March Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

IAPP CIPP-US Certified Information Privacy Professional/United States (CIPP/US) Exam Practice Test

Demo: 50 questions
Total 168 questions

Certified Information Privacy Professional/United States (CIPP/US) Questions and Answers

Question 1

What do the Civil Rights Act, Pregnancy Discrimination Act, Americans with Disabilities Act, Age Discrimination Act, and Equal Pay Act all have in common?

Options:

A.

They require employers not to discriminate against certain classes when employees use personal information

B.

They require that employers provide reasonable accommodations to certain classes of employees

C.

They afford certain classes of employees’ privacy protection by limiting inquiries concerning their personal information

D.

They permit employers to use or disclose personal information specifically about employees who are members of certain classes

Question 2

Which of the following best describes what a “private right of action” is?

Options:

A.

The right of individuals to keep their information private.

B.

The right of individuals to submit a request to access their information.

C.

The right of individuals harmed by data processing to have their information deleted.

D.

The right of individuals harmed by a violation of a law to file a lawsuit against the violation.

Question 3

Which entities must comply with the Telemarketing Sales Rule?

Options:

A.

For-profit organizations and for-profit telefunders regarding charitable solicitations

B.

Nonprofit organizations calling on their own behalf

C.

For-profit organizations calling businesses when a binding contract exists between them

D.

For-profit and not-for-profit organizations when selling additional services to establish customers

Question 4

What practice does the USA FREEDOM Act NOT authorize?

Options:

A.

Emergency exceptions that allows the government to target roamers

B.

An increase in the maximum penalty for material support to terrorism

C.

An extension of the expiration for roving wiretaps

D.

The bulk collection of telephone data and internet metadata

Question 5

What privacy concept grants a consumer the right to view and correct errors on his or her credit report?

Options:

A.

Access.

B.

Notice.

C.

Action.

D.

Choice.

Question 6

What practice do courts commonly require in order to protect certain personal information on documents, whether paper or electronic, that is involved in litigation?

Options:

A.

Redaction

B.

Encryption

C.

Deletion

D.

Hashing

Question 7

Which of the following privacy rights is NOT available under the Colorado Privacy Act?

Options:

A.

The right to access sensitive data.

B.

The right to correct sensitive data.

C.

The right to delete sensitive data.

D.

The right to limit the use of sensitive data.

Question 8

A large online bookseller decides to contract with a vendor to manage Personal Information (PI). What is the

least important factor for the company to consider when selecting the vendor?

Options:

A.

The vendor’s reputation

B.

The vendor’s financial health

C.

The vendor’s employee retention rates

D.

The vendor’s employee training program

Question 9

In a case of civil litigation, what might a defendant who is being sued for distributing an employee’s private information face?

Options:

A.

Probation.

B.

Criminal fines.

C.

An injunction.

D.

A jail sentence.

Question 10

Which of the following best describes an employer’s privacy-related responsibilities to an employee who has left the workplace?

Options:

A.

An employer has a responsibility to maintain a former employee’s access to computer systems and company data needed to support claims against the company such as discrimination.

B.

An employer has a responsibility to permanently delete or expunge all sensitive employment records to minimize privacy risks to both the employer and former employee.

C.

An employer may consider any privacy-related responsibilities terminated, as the relationship between employer and employee is considered primarily contractual.

D.

An employer has a responsibility to maintain the security and privacy of any sensitive employment records retained for a legitimate business purpose.

Question 11

SCENARIO

Please use the following to answer the next QUESTION:

You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security

measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth’s security measures.

A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals – ones that exposed the PHI of public figures including celebrities and politicians.

During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected.

A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual’s ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient’s attorney has submitted a discovery request for the ePHI exposed in the breach.

What is the most significant reason that the U.S. Department of Health and Human Services (HHS) might impose a penalty on HealthCo?

Options:

A.

Because HealthCo did not require CloudHealth to implement appropriate physical and administrative measures to safeguard the ePHI

B.

