IAPP Certified Information Privacy Professional/United States CIPP/US Exam Questions

Page: 1 / 14
Total 195 questions

Want more questions? Get Premium Access.
()

Question 1

Most states with data breach notification laws indicate that notice to affected individuals must be sent in the ''most expeditious time possible without unreasonable delay.'' By contrast, which of the following states currently imposes a definite limit for notification to affected individuals?

AMaine

BFlorida

CNew York

DCalifornia

Answer : B

According to the web search results from my predefined tool, Florida is the only state among the four options that currently imposes a definite limit for notification to affected individuals in case of a data breach.Florida's law requires that notice be provided within 30 days after determination of the breach or reason to believe a breach occurred, unless delayed by law enforcement or measures to determine the scope of the breach and restore the integrity of the system1.The other states have more flexible or vague terms for the notification timeframe, such as ''as soon as practicable'' (Maine), ''in the most expedient time possible and without unreasonable delay'' (New York), or ''in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement'' (California)2.Reference:

Security Breach Notification Chart | Perkins Coie

State Data Breach Notification Chart - International Association of ...

Question 2

Under the California Consumer Privacy Act (as amended by the California Pnvacy Rights Act), a consumer may Initiate a civil action against a business for?

AAny personal information that is subject to unauthorized access or disclosure.

BA security breach of certain categories of personal information that is nonencrypted and nonredacted

CFailure to implement and maintain reasonable security procedures and practices to protect the personal information held.

DFailure to implement and maintain security practices set out in regulations issued by the California Privacy Protection Agency (CPPA).

Answer : B

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), consumers have the right to initiate a civil action if a business fails to adequately protect their personal information and a security breach occurs. This right applies specifically to breaches of certain categories of personal information that are unencrypted and unredacted.

Key Details of CCPA/CPRA Civil Actions:

Security Breaches:

A consumer can sue a business if the breach involves personal information such as Social Security numbers, driver's license numbers, or financial account information, provided that the data was unencrypted and unredacted.

Reasonable Security Practices:

Businesses are required to implement and maintain reasonable security practices to protect personal information. Failure to do so may expose the business to liability in case of a breach.

Categories of Data Covered:

The law specifies that only certain sensitive categories of personal information are actionable under a civil suit.

Explanation of Options:

A . Any personal information that is subject to unauthorized access or disclosure: This is incorrect. The civil action is limited to specific sensitive data categories, not all personal information.

B . A security breach of certain categories of personal information that is nonencrypted and nonredacted: This is correct. Civil actions under the CCPA/CPRA apply to breaches involving specific sensitive data that is not encrypted or redacted.

C . Failure to implement and maintain reasonable security procedures and practices to protect the personal information held: While this is a requirement under the law, it does not by itself provide grounds for a civil action. A security breach must occur for a consumer to sue.

D . Failure to implement and maintain security practices set out in regulations issued by the California Privacy Protection Agency (CPPA): This is incorrect. Civil actions are tied to breaches of sensitive data, not a failure to meet specific agency guidelines.

Reference from CIPP/US Materials:

CCPA/CPRA (Civil Code 1798.150): Outlines the private right of action for security breaches involving certain unencrypted and unredacted data.

IAPP CIPP/US Certification Textbook: Discusses the conditions under which consumers may bring civil actions under the CCPA/CPRA.

Question 3

SCENARIO

Please use the following to answer the next QUESTION

Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. ''Doing your network?'' Matt asked hopefully.

''No,'' the boy said. ''I'm filling out a survey.''

Matt looked over his son's shoulder at his computer screen. ''What kind of survey?'' ''It's asking Questio ns about my opinions.''

''Let me see,'' Matt said, and began reading the list of Questio ns that his son had already answered. ''It's asking your opinions about the government and citizenship. That's a little odd. You're only ten.''

Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.

To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.

Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.

Based on the incident, the FTC's enforcement actions against the marketer would most likely include what violation?

AIntruding upon the privacy of a family with young children.

BCollecting information from a child under the age of thirteen.

CFailing to notify of a breach of children's private information.

