What role does the U.S. Constitution play in the area of workplace privacy?

It provides significant protections to federal and state governments, but not to private-sector employment

It provides enforcement resources to large employers, but not to small businesses

It provides legal precedent for physical information security, but not for electronic security

It provides contractual protections to members of labor unions, but not to employees at will

It provides significant protections to federal and state governments, but not to private-sector employment

Which action is prohibited under the Electronic Communications Privacy Act of 1986?

Intercepting electronic communications and unauthorized access to stored communications

Monitoring all employee telephone calls

Accessing stored communications with the consent of the sender or recipient of the message

Monitoring employee telephone calls of a personal nature

Which of the following does Title VII of the Civil Rights Act prohibit an employer from asking a job applicant?

Questions about intended pregnancy

Questions about a national origin

Questions about intended pregnancy

How did the Fair and Accurate Credit Transactions Act (FACTA) amend the Fair Credit Reporting Act (FCRA)?

It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized access

It expanded the definition of ''consumer reports'' to include communications relating to employee investigations

It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized access

It stipulated the purpose of obtaining a consumer report can only be for a review of the employee's credit worthiness

It required employers to get an employee's consent in advance of requesting a consumer report for internal investigation purposes

Which federal act does NOT contain provisions for preempting stricter state laws?

The Telemarketing Consumer Protection and Fraud Prevention Act

The Children's Online Privacy Protection Act (COPPA)

The Fair and Accurate Credit Transactions Act (FACTA)

The Telemarketing Consumer Protection and Fraud Prevention Act

Which of the following is commonly required for an entity to be subject to breach notification requirements under most state laws?

The entity must conduct business in the state

The entity must have employees in the state

The entity must be registered in the state

The entity must be an information broker

What is the most likely reason that states have adopted their own data breach notification laws?

Many types of organizations are not currently subject to federal laws regarding breaches

Many states have unique types of businesses that require specific legislation

Many lawmakers believe that federal enforcement of current laws has not been effective

Many types of organizations are not currently subject to federal laws regarding breaches

Many large businesses have intentionally breached the personal information of their customers

Which federal law or regulation preempts state law?

Health Insurance Portability and Accountability Act

Controlling the Assault of Non-Solicited Pornography and Marketing Act

Electronic Communications Privacy Act of 1986

More than half of U.S. states require telemarketers to?

Register with the state before conducting business

Identify themselves at the beginning of a call

Obtain written consent from potential customers

Register with the state before conducting business

Provide written contracts for customer transactions

What does the Massachusetts Personal Information Security Regulation require as it relates to encryption of personal information?

The encryption of all personal information of Massachusetts residents when stored on portable devices.

The encryption of all personal information of Massachusetts residents when all equipment is located in Massachusetts.

The encryption of all personal information stored in Massachusetts-based companies when all equipment is located in Massachusetts.

The encryption of personal information stored in Massachusetts-based companies when stored on portable devices.

The encryption of all personal information of Massachusetts residents when stored on portable devices.

California's SB 1386 was the first law of its type in the United States to do what?

Require commercial entities to disclose a security data breach concerning personal information about the state's residents

Require notification of non-California residents of a breach that occurred in California

Require encryption of sensitive information stored on servers that are Internet connected

Require state attorney general enforcement of federal regulations against unfair and deceptive trade practices

Which of the following best describes what a ''private right of action'' is?

The right of individuals harmed by a violation of a law to file a lawsuit against the violation.

The right of individuals to keep their information private.

The right of individuals to submit a request to access their information.

The right of individuals harmed by data processing to have their information deleted.

The right of individuals harmed by a violation of a law to file a lawsuit against the violation.

Which of the following is NOT a principle found in the APEC Privacy Framework?

Integrity of Personal Information.

What is the most important action an organization can take to comply with the FTC position on retroactive changes to a privacy policy?

Obtaining affirmative consent from its customers.

Describing the policy changes on its website.

Obtaining affirmative consent from its customers.

Publicizing the policy changes through social media.

Reassuring customers of the security of their information.