Because HealthCo did not conduct due diligence to verify or monitor CloudHealth’s security measures

C.

Because HIPAA requires the imposition of a fine if a data breach of this magnitude has occurred

D.

Because CloudHealth violated its contract with HealthCo by not encrypting the ePHI

Question 12

In 2011, the FTC announced a settlement with Google regarding its social networking service Google Buzz. The FTC alleged that in the process of launching the service, the company did all of the following EXCEPT?

Options:

A.

Violated its own privacy policies.

B.

Engaged in deceptive trade practices.

C.

Failed to comply with Safe Harbor principles.

D.

Failed to employ sufficient security safeguards.

Question 13

SCENARIO

Please use the following to answer the next QUESTION:

You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth’s security measures.

A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals – ones that exposed the PHI of public figures including celebrities and politicians.

During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected.

A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual’s ePHI, and that he has suffered substantial harm as aresult of the exposed data. The patient’s attorney has submitted a discovery request for the ePHI exposed in the breach.

Of the safeguards required by the HIPAA Security Rule, which of the following is NOT at issue due to HealthCo’s actions?

Options:

A.

Administrative Safeguards

B.

Technical Safeguards

C.

Physical Safeguards

D.

Security Safeguards

Question 14

SCENARIO

Please use the following to answer the next QUESTION

Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in California. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants’ postings on social media, ask QUESTION NO:s about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements.

Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle’s GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.

Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia’s concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that

even if the business grows a customer database of a few thousand, it’s unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.

In any case, Celeste feels that all they need is common sense – like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she’s right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.

Which law will be most relevant to Felicia’s plan to ask applicants about drug addiction?

Options:

A.

The Americans with Disabilities Act (ADA).

B.

The Occupational Safety and Health Act (OSHA).

C.

The Genetic Information Nondiscrimination Act of 2008.

D.

The Health Insurance Portability and Accountability Act (HIPAA).

Question 15

According to the FTC Report of 2012, what is the main goal of Privacy by Design?

Options:

A.

Obtaining consumer consent when collecting sensitive data for certain purposes

B.

Establishing a system of self-regulatory codes for mobile-related services

C.

Incorporating privacy protections throughout the development process

D.

Implementing a system of standardization for privacy notices

Question 16

Which of the following is NOT one of three broad categories of products offered by data brokers, as identified by the U.S. Federal Trade Commission (FTC)?

Options:

A.

Research (such as information for understanding consumer trends).

B.

Risk mitigation (such as information that may reduce the risk of fraud).

C.

Location of individuals (such as identifying an individual from partial information).

D.

Marketing (such as appending data to customer information that a marketing company already has).

Question 17

Which jurisdiction must courts have in order to hear a particular case?

Options:

A.

Subject matter jurisdiction and regulatory jurisdiction

B.

Subject matter jurisdiction and professional jurisdiction

C.

Personal jurisdiction and subject matter jurisdiction

D.

Personal jurisdiction and professional jurisdiction

Question 18

Which of the following accurately describes the purpose of a particular federal enforcement agency?

Options:

A.

The National Institute of Standards and Technology (NIST) has established mandatory privacy standards that can then be enforced against all for-profit organizations by the Department of Justice (DOJ).

B.

The Cybersecurity and Infrastructure Security Agency (CISA) is authorized to bring civil enforcement actions against organizations whose website or other online service fails to adequately secure personal information.

C.

The Federal Communications Commission (FCC) regulates privacy practices on the internet and enforces violations relating to websites’ posted privacy disclosures.

D.

The Federal Trade Commission (FTC) is typically recognized as having the broadest authority under the FTC Act to address unfair or deceptive privacy practices.

Question 19

Global Manufacturing Co’s Human Resources department recently purchased a new software tool. This tool helps evaluate future candidates for executive roles by scanning emails to see what those candidates say and what is said about them. This provides the HR department with an automated “360 review” that lets them know how the candidate thinks and operates, what their peers and direct reports say about them, and how well they interact with each other.

