IAPP IAPP Certifications CIPP-C Questions & Answers

• Question 81:

  SCENARIO

  Please use the following to answer the next QUESTION:

  A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the

  letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.

  The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and

  request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened

  the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: "Please act immediately by identifying all personal data received from our company."

  This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.

  As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.

  Upon review, the data privacy leader discovers that the Company's documented data inventory is obsolete. What is the data privacy leader's next best source of information to aid the investigation?

  A. Reports on recent purchase histories

  B. Database schemas held by the retailer

  C. Lists of all customers, sorted by country

  D. Interviews with key marketing personnel

  Correct Answer: C

• Question 82:

  When there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor

  procedures for purging and destroying outdated data. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.

  Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.

  When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.

  Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.

  Based on the problems with the company's privacy security that Roberta identifies, what is the most likely cause of the breach?

  A. Mishandling of information caused by lack of access controls.

  B. Unintended disclosure of information shared with a third party.

  C.

  D. Fraud involving credit card theft at point-of-service terminals.

  E. Lost company property such as a computer or flash drive.

  Correct Answer: A

• Question 83:

  SCENARIO

  Please use the following to answer the next QUESTION:

  Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop.

  "Doing your network?" Matt asked hopefully.

  "No," the boy said. "I'm filling out a survey."

  Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking Questions about my opinions."

  "Let me see," Matt said, and began reading the list of Questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten."

  Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and

  the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.

  To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his

  name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.

  Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and

  he decided it was time to report the incident to the proper authorities.

  How could the marketer have best changed its privacy management program to meet COPPA "Safe Harbor" requirements?

  A. By receiving FTC approval for the content of its emails

  B. By making a COPPA privacy notice available on website

  C. By participating in an approved self-regulatory program

  D. By regularly assessing the security risks to consumer privacy

  Correct Answer: A

• Question 84:

  Which federal act does NOT contain provisions for preempting stricter state laws?

  A. The CAN-SPAM Act

  B. The Children's Online Privacy Protection Act (COPPA)

  C. The Fair and Accurate Credit Transactions Act (FACTA)

  D. The Telemarketing Consumer Protection and Fraud Prevention Act

  Correct Answer: D

• Question 85:

  SCENARIO

  Please use the following to answer the next QUESTION:

  Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to."

  Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.

  Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social media. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.

  Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.

  Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss. Larry wants to take action, but is uncertain how to proceed.

  In what area does Larry have a misconception about private-sector employee rights?

  A. The applicability of federal law

  B. The enforceability of local law

  C. The strict nature of state law

  D. The definition of tort law

  Correct Answer: A

• Question 86:

  A law enforcement subpoenas the ACME telecommunications company for access to text message records of a person suspected of planning a terrorist attack. The company had previously encrypted its text message records so that only the suspect could access this data.

  What law did ACME violate by designing the service to prevent access to the information by a law enforcement agency?

  A. SCA

  B.

  C. ECPA

  D. CALEA

  E. USA Freedom Act

  Correct Answer: C

• Question 87:

  Which act violates the Family Educational Rights and Privacy Act of 1974 (FERPA)?

  A. A K-12 assessment vendor obtains a student's signed essay about her hometown from her school to use as an exemplar for public release

  B. A university posts a public student directory that includes names, hometowns, e-mail addresses, and majors

  C. A newspaper prints the names, grade levels, and hometowns of students who made the quarterly honor roll

  D. University police provide an arrest report to a student's hometown police, who suspect him of a similar crime

  Correct Answer: A

• Question 88:

  Which statement is FALSE regarding the provisions of the Employee Polygraph Protection Act of 1988 (EPPA)?

  A. The EPPA requires that employers post essential information about the Act in a conspicuous location.

  B. The EPPA includes an exception that allows polygraph tests in professions in which employee honesty is necessary for public safety.

  C. Employers are prohibited from administering psychological testing based on personality traits such as honesty, preferences or habits.

  D. Employers involved in the manufacture of controlled substances may terminate employees based on polygraph results if other evidence exists.

  Correct Answer: C

• Question 89:

  SCENARIO

  Please use the following to answer the next QUESTION:

  Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they

  were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to."

  Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.

  Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly,

  even connecting with employees on social media. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.

  Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common

  at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.

  Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations

  sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.

  Larry wants to take action, but is uncertain how to proceed.

  In regard to telemarketing practices, Evan the supervisor has a misconception regarding?

  A. The conditions under which recipients can opt out

  B. The wishes of recipients who request callbacks

  C. The right to monitor calls for quality assurance

  D. The relationship of state law to federal law

  Correct Answer: B

• Question 90:

  Which of the following best describes how federal anti-discrimination laws protect the privacy of private-sector employees in the United States?

  A. They prescribe working environments that are safe and comfortable.

  B. They limit the amount of time a potential employee can be interviewed.

  C. They promote a workforce of employees with diverse skills and interests.

  D. They limit the types of information that employers can collect about employees.

  Correct Answer: A