DDisregarding the privacy policy of the children's marketing industry.
Based on the incident, the FTC's enforcement actions against the marketer would most likely include the violation of collecting information from a child under the age of thirteen without obtaining verifiable parental consent, as required by the Children's Online Privacy Protection Act (COPPA) Rule. The COPPA Rule applies to operators of commercial websites and online services (including mobile apps) that collect, use, or disclose personal information from children under 13, and operators of general audience websites or online services that have actual knowledge that they are collecting, using, or disclosing personal information from children under 13. The COPPA Rule also applies to websites or online services that are directed to children under 13 and that collect personal information from users of any age. The COPPA Rule defines personal information to include full name, address, phone number, email address, date of birth, and other identifiers that permit the physical or online contacting of a specific individual. The COPPA Rule requires operators to post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from children; provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information online from children; give parents the choice of consenting to the operator's collection and internal use of a child's information, but prohibiting the operator from disclosing that information to third parties (unless disclosure is integral to the site or service, in which case, this must be made clear to parents); provide parents access to their child's personal information to review and/or have the information deleted; give parents the opportunity to prevent further use or online collection of a child's personal information; maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security; and retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use. The FTC has the authority to seek civil penalties and injunctive relief for violations of the COPPA Rule. The FTC has brought numerous enforcement actions against operators for violating the COPPA Rule, resulting in millions of dollars in penalties and orders to delete illegally collected data.References:
Children's Privacy | Federal Trade Commission
Kids' Privacy (COPPA) | Federal Trade Commission
FTC Is Escalating Scrutiny of Dark Patterns, Children's Privacy
FTC to Crack Down on Companies that Illegally Surveil Children Learning Online
FTC Takes Action Against Company for Collecting Children's Personal Information Without Parental Permission
[IAPP CIPP/US Certified Information Privacy Professional Study Guide], Chapter 5, pages 165-168.

Answer : B

Question 4

Which of the following best describes how federal anti-discrimination laws protect the privacy of private-sector employees in the United States?

AThey prescribe working environments that are safe and comfortable.

BThey limit the amount of time a potential employee can be interviewed.

CThey promote a workforce of employees with diverse skills and interests.

DThey limit the types of information that employers can collect about employees.

Answer : D

Federal anti-discrimination laws, such as Title VII of the Civil Rights Act of 1964, the Equal Pay Act of 1963, the Age Discrimination in Employment Act of 1967, and the Americans with Disabilities Act of 1990, prohibit employers from discriminating against employees or applicants based on certain protected characteristics, such as race, color, religion, sex, national origin, age, disability, and genetic information. These laws also limit the types of information that employers can collect, use, disclose, or retain about employees or applicants, in order to prevent discrimination or invasion of privacy. For example, employers cannot ask about an applicant's medical history, disability status, genetic information, or religious beliefs, unless they are relevant to the job or a bona fide occupational qualification. Employers also cannot use such information to make adverse employment decisions, such as hiring, firing, promotion, or compensation, unless they are justified by a legitimate business necessity or a reasonable accommodation. Employers must also safeguard the confidentiality of such information and dispose of it properly when it is no longer needed.Reference:

Federal Laws Prohibiting Job Discrimination Questions And Answers

Laws Enforced by EEOC

Employment and Anti-Discrimination Laws in the Workplace

Protections Against Discrimination and Other Prohibited Practices

3. Who is protected from employment discrimination?

Question 5

If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?

AUses the transferred data for limited purposes

BProvides the same level of privacy protection as the organization

CNotifies the organization if it can no longer meet its requirements for proper data handling

DEnters a contract with the organization that states the third party will process data according to the consent agreement

Answer : D

According to the Privacy Shield Framework, an organization that transfers personal data to a third party acting as an agent must ensure that the agent does all of the following1:

Uses the transferred data only for limited and specified purposes;

Provides the same level of privacy protection as is required by the Privacy Shield Principles;

Takes reasonable and appropriate steps to ensure that the agent effectively processes the personal information transferred in a manner consistent with the organization's obligations under the Principles;

Requires the agent to notify the organization if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Principles;

Upon notice, takes reasonable and appropriate steps to stop and remediate unauthorized processing; and

Provides a summary or a representative copy of the relevant privacy provisions of its contract with that agent to the Department of Commerce upon request.