What is the most important step for the Human Resources Department to take when implementing this new software?

Options:

A.

Making sure that the software does not unintentionally discriminate against protected groups.

B.

Ensuring that the software contains a privacy notice explaining that employees have no right to privacy as long as they are running this software on organization systems to scan email systems.

C.

Confirming that employees have read and signed the employee handbook where they have been advised that they have no right to privacy as long as they are using the organization’s systems, regardless of the protected group or laws enforced by EEOC.

D.

Providing notice to employees that their emails will be scanned by the software and creating automated profiles.

Question 20

The Family Educational Rights and Privacy Act (FERPA) requires schools to do all of the following EXCEPT?

Options:

A.

Verify the identity of students who make requests for access to their records.

B.

Provide students with access to their records within a specified amount of time.

C.

Respond to all reasonable student requests regarding explanation of their records.

D.

Obtain student authorization before releasing directory information in their records.

Question 21

SuperMart is a large Nevada-based business that has recently determined it sells what constitutes “covered information” under Nevada’s privacy law, Senate Bill 260. Which of the following privacy compliance steps would best help SuperMart comply with the law?

Options:

A.

Providing a mechanism for consumers to opt out of sales.

B.

Implementing internal protocols for handling access and deletion requests.

C.

Preparing a notice of financial incentive for any loyalty programs offered to its customers.

D.

Reviewing its vendor contracts to ensure that the vendors are subject to service provider restrictions.

Question 22

Which of the following became the first state to pass a law specifically regulating the collection of biometric data?

Options:

A.

California.

B.

Texas.

C.

Illinois.

D.

Washington.

Question 23

The “Consumer Privacy Bill of Rights” presented in a 2012 Obama administration report is generally based on?

Options:

A.

The 1974 Privacy Act

B.

Common law principles

C.

European Union Directive

D.

Traditional fair information practices

Question 24

Most states with data breach notification laws indicate that notice to affected individuals must be sent in the “most expeditious time possible without unreasonable delay.” By contrast, which of the following states currently imposes a definite limit for notification to affected individuals?

Options:

A.

Maine

B.

Florida

C.

New York

D.

California

Question 25

All of the following are tasks in the “Discover” phase of building an information management program EXCEPT?

Options:

A.

Facilitating participation across departments and levels

B.

Developing a process for review and update of privacy policies

C.

Deciding how aggressive to be in the use of personal information

D.

Understanding the laws that regulate a company’s collection of information

Question 26

Which of the following laws is NOT involved in the regulation of employee background checks?

Options:

A.

The Civil Rights Act.

B.

The Gramm-Leach-Bliley Act (GLBA).

C.

The U.S. Fair Credit Reporting Act (FCRA).

D.

The California Investigative Consumer Reporting Agencies Act (ICRAA).

Question 27

Which of the following federal agencies does NOT have regulatory authority related to privacy?

Options:

A.

Consumer Financial Protection Bureau.

B.

U.S. Department of Transportation.

C.

U.S. Department of Commerce.

D.

Federal Reserve

Question 28

SCENARIO

Please use the following to answer the next QUESTION

Otto is preparing a report to his Board of Directors at Filtration Station, where he is responsible for the privacy program. Filtration Station is a U.S. company that sells filters and tubing products to pharmaceutical companies for research use. The company is based in Seattle, Washington, with offices throughout the U.S. and Asia. It sells to business customers across both the U.S. and the Asia-Pacific region. Filtration Station participates in the Cross-Border Privacy Rules system of the APEC Privacy Framework.

Unfortunately, Filtration Station suffered a data breach in the previous quarter. An unknown third party was able

to gain access to Filtration Station’s network and was able to steal data relating to employees in the company’s Human Resources database, which is hosted by a third-party cloud provider based in the U.S. The HR data is encrypted. Filtration Station also uses the third-party cloud provider to host its business marketing contact database. The marketing database was not affected by the data breach. It appears that the data breach was caused when a system administrator at the cloud provider stored the encryption keys with the data itself.

