The CFO of a pharmaceutical company is duped by a phishing email and discloses many of the company's employee personnel files to an online predator. The files include employee contact information, job applications, performance reviews, discipline records, and job descriptions.Which of the following state laws would be an affected employee's best recourse against the employer?

The state social security number confidentiality statute.

The state personnel record review statute.

The state data destruction statute.

A company based in United States receives information about its UK subsidiary's employees in connection with the centralized HR service it provides.How can the UK company ensure an adequate level of data protection that would allow the restricted data transfer to continue?

By revising the contract with the United States parent company incorporating EU SCCs, as it continues to be valid for restricted transfers under the UK regime.

By signing up to an approved code of conduct under UK GDPR to demonstrate compliance with its requirements, both for the parent and the subsidiary companies.

By revising the contract with the United States parent company incorporating EU SCCs, as it continues to be valid for restricted transfers under the UK regime.

By submitting to the ICO a new application for the UK BCRs using the UK BCR application forms, as their existing authorized EU BCRs are not recognized.

By allowing each employee the option to opt-out to the restricted transfer, as it is necessary to send their names in order to book the sales bonuses.

Which of the following state laws has an entity exemption for organizations subject to the Gramm-Leach-Bliley Act (GLBA)?

California Consumer Privacy Act.

Virginia Consumer Data Protection Act

SCENARIO -Please use the following to answer the next question:Jane is a U.S. citizen and a senior software engineer at California-based Jones Labs, a major software supplier to the U.S. Department of Defense and other U.S. federal agencies. Jane's manager, Patrick, is a French citizen who has been living in California for over a decade. Patrick has recently begun to suspect that Jane is an insider secretly transmitting trade secrets to foreign intelligence. Unbeknownst to Patrick, the FBI has already received a hint from anonymous whistleblower, and jointly with the National Security Agency is investigating Jane's possible implication in a sophisticated foreign espionage campaign.Ever since the pandemic, Jane has been working from home. To complete her daily tasks she uses her corporate laptop, which after each login conspicuously provides notice that the equipment belongs to Jones Labs and may be monitored according to the enacted privacy policy and employment handbook. Jane also has a corporate mobile phone that she uses strictly for business, the terms of which are defined in her employment contract and elaborated upon in her employee handbook. Both the privacy policy and the employee handbook are revised annually by a reputable California law firm specializing in privacy law. Jane also has a personal iPhone that she uses for private purposes only.Jones Labs has its primary data center in San Francisco, which is managed internally by Jones Labs engineers. The secondary data center, managed by Amazon AWS, is physically located in the UK for disaster recovery purposes. Jones Labs' mobile devices backup is managed by a mid-sized mobile defense company located in Denver, which physically stores the data in Canada to reduce costs. Jones Labs MS Office documents are securely stored in a Microsoft Office 365 data center based in Ireland. Manufacturing data of Jones Labs is stored in Taiwan and managed by a local supplier that has no presence in the U.S.Before inspecting any GPS geolocation data from Jane's corporate mobile phone, Patrick should first do what?

Ensure that such activity is permitted under Jane's employment contract or the company's employee privacy policy.

Obtain prior consent from Jane pursuant to the Telephone Consumer Protection Act

Revise emerging workplace privacy best practices with a reputable advocacy organization.

Obtain a subpoena from law enforcement, or a court order, directing Jones Labs to collect the GPS geolocation data.

Ensure that such activity is permitted under Jane's employment contract or the company's employee privacy policy.

Once a breach has been definitively established, which task should be prioritized next?

Providing notice to the affected parties so they can take precautionary measures.

Involving law enforcement and state Attorneys General.

Determining what was responsible for the breach and neutralizing the threat.

Providing notice to the affected parties so they can take precautionary measures.

Implementing remedial measures and evaluating how to prevent future breaches.

SCENARIO -Please use the following to answer the next question:Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app.For this new initiative, Miraculous is considering a product built by MedApps, a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices' branding. MedApps provides technical support for the app, which it hosts in the cloud. MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service.Riya is the Privacy Officer at Miraculous, responsible for the practice's compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices, as well as negotiating the terms of vendor agreements. Riya is currently reviewing the suitability of the MedApps app from a privacy perspective.Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps' optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps.What HIPAA compliance issue would Miraculous have to consider before using the telehealth app?

HIPAA would require Miraculous and MedApps to enter into a Business Associate Agreement.

HIPAA does not permit healthcare providers to use cloud hosting services.

HIPAA does not permit in-person appointment data to be hosted in the cloud.

HIPAA would require Miraculous and MedApps to enter into a Business Associate Agreement.

HIPAA would require Miraculous to obtain patient consent before in-person appointment data can be shared with third parties.

What was unique about the action that the Federal Trade Commission took against B.J.'s Wholesale Club in 2005?

It was based on matters of fairness rather than deception.

It made third-party audits a penalty for policy violations.

It was based on matters of fairness rather than deception.

It was the first substantial U.S.-EU Safe Harbor enforcement.

