IAPP CIPT Exam Questions Instant Access - No Installation Required

Question 1

Under the Family Educational Rights and Privacy Act (FERPA), releasing personally identifiable information from a student's educational record requires written permission from the parent or eligible student in order for information to be?

AReleased to a prospective employer.

BReleased to schools to which a student is transferring.

CReleased to specific individuals for audit or evaluation purposes.

DReleased in response to a judicial order or lawfully ordered subpoena.

Answer : A

Under the Family Educational Rights and Privacy Act (FERPA), personally identifiable information (PII) from a student's educational record generally requires written consent from the parent or eligible student to be released. While there are specific exceptions, such as releases to schools to which a student is transferring, for audit or evaluation purposes, or in response to a judicial order or lawfully issued subpoena, releasing information to a prospective employer does not fall under these exceptions and therefore would require consent.

Question 2

SCENARIO

Clean-Q is a company that offers house-hold and office cleaning services. The company receives requests from consumers via their website and telephone, to book cleaning services. Based on the type and size of service, Clean-Q then contracts individuals that are registered on its resource database - currently managed in-house by Clean-Q IT Support. Because of Clean-Q's business model, resources are contracted as needed instead of permanently employed.

The table below indicates some of the personal information Clean-Q requires as part of its business operations:

Clean-Q has an internal employee base of about 30 people. A recent privacy compliance exercise has been conducted to align employee data management and human resource functions with applicable data protection regulation. Therefore, the Clean-Q permanent employee base is not included as part of this scenario.

With an increase in construction work and housing developments, Clean-Q has had an influx of requests for cleaning services. The demand has overwhelmed Clean-Q's traditional supply and demand system that has caused some overlapping bookings.

Ina business strategy session held by senior management recently, Clear-Q invited vendors to present potential solutions to their current operational issues. These vendors included Application developers and Cloud-Q's solution providers, presenting their proposed solutions and platforms.

The Managing Director opted to initiate the process to integrate Clean-Q's operations with a cloud solution (LeadOps) that will provide the following solution one single online platform: A web interface that Clean-Q accesses for the purposes of resource and customer management. This would entail uploading resource and customer information.

A customer facing web interface that enables customers to register, manage and submit cleaning service requests online.

A resource facing web interface that enables resources to apply and manage their assigned jobs.

An online payment facility for customers to pay for services.

What is a key consideration for assessing external service providers like LeadOps, which will conduct personal information processing operations on Clean-Q's behalf?

AUnderstanding LeadOps' costing model.

BEstablishing a relationship with the Managing Director of LeadOps.

CRecognizing the value of LeadOps' website holding a verified security certificate.

DObtaining knowledge of LeadOps' information handling practices and information security environment.

Answer : D

A key consideration for assessing external service providers like LeadOps, which will conduct personal information processing operations on Clean-Q's behalf, is obtaining knowledge of LeadOps' information handling practices and information security environment.

Due Diligence: Evaluating LeadOps' data handling practices ensures that they follow robust data protection principles, including data minimization, purpose limitation, and data retention policies.

Security Measures: Understanding their information security environment involves assessing technical and organizational measures in place to protect personal data. This includes encryption, access controls, incident response plans, and regular security audits.

Compliance and Certification: Verifying compliance with recognized standards such as ISO/IEC 27001 can provide assurance that LeadOps follows best practices in information security management.

Privacy Impact Assessments (PIAs): Conducting a PIA can help identify and mitigate privacy risks associated with outsourcing to LeadOps. It involves evaluating the potential impact on data subjects and implementing appropriate controls to protect their data.

Contractual Safeguards: Ensuring that contracts with LeadOps include specific data protection clauses, such as data processing agreements (DPAs), to delineate responsibilities and ensure compliance with data protection laws.

IAPP Privacy Management, Information Privacy Technologist Certification Textbooks

ISO/IEC 27001 -- Information Security Management Systems

GDPR Article 28 -- Processor

Question 3

Which of the following does NOT illustrate the 'respect to user privacy' principle?

AImplementing privacy elements within the user interface that facilitate the use of technology by any visually-challenged users.

BEnabling Data Subject Access Request (DSARs) that provide rights for correction, deletion, amendment and rectification of personal information.

CDeveloping a consent management self-service portal that enables the data subjects to review the details of consent provided to an organization.

DFiling breach notification paperwork with data protection authorities which detail the impact to data subjects.

Answer : D

Option A (Implementing privacy elements for visually-challenged users): This demonstrates respect to user privacy by ensuring that technology is accessible to all users, including those with disabilities. It aligns with the principle of inclusivity and respect for all users.

