Question 1

SCENARIO Please use the following to answer the next question: A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices. The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: "Please act immediately by identifying all personal data received from our company." This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration. As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer. Under the General Data Protection Regulation (GDPR), how would the U.S.-based startup company most likely be classified?
A) As a data supervisor
B) As a data processor
C) As a data controller
D) As a data manager

Accepted Answer

The answer of SCENARIO Please use the following to answer...

Question 2

Which of the following describes the most likely risk for a company developing a privacy policy with standards that are much higher than its competitors?
A) Being more closely scrutinized for any breaches of policy
B) Getting accused of discriminatory practices
C) Attracting skepticism from auditors
D) Having a security system failure

Accepted Answer

When a company sets higher privacy standards, it may face closer scrutiny to ensure it adheres to those standards, making any breaches more noticeable.

Question 3

In which situation is a company operating under the assumption of implied consent?
A) An employer contacts the professional references provided on an applicant's resume
B) An online retailer subscribes new customers to an e-mail list by default
C) A landlord uses the information on a completed rental application to run a credit report
D) A retail clerk asks a customer to provide a zip code at the check-out counter

Accepted Answer

The answer of In which situation is a company operating...

Question 4

If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?
A) Uses the transferred data for limited purposes
B) Provides the same level of privacy protection as the organization
C) Notifies the organization if it can no longer meet its requirements for proper data handling
D) Enters a contract with the organization that states the third party will process data according to the consent agreement

Accepted Answer

The Privacy Shield framework does not specifically require a contract stating that the third party will process data according to the consent agreement. The focus is on ensuring the third party provides adequate protection and notifies the organization if it cannot meet its obligations.

Question 5

SCENARIO Please use the following to answer the next question: Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. "Doing your homework?" Matt asked hopefully. "No," the boy said. "I'm filling out a survey." Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking questions about my opinions." "Let me see," Matt said, and began reading the list of questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders. To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer questions about his favorite games and toys. Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities. How could the marketer have best changed its privacy management program to meet COPPA "Safe Harbor" requirements?
A) By receiving FTC approval for the content of its emails
B) By making a COPPA privacy notice available on website
C) By participating in an approved self-regulatory program
D) By regularly assessing the security risks to consumer privacy

Accepted Answer

The answer of SCENARIO Please use the following to answer...

Question 6

SCENARIO Please use the following to answer the next question: Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. "Doing your homework?" Matt asked hopefully. "No," the boy said. "I'm filling out a survey." Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking questions about my opinions." "Let me see," Matt said, and began reading the list of questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders. To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer questions about his favorite games and toys. Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities. How does Matt come to the decision to report the marketer's activities?
A) The marketer failed to make an adequate attempt to provide Matt with information
B) The marketer did not provide evidence that the prize books were appropriate for children
C) The marketer seems to have distributed his son's information without Matt's permission
D) The marketer failed to identify himself and indicate the purpose of the messages

Accepted Answer

The answer of SCENARIO Please use the following to answer...

Question 7

Under the Fair and Accurate Credit Transactions Act (FACTA), what is the most appropriate action for a car dealer holding a paper folder of customer credit reports?
A) To follow the Disposal Rule by having the reports shredded
B) To follow the Red Flags Rule by mailing the reports to customers
C) To follow the Privacy Rule by notifying customers that the reports are being stored
D) To follow the Safeguards Rule by transferring the reports to a secure electronic file

Accepted Answer

The answer of Under the Fair and Accurate Credit Transactions...

Question 8

A large online bookseller decides to contract with a vendor to manage Personal Information (PI). What is the least important factor for the company to consider when selecting the vendor?
A) The vendor's reputation
B) The vendor's financial health
C) The vendor's employee retention rates
D) The vendor's employee training program

Accepted Answer

The answer of A large online bookseller decides to contract...

Question 9

What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?
A) The ability for the consumer to correct inaccurate credit report information
B) The truncation of account numbers on credit card receipts
C) The right to request removal from e-mail lists
D) Consumer notice when third-party data is used to make an adverse decision

Accepted Answer

The answer of What consumer protection did the Fair and...

Question 10

In which situation would a policy of "no consumer choice" or "no option" be expected?
A) When a job applicant's credit report is provided to an employer
B) When a customer's financial information is requested by the government
C) When a patient's health record is made available to a pharmaceutical company
D) When a customer's street address is shared with a shipping company

Accepted Answer

A "no consumer choice" policy is expected when sharing information is necessary for service delivery, such as providing a shipping company with a customer's address to deliver a package.

Question 11

What was the original purpose of the Federal Trade Commission Act?
A) To ensure privacy rights of U.S. citizens
B) To protect consumers
C) To enforce antitrust laws
D) To negotiate consent decrees with companies violating personal privacy

Accepted Answer

The Federal Trade Commission Act was passed in 1914 to protect consumers from unfair and deceptive practices.

