A California resident has created an account on your company's online food delivery platform and placed several orders in the past month Later she submits a data subject request to access her personal information under the California Privacy Rights Act.Based on the CPRA. which of the following data elements would your company NOT have to provide to the requestor once her identity has been verified?

Inferences made about the individual for the company s internal purposes

The loyalty account number assigned through the individuals use of the services

The time stamp for the creation of the individual's account in the platform's database.

The email address submitted by the individual as part of the account registration process.

Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.Depending on where Matt lives, the marketer could be prosecuted for violating which of the following?

Unfair and Deceptive Acts and Practices laws.

Investigative Consumer Reporting Agencies Act.

Unfair and Deceptive Acts and Practices laws.

The U.S. Supreme Court has recognized an individual's right to privacy over personal issues, such as contraception, by acknowledging which of the following?

A ''penumbra'' of unenumerated constitutional rights as well as more general protections of due process of law.

Federal preemption of state constitutions that expressly recognize an individual right to privacy.

A ''penumbra'' of unenumerated constitutional rights as well as more general protections of due process of law.

An interpretation of the U.S. Constitution's explicit definition of privacy that extends to personal issues.

The doctrine of stare decisis, which allows the U.S. Supreme Court to follow the precedent of previously decided case law.

Based on the 2012 Federal Trade Commission report ''Protecting Consumer Privacy in an Era of Rapid Change'', which of the following directives is most important for businesses?

Integrating privacy protections during product development.

Announcing the tracking of online behavior for advertising purposes.

Integrating privacy protections during product development.

Allowing consumers to opt in before collecting any data.

Mitigating harm to consumers after a security breach.

In March 2012, the FTC released a privacy report that outlined three core principles for companies handling consumer data. Which was NOT one of these principles?

Providing greater transparency.

What is a key way that the Gramm-Leach-Bliley Act (GLBA) prevents unauthorized access into a person's back account?

By restricting the disclosure of customer account numbers by financial institutions.

By requiring immediate public disclosure after a suspected security breach.

By requiring the amount of customer personal information printed on paper.

By requiring the financial institutions limit the collection of personal information.

By restricting the disclosure of customer account numbers by financial institutions.

In what way is the Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act intended to help consumers?

By requiring companies to allow consumers to opt-out of future e-mails.

By providing consumers with free spam-filtering software.

By requiring a company to receive an opt-in before sending any advertising e-mails.

By prohibiting companies from sending objectionable content through unsolicited e-mails.

By requiring companies to allow consumers to opt-out of future e-mails.

SCENARIOPlease use the following to answer the next QUESTIONOtto is preparing a report to his Board of Directors at Filtration Station, where he is responsible for the privacy program. Filtration Station is a U.S. company that sells filters and tubing products to pharmaceutical companies for research use. The company is based in Seattle, Washington, with offices throughout the U.S. and Asia. It sells to business customers across both the U.S. and the Asia-Pacific region. Filtration Station participates in the Cross-Border Privacy Rules system of the APEC Privacy Framework.Unfortunately, Filtration Station suffered a data breach in the previous quarter. An unknown third party was able to gain access to Filtration Station's network and was able to steal data relating to employees in the company's Human Resources database, which is hosted by a third-party cloud provider based in the U.S. The HR data is encrypted. Filtration Station also uses the third-party cloud provider to host its business marketing contact database. The marketing database was not affected by the data breach. It appears that the data breach was caused when a system administrator at the cloud provider stored the encryption keys with the data itself.The Board has asked Otto to provide information about the data breach and how updates on new developments in privacy laws and regulations apply to Filtration Station. They are particularly concerned about staying up to date on the various U.S. state laws and regulations that have been in the news, especially the California Consumer Privacy Act (CCPA) and breach notification requirements.The Board has asked Otto whether the company will need to comply with the new California Consumer Privacy Law (CCPA). What should Otto tell the Board?

That business contact information could be considered personal information governed by CCPA.

That CCPA will apply to the company only after the California Attorney General determines that it will enforce the statute.

That the company is governed by CCPA, but does not need to take any additional steps because it follows CPBR.