Federal laws establish which of the following requirements for collecting personal information of minors under the age of 13?

Affirmative consent from a minor's parent or guardian before collecting the minor's personal information online.

Implied consent from a minor's parent or guardian, or affirmative consent from the minor.

Affirmative consent from a minor's parent or guardian before collecting the minor's personal information online.

Implied consent from a minor's parent or guardian before collecting a minor's personal information online, such as when they permit the minor to use the internet.

Affirmative consent of a parent or guardian before collecting personal information of a minor offline (e.g., in person), which also satisfies any requirements for online consent.

If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?

The impact of an organizational data breach will be more severe than if the data had been segregated.

The organization will still be in compliance with most sector-specific privacy and security laws.

The impact of an organizational data breach will be more severe than if the data had been segregated.

Temporary employees will be able to find the data necessary to fulfill their responsibilities.

The organization will be able to address legal discovery requests efficiently without producing more information than necessary.

Which of the following best describes the ASIA-Pacific Economic Cooperation (APEC) principles?

An international court ruling on personal information held in the commercial sector.

A bill of rights for individuals seeking access to their personal information.

A code of responsibilities for medical establishments to uphold privacy laws.

An international court ruling on personal information held in the commercial sector.

A baseline of marketers' minimum responsibilities for providing opt-out mechanisms.

Acme Student Loan Company has developed an artificial intelligence algorithm that determines whether an individual is likely to pay their bill or default. A person who is determined by the algorithm to be more likely to default will receive frequent payment reminder calls, while those who are less likely to default will not receive payment reminders.Which of the following most accurately reflects the privacy concerns with Acme Student Loan Company using artificial intelligence in this manner?

If the algorithm uses information about protected classes to make automated decisions, Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.

If the algorithm uses risk factors that impact the automatic decision engine. Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.

If the algorithm makes automated decisions based on risk factors and public information, Acme need not determine if the algorithm has a disparate impact on protected classes.

If the algorithm's methodology is disclosed to consumers, then it is acceptable for Acme to have a disparate impact on protected classes.

If the algorithm uses information about protected classes to make automated decisions, Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.

Global Manufacturing Co's Human Resources department recently purchased a new software tool. This tool helps evaluate future candidates for executive roles by scanning emails to see what those candidates say and what is said about them. This provides the HR department with an automated ''360 review'' that lets them know how the candidate thinks and operates, what their peers and direct reports say about them, and how well they interact with each other.What is the most important step for the Human Resources Department to take when implementing this new software?

Providing notice to employees that their emails will be scanned by the software and creating automated profiles.

Making sure that the software does not unintentionally discriminate against protected groups.

Ensuring that the software contains a privacy notice explaining that employees have no right to privacy as long as they are running this software on organization systems to scan email systems.

Confirming that employees have read and signed the employee handbook where they have been advised that they have no right to privacy as long as they are using the organization's systems, regardless of the protected group or laws enforced by EEOC.

Providing notice to employees that their emails will be scanned by the software and creating automated profiles.

Which of the following would NOT constitute an exception to the authorization requirement under the HIPAA Privacy Rule?

Disclosing health information needed to pay a third party billing administrator.

Disclosing health information for public health activities.

Disclosing health information to file a child abuse report.

Disclosing health information needed to treat a medical emergency.

Disclosing health information needed to pay a third party billing administrator.

What type of material is exempt from an individual's right to disclosure under the Privacy Act?

Material reporting investigative efforts pertaining to the enforcement of criminal law.

Material requires by statute to be maintained and used solely for research purposes.

Material reporting investigative efforts to prevent unlawful persecution of an individual.

Material used to determine potential collaboration with foreign governments in negotiation of trade deals.

Material reporting investigative efforts pertaining to the enforcement of criminal law.

Which of the following best describes an employer's privacy-related responsibilities to an employee who has left the workplace?

An employer has a responsibility to maintain the security and privacy of any sensitive employment records retained for a legitimate business purpose.

An employer has a responsibility to maintain a former employee's access to computer systems and company data needed to support claims against the company such as discrimination.