The Board has asked Otto to provide information about the data breach and how updates on new developments in privacy laws and regulations apply to Filtration Station. They are particularly concerned about staying up to date on the various U.S. state laws and regulations that have been in the news, especially the California Consumer Privacy Act (CCPA) and breach notification requirements.

The Board has asked Otto whether the company will need to comply with the new California Consumer Privacy Law (CCPA). What should Otto tell the Board?

Options:

A.

That CCPA will apply to the company only after the California Attorney General determines that it will enforce the statute.

B.

That the company is governed by CCPA, but does not need to take any additional steps because it follows CPBR.

C.

That business contact information could be considered personal information governed by CCPA.

D.

That CCPA only applies to companies based in California, which exempts the company from compliance.

Question 29

In which situation would a policy of “no consumer choice” or “no option” be expected?

Options:

A.

When a job applicant’s credit report is provided to an employer

B.

When a customer’s financial information is requested by the government

C.

When a patient’s health record is made available to a pharmaceutical company

D.

When a customer’s street address is shared with a shipping company

Question 30

Which of the following is NOT a principle found in the APEC Privacy Framework?

Options:

A.

Integrity of Personal Information.

B.

Access and Correction.

C.

Preventing Harm.

D.

Privacy by Design.

Question 31

Even when dealing with an organization subject to the CCPA, California residents are NOT legally entitled to request that the organization do what?

Options:

A.

Delete their personal information.

B.

Correct their personal information.

C.

Disclose their personal information to them.

D.

Refrain from selling their personal information to third parties.

Question 32

SCENARIO

Please use the following to answer the next QUESTION:

Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.

Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients’ Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.

On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.

He was also curious about the hospital’s use of a billing company. He questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients’ care.

On his first day Declan became familiar with all areas of the hospital’s large radiology department. As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non-encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.

Despite Declan’s concern about this issue, he was amazed by the hospital’s effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.

Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.

In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.

Although Declan’s day ended with many Questions, he was pleased about his new position.

What is the most likely way that Declan might directly violate the Health Insurance Portability and Accountability Act (HIPAA)?

Options:

A.

By being present when patients are checking in

B.

By speaking to a patient without prior authorization

C.

By ignoring the conversation about a potential breach

D.

By following through with his plans for his upcoming paper

Question 33

Who has rulemaking authority for the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA)?

Options:

A.

State Attorneys General

B.

The Federal Trade Commission

C.

The Department of Commerce

D.

The Consumer Financial Protection Bureau

Question 34

When designing contact tracing apps in relation to COVID-19 or any other diagnosed virus, all of the following privacy measures should be considered EXCEPT?

Options:

A.

Data retention.

B.

Use limitations.

C.

Opt-out choice.

D.

User confidentiality.

Question 35

All of the following common law torts are relevant to employee privacy under US law EXCEPT?

Options:

A.

Infliction of emotional distress.

B.

Intrusion upon seclusion.

C.

Defamation

D.

Conversion.

Question 36

SCENARIO

Please use the following to answer the next QUESTION

Otto is preparing a report to his Board of Directors at Filtration Station, where he is responsible for the privacy program. Filtration Station is a U.S. company that sells filters and tubing products to pharmaceutical companies for research use. The company is based in Seattle, Washington, with offices throughout the U.S. and Asia. It sells to business customers across both the U.S. and the Asia-Pacific region. Filtration Station participates in the Cross-Border Privacy Rules system of the APEC Privacy Framework.

Unfortunately, Filtration Station suffered a data breach in the previous quarter. An unknown third party was able to gain access to Filtration Station’s network and was able to steal data relating to employees in the company’s Human Resources database, which is hosted by a third-party cloud provider based in the U.S. The HR data is encrypted. Filtration Station also uses the third-party cloud provider to host its business marketing contact database. The marketing database was not affected by the data breach. It appears that the data breach was caused when a system administrator at the cloud provider stored the encryption keys with the data itself.

