IAPP CIPP-A Practice Test - Questions Answers, Page 3
Question list
Related questions
In what case would a foreign company NOT be liable for breaches of Singapore's PDPA?
If it has a physical office in Singapore.
If it is storing information in Singapore.
If it is collecting personal information in Singapore.
If it collects information from Singaporeans living abroad.
In what way are Singapore residents protected following a data breach in ways that India and Hong Kong residents are not?
The affected individuals must be informed when significant harm is likely to occur.
The relevant authority must be informed of such data breach following its discovery.
The company must have in place a data breach response plan including third-parties.
The breach must be reported to the relevant authority within 72 hours of the discovery.
Which was NOT listed as an individual right in the 1998 Fair Information Practice Principles (FIPPs)?
Notice.
Choice.
Right to erasure.
Right to data access.
What emerged as the main reason for creating a comprehensive data protection law when Singapore ministers met between 2005 and 2011?
To control increasing technological threats.
To raise Singapore's human rights standing.
To limit the scope of governmental surveillance.
To enhance Singapore's economic competitiveness.
In Singapore, a potential employer can collect all of the following data on an individual in the pre-employment phase EXCEPT?
Postings from social media websites.
Information from a background check.
Information about the individual's children.
The individual's university attendance records.
Protection of which kind of personal information is NOT explicitly mentioned in the privacy laws of Hong Kong, Singapore, and India?
Sensitive data.
Children's data.
Outsourced data.
Extraterritorial data.
SCENARIO – Please use the following to answer the next question:
Fitness For Everyone ("FFE") is a gym on Hong Kong Island that is affiliated with a network of gyms throughout Southeast Asia. When prospective members of the gym stop in, call in or submit an inquiry online, they are invited for a free trial session. At first, the gym asks prospective clients only for basic information: a full name, contact number, age and their Hong Kong ID number, so that FFE's senior trainer Kelvin can reach them to arrange their first appointment.
One day, a potential customer named Stephen took a tour of the gym with Kelvin and then decided to join FFE for six months. Kelvin pulled out a registration form and explained FFE's policies, placing a circle next to the part that read "FEE and affiliated third parties" may market new products and services using the contact information provided on the form to Stephen "for the duration of his membership." Stephen asked if he could opt-out of the marketing communications. Kelvin shrugged and said that it was a standard part of the contract and that most gyms have it, but that even so Kelvin's manager wanted the item circled on all forms. Stephen agreed, signed the registration form at the bottom of the page, and provided his credit card details for a monthly gym fee. He also exchanged instant messenger/cell details with Kelvin so that they could communicate about personal training sessions scheduled to start the following week.
After attending the gym consistently for six months, Stephen's employer transferred him to another part of the Island, so he did not renew his FFE membership.
One year later, Stephen started to receive numerous text messages each day from unknown numbers, most marketing gym or weight loss products.
Suspecting that FFE shared his information widely, he contacted his old FFE branch and asked reception if they still had his information on file. They did, but offered to delete it if he wished. He was told FFE's process to purge his information from all the affiliated systems might take 8 to 12 weeks. FFE also informed him that Kelvin was no longer employed by FFE and had recently started working for a competitor. FFE believed that Kelvin may have shared the mobile contact details of his clients with the new gym, and apologized for this inconvenience.
Which of the following types of text messages are permissible, regardless of Stephen's withdrawal of consent?
From the FFE retention department, offering a special discount for reactivating membership.
From health care services provided by Hong Kong's Hospital Authority or Department of Health.
From an FFE affiliate that provides a mechanism to opt out of further communications by reply-texting "OO."
From an FFE affiliate in the region Stephen was transferred to, offering services similar to those he purchased previously.
SCENARIO – Please use the following to answer the next question:
Delilah is seeking employment in the marketing department of Good Mining Private Limited, an industry leader in drilling mines in Singapore. Delilah, while filling in the standard paper application form, is asked to provide details about emergency contacts, medical history, blood type and her insurance policy. These fields need to be filled in no matter which department Delilah applies to. The form also asks Delilah to expressly consent to the collection, use and disclosure of her personal data.
A week after submitting the form, Delilah is invited by Evan, the Director of Marketing at Good Mining, to coffee. Just before Delilah leaves, she gives her business card containing her current business contact information to Evan. Evan then uses the business card to add Delilah's details to Good Mining's business development database, which is kept on a local server.
Good Mining uses the database to inform people about networking and client events that Good Mining organizes.
Why is Good Mining Private's standard form NOT compliant with Singapore's data protection law?
It is not available in an electronic format.
It does not contain the contact information for the HR manager.
It asks for Delilah's consent to use and disclose her personal data.
It asks for details that are not relevant to the job Delilah is applying for.
SCENARIO – Please use the following to answer the next question:
Fitness For Everyone ("FFE") is a gym on Hong Kong Island that is affiliated with a network of gyms throughout Southeast Asia. When prospective members of the gym stop in, call in or submit an inquiry online, they are invited for a free trial session. At first, the gym asks prospective clients only for basic information: a full name, contact number, age and their Hong Kong ID number, so that FFE's senior trainer Kelvin can reach them to arrange their first appointment.
One day, a potential customer named Stephen took a tour of the gym with Kelvin and then decided to join FFE for six months. Kelvin pulled out a registration form and explained FFE's policies, placing a circle next to the part that read "FEE and affiliated third parties" may market new products and services using the contact information provided on the form to Stephen "for the duration of his membership." Stephen asked if he could opt-out of the marketing communications. Kelvin shrugged and said that it was a standard part of the contract and that most gyms have it, but that even so Kelvin's manager wanted the item circled on all forms. Stephen agreed, signed the registration form at the bottom of the page, and provided his credit card details for a monthly gym fee. He also exchanged instant messenger/cell details with Kelvin so that they could communicate about personal training sessions scheduled to start the following week.
After attending the gym consistently for six months, Stephen's employer transferred him to another part of the Island, so he did not renew his FFE membership.
One year later, Stephen started to receive numerous text messages each day from unknown numbers, most marketing gym or weight loss products.
Suspecting that FFE shared his information widely, he contacted his old FFE branch and asked reception if they still had his information on file. They did, but offered to delete it if he wished. He was told FFE's process to purge his information from all the affiliated systems might take 8 to 12 weeks. FFE also informed him that Kelvin was no longer employed by FFE and had recently started working for a competitor. FFE believed that Kelvin may have shared the mobile contact details of his clients with the new gym, and apologized for this inconvenience.
Which of the following FFE data retention policies would be permitted under Section 26 of the Personal Data (Privacy) Ordinance and Hong Kong Data Protection Principle 2 regarding accuracy and retention?
Retain the data of members who have been suspended for non-payment, in the event that the data is needed to seek compensation in a court of law.
Retain all member data and documents in original form for two years after account termination, to better inform marketing efforts focused on re-activating accounts of former customers.
Retain an anonymous data set after account termination indicating dates of membership, age, and other statistical data, to be included in aggregate reports about gym membership trends.
Retain copies of files of customers who utilized personal trainer services for six months after account termination, to allow trainers to respond to inquiries from personal physicians about training-related injuries.
What benefit does making data pseudonymous offer to data controllers?
It ensures that it is impossible to re-identify the data.
It eliminates the responsibility to report data breaches.
It allows for further use of the data for research purposes.
It eliminates the need for a policy specifying data subject access rights.
Question