conducts processing of personal information.
- C. Spain, because that is T-Craze’s primary market based on its marketing campaigns.
- D. T-Craze may choose its lead supervisory authority where any of its affiliates are based, because it has presence in several European countries.
Correct answer: A
Explanation
The correct answer is A because T-Craze is headquartered in Germany, which designates it as the lead supervisory authority under GDPR regulations. Options B and C are incorrect as they focus on where processing and marketing occur rather than the company’s headquarters. Option D is misleading because the lead authority is determined by the main establishment, not by choosing any country where affiliates operate.