The Board has asked Otto to provide information about the data breach and how updates on new developments in privacy laws and regulations apply to Filtration Station. They are particularly concerned about staying up to date on the various U.S. state laws and regulations that have been in the news, especially the California Consumer Privacy Act (CCPA) and breach notification requirements.

What can Otto do to most effectively minimize the privacy risks involved in using a cloud provider for the HR data?

Options:

A.

Request that the Board sign off in a written document on the choice of cloud provider.

B.

Ensure that the cloud provider abides by the contractual requirements by conducting an on-site audit.

C.

Obtain express consent from employees for storing the HR data in the cloud and keep a record of the employee consents.

D.

Negotiate a Business Associate Agreement with the cloud provider to protect any health-related data employees might share with Filtration Station.

Question 37

SCENARIO

Please use the following to answer the next QUESTION

Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in California. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants’ postings on social media, ask QUESTION NO:s about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements.

Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle’s GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.

Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia’s concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that

even if the business grows a customer database of a few thousand, it’s unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.

In any case, Celeste feels that all they need is common sense – like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she’s right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.

Based on Felicia’s Bring Your Own Device (BYOD) plan, the business consultant will most likely advise Felicia and Celeste to do what?

Options:

A.

Reconsider the plan in favor of a policy of dedicated work devices.

B.

Adopt the same kind of monitoring policies used for work-issued devices.

C.

Weigh any productivity benefits of the plan against the risk of privacy issues.

D.

Make employment decisions based on those willing to consent to the plan in writing.

Question 38

SCENARIO

Please use the following to answer the next QUESTION

When there was a data breach involving customer personal and financial information at a large retail store, the company’s directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor

procedures for purging and destroying outdated data. In her research, Roberta had discovered that even low- level employees had access to all of the company’s customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.

Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees’ access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers’ financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.

When the breach occurred, the company’s executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta’s guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.

Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.

Which principle of the Consumer Privacy Bill of Rights, if adopted, would best reform the company’s privacy program?

Options:

A.

Consumers have a right to exercise control over how companies use their personal data.

B.

Consumers have a right to reasonable limits on the personal data that a company retains.

C.

Consumers have a right to easily accessible information about privacy and security practices.

D.

Consumers have a right to correct personal data in a manner that is appropriate to the sensitivity.

Question 39

Which of these organizations would be required to provide its customers with an annual privacy notice?

Options:

A.

The Four Winds Tribal College.

B.

The Golden Gavel Auction House.

C.

The King County Savings and Loan.

D.

The Breezy City Housing Commission.

Question 40

SCENARIO

Please use the following to answer the next QUESTION:

Matt went into his son’s bedroom one evening and found him stretched out on his bed typing on his laptop. “Doing your network?” Matt asked hopefully.

“No,” the boy said. “I’m filling out a survey.”

Matt looked over his son’s shoulder at his computer screen. “What kind of survey?” “It’s asking Questions about my opinions.”

“Let me see,” Matt said, and began reading the list of Questions that his son had already answered. “It’s asking your opinions about the government and citizenship. That’s a little odd. You’re only ten.”

Matt wondered how the web link to the survey had ended up in his son’s email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.

To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.

Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son’s inbox, and he decided it was time to report the incident to the proper authorities.

How could the marketer have best changed its privacy management program to meet COPPA “Safe Harbor” requirements?

Options:

A.

By receiving FTC approval for the content of its emails

B.

By making a COPPA privacy notice available on website

C.

By participating in an approved self-regulatory program

D.

By regularly assessing the security risks to consumer privacy

Question 41

What does the Massachusetts Personal Information Security Regulation require as it relates to encryption of personal information?

Options:

A.

The encryption of all personal information of Massachusetts residents when all equipment is located in Massachusetts.