Question 12

All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?
A) Healthcare information clearinghouses
B) Pharmaceutical companies
C) Healthcare providers
D) Health plans

Accepted Answer

Pharmaceutical companies are not considered covered entities under HIPAA. Covered entities include healthcare providers, health plans, and healthcare clearinghouses.

Question 13

SCENARIO Please use the following to answer the next question: A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices. The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: "Please act immediately by identifying all personal data received from our company." This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration. As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer. Under the GDPR, the complainant's request regarding her personal information is known as what?
A) Right of Access
B) Right of Removal
C) Right of Rectification
D) Right to Be Forgotten

Accepted Answer

The answer of SCENARIO Please use the following to answer...

Question 14

What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH)?
A) Make electronic health records (EHRs) part of regular care
B) Bill the majority of patients electronically for their health care
C) Send health information and appointment reminders to patients electronically
D) Keep electronic updates about the Health Insurance Portability and Accountability Act

Accepted Answer

To qualify for funds under HITECH, health care providers must demonstrate "meaningful use" of electronic health records (EHRs), which involves integrating EHRs into regular care practices.

Question 15

All of the following are tasks in the "Discover" phase of building an information management program EXCEPT?
A) Facilitating participation across departments and levels
B) Developing a process for review and update of privacy policies
C) Deciding how aggressive to be in the use of personal information
D) Understanding the laws that regulate a company's collection of information

Accepted Answer

The answer of All of the following are tasks in...

Question 16

A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?
A) Department of Health and Human Services
B) The affected individuals
C) The local media
D) Medical providers

Accepted Answer

Under HIPAA, a covered entity must report a breach of PHI affecting more than 500 individuals to the Department of Health and Human Services, the affected individuals, and the local media. There is no requirement to report the breach to medical providers unless they are directly affected.

Question 17

When may a financial institution share consumer information with non-affiliated third parties for marketing purposes?
A) After disclosing information-sharing practices to customers and after giving them an opportunity to opt in.
B) After disclosing marketing practices to customers and after giving them an opportunity to opt in.
C) After disclosing information-sharing practices to customers and after giving them an opportunity to opt out.
D) After disclosing marketing practices to customers and after giving them an opportunity to opt out.

Accepted Answer

Financial institutions can share consumer information with non-affiliated third parties for marketing purposes after disclosing their information-sharing practices to customers and providing them an opportunity to opt out, as per regulations like the Gramm-Leach-Bliley Act.

Question 18

What is the main challenge financial institutions face when managing user preferences?
A) Ensuring they are in compliance with numerous complex state and federal privacy laws
B) Developing a mechanism for opting out that is easy for their consumers to navigate
C) Ensuring that preferences are applied consistently across channels and platforms
D) Determining the legal requirements for sharing preferences with their affiliates

Accepted Answer

The main challenge is ensuring that user preferences are applied consistently across various channels and platforms, which can be complex due to differing systems and technologies.

Question 19

Who has rulemaking authority for the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA)?
A) State Attorneys General
B) The Federal Trade Commission
C) The Department of Commerce
D) The Consumer Financial Protection Bureau

Accepted Answer

The Consumer Financial Protection Bureau (CFPB) has rulemaking authority for the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA).

Question 20

SCENARIO Please use the following to answer the next question: Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. "Doing your homework?" Matt asked hopefully. "No," the boy said. "I'm filling out a survey." Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking questions about my opinions." "Let me see," Matt said, and began reading the list of questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders. To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer questions about his favorite games and toys. Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities. Based on the incident, the FTC's enforcement actions against the marketer would most likely include what violation?
A) Intruding upon the privacy of a family with young children.
B) Collecting information from a child under the age of thirteen.
C) Failing to notify of a breach of children's private information.
D) Disregarding the privacy policy of the children's marketing industry.

Accepted Answer

The answer of SCENARIO Please use the following to answer...

Exam 4: Certified Information Privacy Professional/United States (CIPP/US)

Which of the following describes the most likely risk for a company developing a privacy policy with standards that are much higher than its competitors?

In which situation is a company operating under the assumption of implied consent?

If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?

Under the Fair and Accurate Credit Transactions Act (FACTA) , what is the most appropriate action for a car dealer holding a paper folder of customer credit reports?

A large online bookseller decides to contract with a vendor to manage Personal Information (PI) . What is the least important factor for the company to consider when selecting the vendor?

What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?

In which situation would a policy of "no consumer choice" or "no option" be expected?

What was the original purpose of the Federal Trade Commission Act?

All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?

What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH) ?

All of the following are tasks in the "Discover" phase of building an information management program EXCEPT?

A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?

When may a financial institution share consumer information with non-affiliated third parties for marketing purposes?

What is the main challenge financial institutions face when managing user preferences?

Who has rulemaking authority for the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA) ?