IAPP IAPP Certifications CIPP-US Questions & Answers

• Question 191:

  Which of the following practices is NOT a key component of a data ethics framework?

  A. Automated decision-making.

  B. Preferability testing.

  C. Data governance.

  D. Auditing.

  Correct Answer: A

• Question 192:

  Under the Driver's Privacy Protection Act (DPPA), which of the following parties would require consent of an individual in order to obtain his or her Department of Motor Vehicle information?

  A. Law enforcement agencies performing investigations.

  B. Insurance companies needing to investigate claims.

  C. Attorneys gathering information related to lawsuits.

  D. Marketers wishing to distribute bulk materials.

  Correct Answer: A

• Question 193:

  As a result of the Schrems II decision and CJEU opinion, what would the preferred course of action be if a Section 702 disclosure related to a foreign entity is required?

  A. Ensure that the most recent SCC from the European Commission is being executed as a valid method of adequacy.

  B. Provide 30 days notice to affected parties to allow the opportunity for ling a motion to quash with the court.

  C. Seek redress from the court pursuing a protective order, since the consumer is unable to le a motion to quash.

  D. Seek the advice of outside counsel and conduct a transfer impact assessment.

  Correct Answer: D

• Question 194:

  The CFO of a pharmaceutical company is duped by a phishing email and discloses many of the company's employee personnel les to an online predator. The les include employee contact information, job applications, performance reviews, discipline records, and job descriptions.

  Which of the following state laws would be an affected employee's best recourse against the employer?

  A. The state social security number con dentiality statute.

  B. The state personnel record review statute.

  C. The state data destruction statute.

  D. The state UDAP statute.

  Correct Answer: B

• Question 195:

  Which of the following conditions would NOT be su cient to excuse an entity from providing breach noti cation under state law?

  A. If the data involved was encrypted.

  B. If the data involved was accessed but not exported.

  C. If the entity was subject to the GLBA Safeguards Rule.

  D. If the entity followed internal noti cation procedures compatible with state law.

  Correct Answer: C

• Question 196:

  SuperMart is a large Nevada-based business that has recently determined it sells what constitutes "covered information" under Nevada's privacy law, Senate Bill 260. Which of the following privacy compliance steps would best help SuperMart comply with the law?

  A. Providing a mechanism for consumers to opt out of sales.

  B. Implementing internal protocols for handling access and deletion requests.

  C. Preparing a notice of nancial incentive for any loyalty programs offered to its customers.

  D. Reviewing its vendor contracts to ensure that the vendors are subject to service provider restrictions.

  Correct Answer: B

• Question 197:

  Which of the following privacy rights is NOT available under the Colorado Privacy Act?

  A. The right to access sensitive data.

  B. The right to correct sensitive data.

  C. The right to delete sensitive data.

  D. The right to limit the use of sensitive data.

  Correct Answer: A

• Question 198:

  The California Privacy Rights Act (CPRA) expands upon a number of topics previously introduced in the California Consumer Privacy Act (CCPA).

  Which of the following was already part of the CCPA?

  A. Risk assessments.

  B. Cybersecurity audits.

  C. Private right of action.

  D. Automated decision-making.

  Correct Answer: C