B.

The encryption of all personal information stored in Massachusetts-based companies when all equipment is located in Massachusetts.

C.

The encryption of personal information stored in Massachusetts-based companies when stored on portable devices.

D.

The encryption of all personal information of Massachusetts residents when stored on portable devices.

Question 42

Acme Student Loan Company has developed an artificial intelligence algorithm that determines whether an individual is likely to pay their bill or default. A person who is determined by the algorithm to be more likely to default will receive frequent payment reminder calls, while those who are less likely to default will not receive payment reminders.

Which of the following most accurately reflects the privacy concerns with Acme Student Loan Company using

artificial intelligence in this manner?

Options:

A.

If the algorithm uses risk factors that impact the automatic decision engine. Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.

B.

If the algorithm makes automated decisions based on risk factors and public information, Acme need not determine if the algorithm has a disparate impact on protected classes.

C.

If the algorithm’s methodology is disclosed to consumers, then it is acceptable for Acme to have a disparate impact on protected classes.

D.

If the algorithm uses information about protected classes to make automated decisions, Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.

Question 43

Which was NOT one of the five priority areas listed by the Federal Trade Commission in its 2012 report, “Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers”?

Options:

A.

International data transfers

B.

Large platform providers

C.

Promoting enforceable self-regulatory codes

D.

Do Not Track

Question 44

SCENARIO

Please use the following to answer the next QUESTION:

A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices.

The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.”

This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup’s rapid market penetration.

As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer.

At this stage of the investigation, what should the data privacy leader review first?

Options:

A.

Available data flow diagrams

B.

The text of the original complaint

C.

The company’s data privacy policies

D.

Prevailing regulation on this subject

Question 45

What is the main reason some supporters of the European approach to privacy are skeptical about self- regulation of privacy practices?

Options:

A.

A large amount of money may have to be sent on improved technology and security

B.

Industries may not be strict enough in the creation and enforcement of rules

C.

A new business owner may not understand the regulations

D.

Human rights may be disregarded for the sake of privacy

Question 46

SCENARIO

Please use the following to answer the next QUESTION:

A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices.

The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-basedretailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.”

This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup’s rapid market penetration.

As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer.

Upon review, the data privacy leader discovers that the Company’s documented data inventory is obsolete. What is the data privacy leader’s next best source of information to aid the investigation?

Options:

A.

Reports on recent purchase histories

B.

Database schemas held by the retailer

C.

Lists of all customers, sorted by country

D.

Interviews with key marketing personnel

Question 47

Which venture would be subject to the requirements of Section 5 of the Federal Trade Commission Act?

Options:

A.

A local nonprofit charity’s fundraiser

B.

An online merchant’s free shipping offer

C.

A national bank’s no-fee checking promotion

D.

A city bus system’s frequent rider program

Question 48

The Video Privacy Protection Act of 1988 restricted which of the following?

Options:

A.

Which purchase records of audio visual materials may be disclosed

B.

When downloading of copyrighted audio visual materials is allowed

C.

When a user’s viewing of online video content can be monitored

D.

Who advertisements for videos and video games may target

Question 49

Which of the following is an important implication of the Dodd-Frank Wall Street Reform and Consumer Protection Act?

Options:

A.

Financial institutions must avoid collecting a customer’s sensitive personal information

B.

Financial institutions must help ensure a customer’s understanding of products and services

C.

Financial institutions must use a prescribed level of encryption for most types of customer records

D.

Financial institutions must cease sending e-mails and other forms of advertising to customers who opt out of direct marketing

Question 50

Which of the following best describes how federal anti-discrimination laws protect the privacy of private-sector employees in the United States?

Options:

A.

They prescribe working environments that are safe and comfortable.

B.

They limit the amount of time a potential employee can be interviewed.

C.

They promote a workforce of employees with diverse skills and interests.

D.

They limit the types of information that employers can collect about employees.

Demo: 50 questions
Total 168 questions