That business contact information could be considered personal information governed by CCPA.

That CCPA only applies to companies based in California, which exempts the company from compliance.

SCENARIOPlease use the following to answer the next QUESTIONOtto is preparing a report to his Board of Directors at Filtration Station, where he is responsible for the privacy program. Filtration Station is a U.S. company that sells filters and tubing products to pharmaceutical companies for research use. The company is based in Seattle, Washington, with offices throughout the U.S. and Asia. It sells to business customers across both the U.S. and the Asia-Pacific region. Filtration Station participates in the Cross-Border Privacy Rules system of the APEC Privacy Framework.Unfortunately, Filtration Station suffered a data breach in the previous quarter. An unknown third party was able to gain access to Filtration Station's network and was able to steal data relating to employees in the company's Human Resources database, which is hosted by a third-party cloud provider based in the U.S. The HR data is encrypted. Filtration Station also uses the third-party cloud provider to host its business marketing contact database. The marketing database was not affected by the data breach. It appears that the data breach was caused when a system administrator at the cloud provider stored the encryption keys with the data itself.The Board has asked Otto to provide information about the data breach and how updates on new developments in privacy laws and regulations apply to Filtration Station. They are particularly concerned about staying up to date on the various U.S. state laws and regulations that have been in the news, especially the California Consumer Privacy Act (CCPA) and breach notification requirements.What can Otto do to most effectively minimize the privacy risks involved in using a cloud provider for the HR data?

Ensure that the cloud provider abides by the contractual requirements by conducting an on-site audit.

Request that the Board sign off in a written document on the choice of cloud provider.

Ensure that the cloud provider abides by the contractual requirements by conducting an on-site audit.

Obtain express consent from employees for storing the HR data in the cloud and keep a record of the employee consents.

Negotiate a Business Associate Agreement with the cloud provider to protect any health-related data employees might share with Filtration Station.

Which of the following statements is most accurate in regard to data breach notifications under federal and state laws:

The only obligations to provide data breach notification are under state law because currently there is no federal law or regulation requiring notice for the breach of personal information.

You must notify the Federal Trade Commission (FTC) in addition to affected individuals if over 500 individuals are receiving notice.

When providing an individual with required notice of a data breach, you must identify what personal information was actually or likely compromised.

When you are required to provide an individual with notice of a data breach under any state's law, you must provide the individual with an offer for free credit monitoring.

The only obligations to provide data breach notification are under state law because currently there is no federal law or regulation requiring notice for the breach of personal information.

What consumer service was the Fair Credit Reporting Act (FCRA) originally intended to provide?

The ability to correct inaccurate credit information.

The ability to receive reports from multiple credit reporting agencies.

The ability to appeal negative credit-based decisions.

The ability to correct inaccurate credit information.

The ability to investigate incidents of identity theft.

Privacy Is Hiring Inc., a CA-based company, is an online specialty recruiting firm focusing on placing privacy professionals in roles at major companies. Job candidates create online profiles outlining their experience and credentials, and can pay $19.99/month via credit card to have their profiles promoted to potential employers. Privacy Is Hiring Inc. keeps all customer data at rest encrypted on its servers.Under what circumstances would Privacy Is Hiring Inc., need to notify affected individuals in the event of a data breach?

If the job candidates' credit card information and the encryption keys were among the information taken.

If law enforcement has completed its investigation and has authorized Privacy Is Hiring Inc. to provide the notification to clients and applicable regulators.

If the job candidates' credit card information and the encryption keys were among the information taken.

If Privacy Is Hiring Inc., reasonably believes that job candidates will be harmed by the data breach.

If the personal information stolen included the individuals' names and credit card pin numbers.

