IAPP CIPP-A Online Practice Questions and Exam Preparation

IAPP CIPP-A Online Questions & Answers

• Question 1:

  SCENARIO A. That the vendor submits for approval from Dracarys a privacy notice explaining how personal data will be protected under the Indian Information Technology Act.
  B. That the vendor files requests for transfer of personal data out of India through the offices of the privacy commissioners of Hong Kong and Singapore.
  C. That the vendor is bound by legally enforceable obligations to provide the personal data a standard of protection that is at least comparable to the protection under the Singapore PDPA.
  D. That the vendor adheres to the same sector privacy rules followed by Dracarys headquarters based in Seattle regarding the transfer of personal data.

  A. That the vendor submits for approval from Dracarys a privacy notice explaining how personal data will be protected under the Indian Information Technology Act.

  ---

  Explanation/Reference:

• Question 2:

  What emerged as the main reason for creating a comprehensive data protection law when Singapore ministers met between 2005 and 2011?

  A. To control increasing technological threats.
  B. To raise Singapore's human rights standing.
  C. To limit the scope of governmental surveillance.
  D. To enhance Singapore's economic competitiveness.
  D. To enhance Singapore's economic competitiveness.

• Question 3:

  Besides the Personal Data Protection Act (PDPA), which of the following is a potential source of privacy protection for Singapore citizens?

  A. Constitutional protections of personal information.
  B. International agreements protecting privacy.
  C. The tort of invasion of privacy.
  D. Breach of confidence law.
  A. Constitutional protections of personal information.

• Question 4:

  SCENARIO A. From the FFE retention department, offering a special discount for reactivating membership.
  B. From health care services provided by Hong Kong's Hospital Authority or Department of Health.
  C. From an FFE affiliate that provides a mechanism to opt out of further communications by reply-texting "OO."
  D. From an FFE affiliate in the region Stephen was transferred to, offering services similar to those he purchased previously.

  C. From an FFE affiliate that provides a mechanism to opt out of further communications by reply-texting "OO."

  ---

  Explanation/Reference:

• Question 5:

  SCENARIO A. Prescription details.
  B. Location data.
  C. Nationality.
  D. Religion.

  A. Prescription details.

  ---

  Explanation/Reference:

• Question 6:

  What benefit does making data pseudonymous offer to data controllers?

  A. It ensures that it is impossible to re-identify the data.
  B. It eliminates the responsibility to report data breaches.
  C. It allows for further use of the data for research purposes.
  D. It eliminates the need for a policy specifying data subject access rights.
  A. It ensures that it is impossible to re-identify the data.

• Question 7:

  Hong Kong's Personal Data (Privacy) Ordinance (PDPO) was primarily inspired by which of the following?

  A. Asia's APEC Privacy Framework.
  B. Macau's Personal Data Protection Act.
  C. South Korea's Public Agency Data Protection Act.
  D. Europe's Data Protection Directive (Directive 95/46/EC).
  D. Europe's Data Protection Directive (Directive 95/46/EC).

• Question 8:

  Which Hong Kong body has recommended legislation that provides for the right of civil action to be taken when private information is publicly disclosed?

  A. Hong Kong's Court of Final Appeal.
  B. Hong Kong Law Reform Commission.
  C. Office of the Privacy Commissioner for Personal Data.
  D. Standing Committee of the National People's Congress of the PRC.
  B. Hong Kong Law Reform Commission.

• Question 9:

  SCENARIO A. Because Delilah "consented" to her business contact information being used by Good Mining by passing it to Evan voluntarily.
  B. Because any business contact information can be freely used, collected or disclosed by Good Mining.
  C. Because Good Mining does not export the information to a cloud vendor.
  D. Because Delilah initiated the relationship with Good Mining.

  B. Because any business contact information can be freely used, collected or disclosed by Good Mining.

  ---

  Explanation/Reference:

• Question 10:

  In Hong Kong's revised Breach Guidance Note of 2015, what course of action did the Commissioner recommend that companies take immediately after experiencing a breach?

  A. Proceed under the assumption that the breach is a threat to personal safety.
  B. Enlist the aid of law enforcement to determine the cause of the breach.
  C. Quickly issue a notification to the data subjects affected by the breach.
  D. Immediately gather essential information in relation to the breach.
  D. Immediately gather essential information in relation to the breach.

  ---

  Explanation/Reference:

  The Commissioner of Hong Kong recommended that companies take the course of action of immediately gathering essential information in relation to the breach, as stated in the revised Breach Guidance Note of 2015. This would include investigating the cause and extent of the breach, identifying the types of personal data involved, and assessing the potential harm to affected individuals. Once this information has been gathered, companies can then determine whether they need to notify affected individuals and take any other necessary steps to mitigate the impact of the breach. Therefore, the correct option is D.