Option B (Enabling DSARs): This directly respects user privacy by allowing individuals to exercise their rights to access, correct, delete, amend, and rectify their personal information. It is a core aspect of privacy rights under regulations like GDPR.

Option C (Consent management portal): Providing a consent management self-service portal allows users to review and manage their consent preferences. This empowers users with control over their personal data, which is a key aspect of respecting user privacy.

Option D (Filing breach notification paperwork): Filing breach notification paperwork with data protection authorities is a compliance activity rather than an illustration of respect for user privacy. While it is necessary and legally required, it does not directly interact with or respect user privacy principles in the same way as the other options.

GDPR Articles on Data Subject Rights (Articles 15-22).

Principles of Privacy by Design and Respect for User Privacy (Ann Cavoukian's 7 Foundational Principles).

Conclusion: Filing breach notification paperwork with data protection authorities (Option D) is a necessary compliance activity but does not directly illustrate the 'respect to user privacy' principle in the same way as the other options.

Question 4

Which activity would best support the principle of data quality?

AProviding notice to the data subject regarding any change in the purpose for collecting such data.

BEnsuring that the number of teams processing personal information is limited.

CDelivering information in a format that the data subject understands.

DEnsuring that information remains accurate.

Answer : D

Ensuring that information remains accurate is the activity that best supports the principle of data quality. Data quality principles emphasize the importance of keeping personal information correct, complete, and up-to-date to prevent harm and ensure reliability. Maintaining accuracy involves regular updates, validation, and correction processes to avoid using outdated or incorrect data (IAPP, Certified Information Privacy Technologist (CIPT) materials).

Question 5

Implementation of privacy controls for compliance with the requirements of the Children's Online Privacy Protection Act (COPPA) is necessary for all the following situations EXCEPT?

AA virtual jigsaw puzzle game marketed for ages 5-9 displays pieces of the puzzle on a handheld screen. Once the child completes a certain level, it flashes a message about new themes released that day.

BAn interactive toy copies a child's behavior through gestures and kid-friendly sounds. It runs on battery power and automatically connects to a base station at home to charge itself.

CA math tutoring service commissioned an advertisement on a bulletin board inside a charter school. The service makes it simple to reach out to tutors through a QR-code shaped like a cartoon character.

DA note-taking application converts hard copies of kids' class notes into audio books in seconds. It does so by using the processing power of idle server farms.

Answer : C

The Children's Online Privacy Protection Act (COPPA) is designed to protect the privacy of children under 13 by regulating the collection of personal information online.

COPPA Applicability: COPPA applies to websites, online services, and apps directed at children under 13 or those that knowingly collect personal information from children under 13.

Advertisement Context: In option C, the math tutoring service advertises through a bulletin board within a charter school, which is not an online activity. Since COPPA focuses on online collection of data, this situation falls outside its scope.

The other options (A, B, and D) involve direct interaction with children through online platforms or devices, hence falling under COPPA's jurisdiction. Reference: IAPP Certification Textbooks, Section on COPPA and Children's Privacy Regulations.

Question 6

An organization is launching a smart watch which, in addition to alerts, will notify the the wearer of incoming calls allowing them to answer on the device. This convenience also comes with privacy concerns and is an example of?

AValue-Sensitive Design.

BUbiquitous computing.

CAnthropomorphism.

DCoupling

Answer : B

The smart watch that notifies the wearer of incoming calls and allows them to answer on the device is an example of ubiquitous computing. Ubiquitous computing refers to the integration of computing processes into everyday objects and activities, creating an environment where technology is seamlessly embedded and always accessible. While this increases convenience, it also raises privacy concerns as it often involves continuous data collection and processing. (Reference: IAPP CIPT Study Guide, Chapter on Emerging Technologies and Privacy)

Question 7

What Privacy by Design (PbD) element should include a de-identification or deletion plan?

ACategorization.

BRemediation.

CRetention.

DSecurity

Answer : C

Privacy by Design (PbD) Principles: PbD emphasizes the proactive inclusion of privacy in the design and operation of IT systems, networks, and business practices.

Retention: The retention element in PbD involves specifying the duration for which personal data will be retained. This is crucial to ensure that data is not kept longer than necessary.

De-identification or Deletion: As part of the retention plan, organizations must decide on de-identifying or deleting personal data once it is no longer needed for its original purpose. This practice minimizes privacy risks associated with unnecessary data retention.

Reference: According to the IAPP's 'Privacy by Design: The 7 Foundational Principles,' the principle of retention emphasizes that personal data should be retained only as long as necessary to fulfill the specified purposes and that secure deletion or de-identification procedures should be implemented.

IAPP Certified Information Privacy Technologist CIPT Exam Questions