SCENARIOPlease use the following to answer the next QUESTIONNoah is trying to get a new job involving the management of money. He has a poor personal credit rating, but he has made better financial decisions in the past two years.One potential employer, Arnie's Emporium, recently called to tell Noah he did not get a position. As part of the application process, Noah signed a consent form allowing the employer to request his credit report from a consumer reporting agency (CRA). Noah thinks that the report hurt his chances, but believes that he may not ever know whether it was his credit that cost him the job. However, Noah is somewhat relieved that he was not offered this particular position. He noticed that the store where he interviewed was extremely disorganized. He imagines that his credit report could still be sitting in the office, unsecured.Two days ago, Noah got another interview for a position at Sam's Market. The interviewer told Noah that his credit report would be a factor in the hiring decision. Noah was surprised because he had not seen anything on paper about this when he applied.Regardless, the effect of Noah's credit on his employability troubles him, especially since he has tried so hard to improve it. Noah made his worst financial decisions fifteen years ago, and they led to bankruptcy. These were decisions he made as a young man, and most of his debt at the time consisted of student loans, credit card debt, and a few unpaid bills -- all of which Noah is still working to pay off. He often laments that decisions he made fifteen years ago are still affecting him today.In addition, Noah feels that an experience investing with a large bank may have contributed to his financial troubles. In 2007, in an effort to earn money to help pay off his debt, Noah talked to a customer service representative at a large investment company who urged him to purchase stocks. Without understanding the risks, Noah agreed. Unfortunately, Noah lost a great deal of money.After losing the money, Noah was a customer of another financial institution that suffered a large security breach. Noah was one of millions of customers whose personal information was compromised. He wonders if he may have been a victim of identity theft and whether this may have negatively affected his credit.Noah hopes that he will soon be able to put these challenges behind him, build excellent credit, and find the perfect job.Consumers today are most likely protected from situations like the one Noah had buying stock because of which federal action or legislation?

Investigations of ''abusive'' acts and practices under the Dodd-Frank Wall Street Reform and Consumer Protection Act.

The rules under the Fair Debt Collection Practices Act.

The creation of the Consumer Financial Protection Bureau.

Federal Trade Commission investigations into ''unfair and deceptive'' acts or practices.

Investigations of ''abusive'' acts and practices under the Dodd-Frank Wall Street Reform and Consumer Protection Act.

More than half of U S. states require telemarketers to do which of the following?

Register with the state before conducting business.

Identify themselves at the beginning of a call

Obtain written consent from potential customers

Register with the state before conducting business.

Provide written contracts for customer transactions

In the US, II is a best practice (and in some states a requirement) to conduct a data protection assessment in which instance?

When technology is used to monitor employees.

When a background check is used as part of the hiring process

When any information is processed by a corporation.

When trade secrets are shared with a third party.

When technology is used to monitor employees.

What is the purpose of a cure provision in a stale data privacy law?

To allow a business a limited timeframe to fix alleged violations before facing enforcement.

To allow consumers a period of time to discover their data has been mishandled

To allow a state to initiate formal enforcement actions for a fixed time period.

To allow certain provisions of a law to expire after a defined time period

SCENARIOPlease use the following to answer the next QUESTIONNoah is trying to get a new job involving the management of money. He has a poor personal credit rating, but he has made better financial decisions in the past two years.One potential employer, Arnie's Emporium, recently called to tell Noah he did not get a position. As part of the application process, Noah signed a consent form allowing the employer to request his credit report from a consumer reporting agency (CRA). Noah thinks that the report hurt his chances, but believes that he may not ever know whether it was his credit that cost him the job. However, Noah is somewhat relieved that he was not offered this particular position. He noticed that the store where he interviewed was extremely disorganized. He imagines that his credit report could still be sitting in the office, unsecured.Two days ago, Noah got another interview for a position at Sam's Market. The interviewer told Noah that his credit report would be a factor in the hiring decision. Noah was surprised because he had not seen anything on paper about this when he applied.Regardless, the effect of Noah's credit on his employability troubles him, especially since he has tried so hard to improve it. Noah made his worst financial decisions fifteen years ago, and they led to bankruptcy. These were decisions he made as a young man, and most of his debt at the time consisted of student loans, credit card debt, and a few unpaid bills -- all of which Noah is still working to pay off. He often laments that decisions he made fifteen years ago are still affecting him today.In addition, Noah feels that an experience investing with a large bank may have contributed to his financial troubles. In 2007, in an effort to earn money to help pay off his debt, Noah talked to a customer service representative at a large investment company who urged him to purchase stocks. Without understanding the risks, Noah agreed. Unfortunately, Noah lost a great deal of money.After losing the money, Noah was a customer of another financial institution that suffered a large security breach. Noah was one of millions of customers whose personal information was compromised. He wonders if he may have been a victim of identity theft and whether this may have negatively affected his credit.Noah hopes that he will soon be able to put these challenges behind him, build excellent credit, and find the perfect job.Based on the scenario, which legislation should ease Noah's worry about his credit report as a result of applying at Arnie's Emporium?

