CIPP-US Exam Questions

Total 164 Questions

Last Updated Exam : 30-Dec-2024

A law enforcement subpoenas the ACME telecommunications company for access to text message records of a person suspected of planning a terrorist attack. The company had previously encrypted its text message records so that only the suspect could access this data.
What law did ACME violate by designing the service to prevent access to the information
by a law enforcement agency?


A.

SCA


B.

ECPA


C.

CALEA


D.

USA Freedom Act





Which statute is considered part of U.S. federal privacy law?


A.

The Fair Credit Reporting Act.


B.

SB 1386.


C.

The Personal Information Protection and Electronic Documents Act.


D.

The e-Privacy Directive.





What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?


A.

Conduct annual consumer surveys regarding satisfaction with user preferences


B.

Process requests for changes to user preferences within a designated time frame


C.

Provide consumers with the opportunity to opt out of receiving telemarketing phone calls


D.

Offer an Opt-Out before transferring PI to an unaffiliated third party for the latter’s own use 





SCENARIO
Please use the following to answer the next QUESTION:
Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer’s privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.
Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.
After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer’s personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis.
Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.
Janice understood Cheryl’s concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company’s day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.
Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.
What is the most likely risk of Fitness Coach, Inc. adopting Janice’s first draft of the privacy policy?


A.

Leaving the company susceptible to violations by setting unrealistic goals


B.

Failing to meet the needs of customers who are concerned about privacy


C.

Showing a lack of trust in the organization’s privacy practices


D.

Not being in standard compliance with applicable laws





In 2014, Google was alleged to have violated the Family Educational Rights and Privacy Act (FERPA) through its Apps for Education suite of tools. For what specific practice did students sue the company?


A.

Scanning emails sent to and received by students


B.

Making student education records publicly available


C.

Relying on verbal consent for a disclosure of education records


D.

Disclosing education records without obtaining required consent





Which act violates the Family Educational Rights and Privacy Act of 1974 (FERPA)?


A.

A K-12 assessment vendor obtains a student’s signed essay about her hometown from her school to use as an exemplar for public release


B.

A university posts a public student directory that includes names, hometowns, e-mail addresses, and majors


C.

A newspaper prints the names, grade levels, and hometowns of students who made the quarterly honor roll


D.

University police provide an arrest report to a student’s hometown police, who suspect him of a similar crime





Most states with data breach notification laws indicate that notice to affected individuals must be sent in the “most expeditious time possible without unreasonable delay.” By contrast, which of the following states currently imposes a definite limit for notification to affected individuals?


A.

Maine


B.

Florida


C.

New York


D.

California





SCENARIO
Please use the following to answer the next QUESTION
Otto is preparing a report to his Board of Directors at Filtration Station, where he is responsible for the privacy program. Filtration Station is a U.S. company that sells filters and tubing products to pharmaceutical companies for research use. The company is based in Seattle, Washington, with offices throughout the U.S. and Asia. It sells to business customers across both the U.S. and the Asia-Pacific region. Filtration Station participates in the Cross-Border Privacy Rules system of the APEC Privacy Framework.
Unfortunately, Filtration Station suffered a data breach in the previous quarter. An unknown
third party was able to gain access to Filtration Station’s network and was able to steal data relating to employees in the company’s Human Resources database, which is hosted by a third-party cloud provider based in the U.S. The HR data is encrypted. Filtration Station also uses the third-party cloud provider to host its business marketing contact database. The marketing database was not affected by the data breach. It appears that the data breach was caused when a system administrator at the cloud provider stored the encryption keys with the data
itself.
The Board has asked Otto to provide information about the data breach and how updates on new developments in privacy laws and regulations apply to Filtration Station. They are particularly concerned about staying up to date on the various U.S. state laws and regulations that have been in the news, especially the California Consumer Privacy Act (CCPA) and breach notification requirements.
The Board has asked Otto whether the company will need to comply with the new California Consumer Privacy Law (CCPA). What should Otto tell the Board?


A.

That CCPA will apply to the company only after the California Attorney General determines that it will enforce the statute. 


B.

That the company is governed by CCPA, but does not need to take any additional steps because it follows CPBR.


C.

That business contact information could be considered personal information governed by CCPA.


D.

That CCPA only applies to companies based in California, which exempts the company from compliance.





Which of the following privacy rights is NOT available under the Colorado Privacy Act?


A.

The right to access sensitive data.


B.

The right to correct sensitive data.


C.

The right to delete sensitive data.


D.

The right to limit the use of sensitive data.





SCENARIO
Please use the following to answer the next QUESTION:
Matt went into his son’s bedroom one evening and found him stretched out on his bed
typing on his laptop. “Doing your network?” Matt asked hopefully.
“No,” the boy said. “I’m filling out a survey.”
Matt looked over his son’s shoulder at his computer screen. “What kind of survey?” “It’s asking Questions about my opinions.”
“Let me see,” Matt said, and began reading the list of Questions that his son had already answered. “It’s asking your opinions about the government and citizenship. That’s a little odd. You’re only ten.”
Matt wondered how the web link to the survey had ended up in his son’s email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son’s inbox, and he decided it was time to report the incident to the proper authorities.
Based on the incident, the FTC’s enforcement actions against the marketer would most likely include what violation?


A.

Intruding upon the privacy of a family with young children.


B.

Collecting information from a child under the age of thirteen.


C.

Failing to notify of a breach of children’s private information.


D.

Disregarding the privacy policy of the children’s marketing industry.