IAPP CIPP-A Online Practice Questions and Exam Preparation

IAPP CIPP-A Online Questions & Answers

• Question 21:

  SCENARIO A. Yes, because Carl gave his consent for his sensitive personal data to be collected during his employment.
  B. No, an organization is not allowed to use sensitive personal data without an individual's consent unless absolutely necessary.
  C. No, because the research is taking place after Carl has left B-Star's employment.
  D. Yes, if the research is deemed to be in the public interest.

  B. No, an organization is not allowed to use sensitive personal data without an individual's consent unless absolutely necessary.

  ---

  Explanation/Reference:

• Question 22:

  Which European-influenced safeguard was NOT included in Hong Kong or Singapore's personal data protection acts, but was subsequently adopted as a consideration in regulatory guidelines?

  A. Controls on automated decision making.
  B. Additional protection for sensitive personal data.
  C. Legitimate interest as a legal basis for processing.
  D. Notice requirements when data is collected from third parties.
  D. Notice requirements when data is collected from third parties.

• Question 23:

  In Singapore, a potential employer can collect all of the following data on an individual in the pre-employment phase EXCEPT?

  A. Postings from social media websites.
  B. Information from a background check.
  C. Information about the individual's children.
  D. The individual's university attendance records.
  B. Information from a background check.

• Question 24:

  Which Indian institution is vested with powers under the Credit Information Companies (Regulation) Act of 2005?

  A. The Reserve Bank of India.
  B. The National Housing Bank.
  C. The Oriental Bank of Commerce.
  D. The Securities and Exchange Board of India.
  A. The Reserve Bank of India.

• Question 25:

  Which of the following does Singapore's PDPC NOT have the power to do?

  A. Order an organization to stop collecting personal data.
  B. Order an organization to destroy collected personal data.
  C. Order an organization to award compensation to a complainant.
  D. Order an organization to pay a financial penalty to the government.
  D. Order an organization to pay a financial penalty to the government.

• Question 26:

  Which concept is NOT an element of Cross Border Privacy Rules (CBPR)?

  A. Enforcement by Accountability Agents.
  B. Self-assessment against CBPR questionnaire.
  C. Consultation with Privacy Enforcement (PE) Authority.
  D. Dispute resolution via the Accountability Agent's compliance program.
  E. None of above.
  E. None of above.

  ---

  Explanation/Reference:

  None of the concepts listed are outside the scope of Cross Border Privacy Rules (CBPR). All of the options listed are key elements of the CBPR framework.

  Enforcement by Accountability Agents, Self-assessment against CBPR questionnaire, Consultation with Privacy Enforcement (PE) Authority, and Dispute resolution via the Accountability Agent's compliance program are all important components of the CBPR framework, which is designed to facilitate international data flows while ensuring the protection of personal information.

• Question 27:

  Under the General Data Protection Regulation (GDPR), European Union member states may be allowed to transfer personal data to the United States in some cases.

  Which of the following could NOT be used as a legitimate means of doing this?

  A. A consent derogation.
  B. A certification mechanism.
  C. Privacy Shield.
  D. Ad-hoc contractual clauses.
  C. Privacy Shield.

• Question 28:

  Which of the following entities do NOT fall under India's Right to Information Act of 2005?

  A. High courts.
  B. State legislatures.
  C. Law enforcement agencies.
  D. National Security Guard.
  D. National Security Guard.

• Question 29:

  SCENARIO A. Assess the business risk of further processing in the absence of any regulations on anonymised data.
  B. Refer to India's Information Technology Act and the 2011 rules 3-8 for guidance on handling anonymised data.
  C. Obtain the consent of the data subjects because anonymous data must be treated as personal data at all times.
  D. Adhere to the Singapore guidelines on anonymization and the Hong Kong Guidance on Personal Data Erasure and Anonymization.

  A. Assess the business risk of further processing in the absence of any regulations on anonymised data.

  ---

  Explanation/Reference:

• Question 30:

  In what way are Hong Kong citizens protected from direct marketing in ways that India and Singapore citizens are not?

  A. Subscribers must have explicitly indicated that they did not object to their data being collected and used for marketing purposes.
  B. Subscribers can opt out of the use of their data for marketing purposes after collection by withdrawing consent.
  C. Data subjects must be notified on a website if their data is being used for marketing purposes.
  D. Data subjects are protected from the secondary use of personal data for marketing purposes.
  A. Subscribers must have explicitly indicated that they did not object to their data being collected and used for marketing purposes.