The Disposal Rule under the Fair and Accurate Credit Transactions Act (FACTA).

The Privacy Rule under the Gramm-Leach-Bliley Act (GLBA).

The Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA).

The Disposal Rule under the Fair and Accurate Credit Transactions Act (FACTA).

The Red Flags Rule under the Fair and Accurate Credit Transactions Act (FACTA).

Which federal agency plays a role in privacy policy, but does NOT have regulatory authority?

The Office of the Comptroller of the Currency.

The Federal Communications Commission.

The Department of Transportation.

Which of the following is NOT one of three broad categories of products offered by data brokers, as identified by the U.S. Federal Trade Commission (FTC)?

Location of individuals (such as identifying an individual from partial information).

Research (such as information for understanding consumer trends).

Risk mitigation (such as information that may reduce the risk of fraud).

Location of individuals (such as identifying an individual from partial information).

Marketing (such as appending data to customer information that a marketing company already has).

What information did the Red Flag Program Clarification Act of 2010 add to the original Red Flags rule?

The definition of what constitutes a creditor.

The most common methods of identity theft.

The definition of what constitutes a creditor.

The process for proper disposal of sensitive data.

The components of an identity theft detection program.

Although an employer may have a strong incentive or legal obligation to monitor employees' conduct or behavior, some excessive monitoring may be considered an intrusion on employees' privacy? Which of the following is the strongest example of excessive monitoring by the employer?

An employer who installs video monitors in physical locations, such as a changing room, to reduce the risk of sexual harassment.

An employer who installs a video monitor in physical locations, such as a warehouse, to ensure employees are performing tasks in a safe manner and environment.

An employer who installs data loss prevention software on all employee computers to limit transmission of confidential company information.

An employer who installs video monitors in physical locations, such as a changing room, to reduce the risk of sexual harassment.

An employer who records all employee phone calls that involve financial transactions with customers completed over the phone.

SCENARIOPlease use the following to answer the next QUESTIONFelicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in California. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants' postings on social media, ask QUESTION NO:s about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements.Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle's GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia's concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that even if the business grows a customer database of a few thousand, it's unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.In any case, Celeste feels that all they need is common sense -- like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she's right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.Which law will be most relevant to Felicia's plan to ask applicants about drug addiction?

The Americans with Disabilities Act (ADA).

The Occupational Safety and Health Act (OSHA).

The Genetic Information Nondiscrimination Act of 2008.

The Health Insurance Portability and Accountability Act (HIPAA).

Your company, an online store selling digital keys to video games, has received a data access request from an individual. Specifically, the individual wants access to her recent purchase history, as she has misplaced the emails containing the digital keys to multiple game purchases she made last month.From a security standpoint, what would the user have to do under CCPA in order to acceptably verify her identity?

Log in to her password-protected account with the company

Take a photo of herself with her driver license

Provide a notarized affidavit signed by two witnesses.

Log in to her password-protected account with the company

Phone the company and provide her contact details and credit card number

Which of the following would NOT be regulated by the Illinois Biometnc Information Pnvacy Act (BIPA)?

Photographs of local convicted felons uploaded lo a news website.

Fingerprint scans of elementary school students used to open their lockers

Security software designed to identify local convicted felons in retail stores via facial recognition.

Retina scans of elementary school students used to verify their identities for attendance purposes

SCENARIOPlease use the following to answer the next QUESTIONFelicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in California. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants' postings on social media, ask QUESTION NO:s about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements.Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle's GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia's concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that even if the business grows a customer database of a few thousand, it's unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.In any case, Celeste feels that all they need is common sense -- like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she's right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.Based on Felicia's Bring Your Own Device (BYOD) plan, the business consultant will most likely advise Felicia and Celeste to do what?