An employer has a responsibility to permanently delete or expunge all sensitive employment records to minimize privacy risks to both the employer and former employee.

An employer may consider any privacy-related responsibilities terminated, as the relationship between employer and employee is considered primarily contractual.

An employer has a responsibility to maintain the security and privacy of any sensitive employment records retained for a legitimate business purpose.

All of the following common law torts are relevant to employee privacy under US law EXCEPT?

Infliction of emotional distress.

Which law provides employee benefits, but often mandates the collection of medical information?

The Family and Medical Leave Act.

The Occupational Safety and Health Act.

The Americans with Disabilities Act.

The Employee Medical Security Act.

The Family and Medical Leave Act.

John, a California resident, receives notification that a major corporation with $500 million in annual revenue has experienced a data breach. John's personal information in their possession has been stolen, including his full name and social security numb. John also learns that the corporation did not have reasonable cybersecurity measures in place to safeguard his personal information.Which of the following answers most accurately reflects John's ability to pursue a legal claim against the corporation under the California Consumer Privacy Act (CCPA)?

John can sue the corporation for the data breach to recover monetary damages suffered as a result of the data breach, and in some circumstances seek statutory damages irrespective of whether he suffered any financial harm.

John has no right to sue the corporation because the CCPA does not address any data breach rights.

John cannot sue the corporation for the data breach because only the state's Attoney General has authority to file suit under the CCPA.

John can sue the corporation for the data breach but only to recover monetary damages he actually suffered as a result of the data breach.

John can sue the corporation for the data breach to recover monetary damages suffered as a result of the data breach, and in some circumstances seek statutory damages irrespective of whether he suffered any financial harm.

Smith Memorial Healthcare (SMH) is a hospital network headquartered in New York and operating in 7 other states. SMH uses an electronic medical record to enter and track information about its patients. Recently, SMH suffered a data breach where a third-party hacker was able to gain access to the SMH internal network.Because it is a HIPPA-covered entity, SMH made a notification to the Office of Civil Rights at the U.S. Department of Health and Human Services about the breach.Which statement accurately describes SMH's notification responsibilities?

If SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York.

If SMH is compliant with HIPAA, it will not have to make a separate notification to individuals in the state of New York.

If SMH has more than 500 patients in the state of New York, it will need to make separate notifications to these patients.

If SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York.

If SMH makes credit monitoring available to individuals who inquire, it will not have to make a separate notification to individuals in the state of New York.

Sarah lives in San Francisco, California. Based on a dramatic increase in unsolicited commercial emails, Sarah believes that a major social media platform with over 50 million users has collected a lot of personal information about her. The company that runs the platform is based in New York and France.Why is Sarah entitled to ask the social media platform to delete the personal information they have collected about her?

The California Consumer Privacy Act entitles Sarah to request deletion of her personal information.

Any company with a presence in Europe must comply with the General Data Protection Regulation globally, including in response to data subject deletion requests.

Under Section 5 of the FTC Act, the Federal Trade Commission has held that refusing to delete an individual's personal information upon request constitutes an unfair practice.

The California Consumer Privacy Act entitles Sarah to request deletion of her personal information.

The New York ''Stop Hacks and Improve Electronic Data Security'' (SHIELD) Act requires that businesses under New York's jurisdiction must delete customers' personal information upon request.

Which of the following is an example of federal preemption?

The U.S. Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act prohibiting states from passing laws that impose greater obligations on senders of email marketing.

The Payment Card Industry's (PCI) ability to self-regulate and enforce data security standards for payment card data.

The U.S. Federal Trade Commission's (FTC) ability to enforce against unfair and deceptive trade practices across sectors and industries.

The California Consumer Privacy Act (CCPA) regulating businesses that have no physical brick-and-mortal presence in California, but which do business there.

The U.S. Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act prohibiting states from passing laws that impose greater obligations on senders of email marketing.

Which of these organizations would be required to provide its customers with an annual privacy notice?

The King County Savings and Loan.