Therefore, the only option that is not required by the Privacy Shield Framework is D. Enters a contract with the organization that states the third party will process data according to the consent agreement. While the organization must obtain the individual's consent for certain types of data transfers, such as those involving sensitive data or onward transfers to controllers, the organization does not have to include the consent agreement in the contract with the agent.The contract must, however, ensure that the agent will process the data in accordance with the individual's choices and expectations, as well as the Privacy Shield Principles2.

Question 6

SCENARIO

Please use the following to answer the next QUESTION:

Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. ''If they were really serious about not being bothered,'' Evan said, ''They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to.''

Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call ''another time.'' This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.

Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects

American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi

a. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.

Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.

Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.

Larry wants to take action, but is uncertain how to proceed.

Based on the way he uses social media, Evan is susceptible to a lawsuit based on?

ADefamation

BDiscrimination

CIntrusion upon seclusion

DPublicity given to private life

Answer : B

Discrimination is the unfair or prejudicial treatment of people based on certain characteristics, such as race, gender, age, religion, or political affiliation. Discrimination can occur in various contexts, such as employment, education, housing, or public accommodations. Discrimination can violate federal, state, or local laws that prohibit discrimination on the basis of protected categories. In the scenario, Evan is susceptible to a lawsuit based on discrimination because he uses social media to favor employees who share his political views and deny promotions to those who do not. This could constitute political discrimination, which is prohibited by some state and local laws, such as the District of Columbia Human Rights Act and the New York City Human Rights Law. Additionally, Evan's use of social media could reveal other protected characteristics of his employees, such as their race, gender, age, religion, or sexual orientation, and expose him to claims of discrimination based on those grounds as well. For example, if Evan posts derogatory comments about a certain race or religion, and then denies a promotion to an employee of that race or religion, that employee could sue Evan for discrimination under federal laws, such as Title VII of the Civil Rights Act of 1964 or the Civil Rights Act of 1991.Reference:

Political Discrimination in the Workplace | Nolo

Social Media and Employment Law Summary of Key Cases and Legal Issues

IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 4: State Privacy Laws and Regulations, Section 4.1: State Anti-Discrimination Laws.

Question 7

A California resident has created an account on your company's online food delivery platform and placed several orders in the past month Later she submits a data subject request to access her personal information under the California Privacy Rights Act.

Based on the CPR

Awhich of the following data elements would your company NOT have to provide to the requestor once her identity has been verified?

AInferences made about the individual for the company s internal purposes

BThe loyalty account number assigned through the individuals use of the services

CThe time stamp for the creation of the individual's account in the platform's database.

DThe email address submitted by the individual as part of the account registration process.

Answer : A, A

Under the California Privacy Rights Act (CPRA), which amends the California Consumer Privacy Act (CCPA), California residents have the right to request access to their personal information collected by a business. However, the CPRA provides an exception for inferences made about an individual for internal purposes, meaning businesses are not obligated to disclose inferences generated solely for internal use.

Key Points Under the CPRA:

Access to Personal Information:

Businesses must provide consumers with access to personal information they have collected, which includes data submitted by the consumer and other information directly associated with the consumer.

Exception for Inferences:

Inferences made about a consumer, particularly when used for internal purposes (e.g., improving services, analytics, or predicting preferences), are not explicitly required to be disclosed under the CPRA unless they are part of the consumer's profile or used for decision-making purposes that affect the consumer.

Examples of Data to Be Provided:

Information provided by the consumer (e.g., email address, account information).

Automatically collected information (e.g., timestamps, purchase history).

Identifiers (e.g., loyalty account numbers).

Explanation of Options:

A . Inferences made about the individual for the company's internal purposes: This is correct. Inferences generated for internal use are not considered part of the data set that must be disclosed in response to a CPRA data access request.

B . The loyalty account number assigned through the individual's use of the services: Loyalty account numbers are directly associated with the consumer and must be provided in response to an access request under the CPRA.

C. The time stamp for the creation of the individual's account in the platform's database: This information is part of the consumer's account data and must be disclosed under the CPRA.

D . The email address submitted by the individual as part of the account registration process: This is personal information directly provided by the consumer and must be disclosed under the CPRA.

Reference from CIPP/US Materials:

CPRA (Civil Code 1798.140): Defines personal information and exceptions for internal use, including inferences.

IAPP CIPP/US Certification Textbook: Discusses consumer rights under the CPRA, including access rights and the treatment of inferences.