Weigh any productivity benefits of the plan against the risk of privacy issues.

Reconsider the plan in favor of a policy of dedicated work devices.

Adopt the same kind of monitoring policies used for work-issued devices.

Weigh any productivity benefits of the plan against the risk of privacy issues.

Make employment decisions based on those willing to consent to the plan in writing.

Which statement is FALSE regarding the provisions of the Employee Polygraph Protection Act of 1988 (EPPA)?

Employers are prohibited from administering psychological testing based on personality traits such as honesty, preferences or habits.

The EPPA requires that employers post essential information about the Act in a conspicuous location.

The EPPA includes an exception that allows polygraph tests in professions in which employee honesty is necessary for public safety.

Employers are prohibited from administering psychological testing based on personality traits such as honesty, preferences or habits.

Employers involved in the manufacture of controlled substances may terminate employees based on polygraph results if other evidence exists.

Which statute is considered part of U.S. federal privacy law?

The Personal Information Protection and Electronic Documents Act.

The FTC often negotiates consent decrees with companies found to be in violation of privacy principles. How does this benefit both parties involved?

It spares the expense of going to trial.

It standardizes the amount of fines.

It simplifies the audit requirements.

It avoids potentially harmful publicity.

It spares the expense of going to trial.

When developing a company privacy program, which of the following relationships will most help a privacy professional develop useful guidance for the organization?

Relationships with individuals across company departments and at different levels in the organization's hierarchy.

Relationships with individuals within the privacy professional community who are able to share expertise and leading practices for different industries.

Relationships with clients, vendors, and customers whose data will be primarily collected and used throughout the organizational program.

Relationships with company leaders responsible for approving, implementing, and periodically reviewing the corporate privacy program.

Relationships with individuals across company departments and at different levels in the organization's hierarchy.

The Family Educational Rights and Privacy Act (FERPA) requires schools to do all of the following EXCEPT?

Obtain student authorization before releasing directory information in their records.

Verify the identity of students who make requests for access to their records.

Provide students with access to their records within a specified amount of time.

Respond to all reasonable student requests regarding explanation of their records.

Obtain student authorization before releasing directory information in their records.

Chanel Hair Studio is a busy high-end hair salon. In an effort to maximize efficiency of its operations and reduce wait times for appointments, Chanel decides to implement artificial intelligence software that will use client profiles and history to predict which clients will likely be late for their appointments. Information used to create the client profile included appointment history, distance from the salon, and any references to being tardy pulled from the client's social media accounts. If a client is predicted to be late, their appointment will be cancelled within 5 minutes.Based on the details, what is the biggest potential privacy concern related to Chanel's use of this new software?

Scanning a client's social media accounts to use in a client profile without notice to the client.

Calculating client profile address distance from the salon to determine location from salon to help predict if the client will be late.

Using client profile information for any purpose other than setting up an appointment.

Assessing client tardiness history with the salon for predictive purposes.

Which of the following laws is NOT involved in the regulation of employee background checks?

The Gramm-Leach-Bliley Act (GLBA).

The U.S. Fair Credit Reporting Act (FCRA).

The California Investigative Consumer Reporting Agencies Act (ICRAA).

In 2011, the FTC announced a settlement with Google regarding its social networking service Google Buzz. The FTC alleged that in the process of launching the service, the company did all of the following EXCEPT?

Failed to employ sufficient security safeguards.

Violated its own privacy policies.

Engaged in deceptive trade practices.

Failed to comply with Safe Harbor principles.

Failed to employ sufficient security safeguards.

IAPP CIPP-US Practice Test 4 - Free Online Exam Prep & Questions

Under the California Consumer Privacy Act (as amended by the California Pnvacy Rights Act), a consumer may Initiate a civil action against a business for?

Become a Premium Member for full access

Unlock Premium Member

IAPP CIPP-US Practice Test 4

Question

IAPP CIPP-US Practice Tests

Practice Tests