The Golden Gavel Auction House.

The King County Savings and Loan.

The Breezy City Housing Commission.

Which entity within the Department of Health and Human Services (HHS) is the primary enforcer of the Health Insurance Portability and Accountability Act (HIPAA) ''Privacy Rule''?

Office of Public Health and Safety.

Which of the following best describes how federal anti-discrimination laws protect the privacy of private-sector employees in the United States?

They limit the types of information that employers can collect about employees.

They prescribe working environments that are safe and comfortable.

They limit the amount of time a potential employee can be interviewed.

They promote a workforce of employees with diverse skills and interests.

They limit the types of information that employers can collect about employees.

Even when dealing with an organization subject to the CCPA, California residents are NOT legally entitled to request that the organization do what?

Correct their personal information.

Delete their personal information.

Correct their personal information.

Disclose their personal information to them.

Refrain from selling their personal information to third parties.

Which of the following accurately describes the purpose of a particular federal enforcement agency?

The Federal Trade Commission (FTC) is typically recognized as having the broadest authority under the FTC Act to address unfair or deceptive privacy practices.

The National Institute of Standards and Technology (NIST) has established mandatory privacy standards that can then be enforced against all for-profit organizations by the Department of Justice (DOJ).

The Cybersecurity and Infrastructure Security Agency (CISA) is authorized to bring civil enforcement actions against organizations whose website or other online service fails to adequately secure personal information.

The Federal Communications Commission (FCC) regulates privacy practices on the internet and enforces violations relating to websites' posted privacy disclosures.

The Federal Trade Commission (FTC) is typically recognized as having the broadest authority under the FTC Act to address unfair or deceptive privacy practices.

SCENARIOPlease use the following to answer the next QUESTIONWhen there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor procedures for purging and destroying outdated data. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.Based on the problems with the company's privacy security that Roberta identifies, what is the most likely cause of the breach?

Mishandling of information caused by lack of access controls.

Unintended disclosure of information shared with a third party.

Fraud involving credit card theft at point-of-service terminals.

Lost company property such as a computer or flash drive.

SCENARIOPlease use the following to answer the next QUESTIONWhen there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor procedures for purging and destroying outdated data. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.Which principle of the Consumer Privacy Bill of Rights, if adopted, would best reform the company's privacy program?

Consumers have a right to reasonable limits on the personal data that a company retains.

Consumers have a right to exercise control over how companies use their personal data.

Consumers have a right to reasonable limits on the personal data that a company retains.

Consumers have a right to easily accessible information about privacy and security practices.

Consumers have a right to correct personal data in a manner that is appropriate to the sensitivity.

SCENARIOPlease use the following to answer the next QUESTIONWhen there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor procedures for purging and destroying outdated data. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.What could the company have done differently prior to the breach to reduce their risk?

Implemented a comprehensive policy for accessing customer information.

Honored the promise of its privacy policy to acquire information by using an opt-in method.

Looked for any persistent threats to security that could compromise the company's network.

Communicated requests for changes to users' preferences across the organization and with third parties.

SCENARIOPlease use the following to answer the next QUESTIONMatt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. ''Doing your network?'' Matt asked hopefully.''No,'' the boy said. ''I'm filling out a survey.''Matt looked over his son's shoulder at his computer screen. ''What kind of survey?'' ''It's asking Questio ns about my opinions.''''Let me see,'' Matt said, and began reading the list of Questio ns that his son had already answered. ''It's asking your opinions about the government and citizenship. That's a little odd. You're only ten.''Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.Based on the incident, the FTC's enforcement actions against the marketer would most likely include what violation?

Collecting information from a child under the age of thirteen.

Intruding upon the privacy of a family with young children.

Collecting information from a child under the age of thirteen.

Failing to notify of a breach of children's private information.

Disregarding the privacy policy of the children's marketing industry.

IAPP CIPP-US Practice Test 3 - Free Online Exam Questions 81-120

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

IAPP CIPP-US Practice Test 3

Question

IAPP CIPP-US Practice Tests

Practice Tests