Certified Information Privacy Professional CIPPE · Free Practice Question Medium
Question 11
Company A, Company B and Company C decide to set up an internet-based common platform in order to collect feedback from customers to improve their goods and services. They agree on important elements such as which data will be stored, how and who can have access to the information stored. Furthermore, they decide to share the data of their customers in order to carry out integrated marketing campaigns.
Company A enters into a contract with Company D to carry out its mail marketing campaign. It gives clear instructions to Company D regarding what marketing material to send out and to whom, and who to pay, what amounts, by what date etc).
Company D enters into a contract with Company E to send out the marketing material according to the instructions of Company A. Company D also decides to use Company A's customer database also for the purpose of promoting products of other customers.
When Company D contracts with Company E to send the marketing material according to instructions of Company A, Company E is acting as a:
- A Controller
- B Processor
- C Sub-Processor
- D Joint Controller
Reveal correct answer
Correct answer: C
Explanation
Company E is a sub-processor. A Sub-Processor is a third party data processor engaged by a Data Processor who has or will have access to or process personal data from a Data Controller. In order to use a sub- processor, the processor needs to have the controllers written permission.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
