IAPP IAPP Certifications CIPP-C Questions & Answers

• Question 21:

  Most states with data breach notification laws indicate that notice to affected individuals must be sent in the "most expeditious time possible without unreasonable delay." By contrast, which of the following states currently imposes a definite limit for notification to affected individuals?

  A. Maine

  B. Florida

  C.

  D. New York

  E. California

  Correct Answer: B

• Question 22:

  Which jurisdiction must courts have in order to hear a particular case?

  A. Subject matter jurisdiction and regulatory jurisdiction

  B. Subject matter jurisdiction and professional jurisdiction

  C. Personal jurisdiction and subject matter jurisdiction

  D. Personal jurisdiction and professional jurisdiction

  Correct Answer: C

• Question 23:

  When there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor

  procedures for purging and destroying outdated data. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.

  Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.

  When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.

  Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.

  Which principle of the Consumer Privacy Bill of Rights, if adopted, would best reform the company's privacy program?

  A. Consumers have a right to exercise control over how companies use their personal data.

  B. Consumers have a right to reasonable limits on the personal data that a company retains.

  C. Consumers have a right to easily accessible information about privacy and security practices.

  D. Consumers have a right to correct personal data in a manner that is appropriate to the sensitivity.

  Correct Answer: B

• Question 24:

  The rules for "e-discovery" mainly prevent which of the following?

  A. A conflict between business practice and technological safeguards

  B. The loss of information due to poor data retention practices

  C. The practice of employees using personal devices for work

  D. A breach of an organization's data retention program

  Correct Answer: B

• Question 25:

  In a case of civil litigation, what might a defendant who is being sued for distributing an employee's private information face?

  A. Probation.

  B. Criminal fines.

  C. An injunction.

  D. A jail sentence.

  Correct Answer: C

• Question 26:

  What role does the U.S. Constitution play in the area of workplace privacy?

  A. It provides enforcement resources to large employers, but not to small businesses

  B. It provides legal precedent for physical information security, but not for electronic security

  C. It provides contractual protections to members of labor unions, but not to employees at will

  D. It provides significant protections to federal and state governments, but not to private-sector employment

  Correct Answer: B

• Question 27:

  What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?

  A. Conduct annual consumer surveys regarding satisfaction with user preferences

  B. Process requests for changes to user preferences within a designated time frame

  C. Provide consumers with the opportunity to opt out of receiving telemarketing phone calls

  D. Offer an Opt-Out before transferring PI to an unaffiliated third party for the latter's own use

  Correct Answer: D

• Question 28:

  Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle's GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.

  Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia's concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that

  even if the business grows a customer database of a few thousand, it's unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.

  In any case, Celeste feels that all they need is common sense ?like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she's right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.

  Based on Felicia's Bring Your Own Device (BYOD) plan, the business consultant will most likely advise Felicia and Celeste to do what?

  A. Reconsider the plan in favor of a policy of dedicated work devices.

  B. Adopt the same kind of monitoring policies used for work-issued devices.

  C. Weigh any productivity benefits of the plan against the risk of privacy issues.

  D. Make employment decisions based on those willing to consent to the plan in writing.

  Correct Answer: D

• Question 29:

  Which of the following types of information would an organization generally NOT be required to disclose to law enforcement?

  A. Information about medication errors under the Food, Drug and Cosmetic Act

  B. Money laundering information under the Bank Secrecy Act of 1970

  C. Information about workspace injuries under OSHA requirements

  D. Personal health information under the HIPAA Privacy Rule

  Correct Answer: D

• Question 30:

  The U.S. Supreme Court has recognized an individual's right to privacy over personal issues, such as contraception, by acknowledging which of the following?

  A. Federal preemption of state constitutions that expressly recognize an individual right to privacy.

  B. A "penumbra" of unenumerated constitutional rights as well as more general protections of due process of law.

  C.

  D. An interpretation of the U.S. Constitution's explicit definition of privacy that extends to personal issues.

  E. The doctrine of stare decisis, which allows the U.S. Supreme Court to follow the precedent of previously decided case law.

  Correct Answer: B