It made user consent mandatory after any revisions of policy.

Mega Corp. is a U.S.-based business with employees in California, Virginia, and Colorado. Which of the following must Mega Corp. comply with in regard to its human resources data?

California Privacy Rights Act, Virginia Consumer Data Protection Act, and Colorado Privacy Act.

California Privacy Rights Act and Virginia Consumer Data Protection Act.

California Privacy Rights Act and Colorado Privacy Act.

California Privacy Rights Act, Virginia Consumer Data Protection Act, and Colorado Privacy Act.

Which of the following privacy rights is NOT available under the Colorado Privacy Act?

The right to limit the use of sensitive data.

The right to access sensitive data.

The right to correct sensitive data.

The right to delete sensitive data.

The right to limit the use of sensitive data.

SuperMart is a large Nevada-based business that has recently determined it sells what constitutes ''covered information'' under Nevada's privacy law, Senate Bill 260. Which of the following privacy compliance steps would best help SuperMart comply with the law?

Providing a mechanism for consumers to opt out of sales.

Implementing internal protocols for handling access and deletion requests.

Preparing a notice of financial incentive for any loyalty programs offered to its customers.

Reviewing its vendor contracts to ensure that the vendors are subject to service provider restrictions.

Under GLBA. which of these organizations would not be required to provide its customers with an annual privacy notice?

A credit union that has not made changes to its privacy notice from last year

An insurance company that has no privacy department

An auction house that also acts as a financial institution

A credit union that has made changes to its privacy notice from last year.

A credit union that has not made changes to its privacy notice from last year

The concept of data portability refers to what?

The ability of individuals to obtain and reuse their personal data for their own purposes across different services.

The practice of disclosing all the data sources one organization uses to enhance data collection from different social media platforms

The technical measures organizations use to empower consumers' control in case data is being transferred to service providers

The ability of individuals to obtain and reuse their personal data for their own purposes across different services.

The ability of individuals to easily change to another similar service provider if fees are unlawfully being raised

Which of the following is NOT a common challenge large organizations face when implementing data portability?

The technical skillsets available in the transmitting organization.

The presence of third-party data in the data to be ported.

Technically compatible systems for transmission feasibility

Security considerations in relation to the transfer of the data.

The technical skillsets available in the transmitting organization.

Under the EU-US Data Privacy Framework, what must participating organizations provide to individuals in regard to complaints and disputes?

An independent recourse mechanism.

A copy 01 the individual's personal data

A description of the organization's data processing policies

A means of communicating with the organization's privacy team.

SCENARIOPlease use the following to answer the next question;Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app.For this new initiative. Miraculous is considering a product built by MedApps. a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices' branding. MedApps provides technical support for the app. which it hosts in the cloud MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the serviceRiya is the Privacy Officer at Miraculous, responsible for the practice s compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices. as well as negotiating the terms of vendor agreements Riya is currently reviewing the suitability of the MedApps app from a pnvacy perspectiveRiya has also been asked by the Miraculous Healthcare business operations team to review the MedApps' optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedAppsWhich of the following would accurately describe the relationship of the parties if they enter into a contract for use of the app?

Miraculous Healthcare would be the covered entity because it is the healthcare provider; MedApps would be a business associate because it is providing a service to support Miraculous.

Miraculous Healthcare would be the covered entity because Us name and branding are on the app. MedApps would be a business associate because it Is hosting the data that supports the app

MedApps would be the covered entity because it built and hosts the app and all the data. Miraculous Healthcare would be a business associate because it only provides its brand on the app.

Miraculous Healthcare would be a covered entity because it is the healthcare provider; MedApps would also be a covered entity because the data in the app is being shared with it.

Miraculous Healthcare would be the covered entity because it is the healthcare provider; MedApps would be a business associate because it is providing a service to support Miraculous.

SCENARIOPlease use the following to answer the next question;Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering teleheaith appointments, where patients can have virtual appointments with on-site doctors via a phone appFor this new initiative. Miraculous is considering a product built by MedApps, a company that makes quality teleheaith apps for healthcare practices and licenses them to be used with the practices' branding. MedApps provides technical support for the app. which it hosts in the cloud MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the serviceRiya is the Privacy Officer at Miraculous, responsible for the practice's compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices. as well as negotiating the terms of vendor agreements Riya is currently reviewing the suitability of the MedApps app from a privacy perspective.Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps' optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedAppsWhat is the most practical action Riya can take to minimize the privacy risks of using an app for telehealth appointments?

Engage in active oversight of MedApps

Prevent MedApps from using copies of the patient data.

Require MedApps to obtain consent from all patients.

Require MedApps to submit a SOC2 report.

Engage in active oversight of MedApps

SCENARIOPlease use the following to answer the next question;Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering tliehealth appointments, where patients can have virtual appointments with on-site doctors via a phone appFor this new initiative. Miraculous is considering a product built by MedApps, a company that makes quality teleheaith apps for healthcare practices and licenses them to be used with the practices' branding. MedApps provides technical support for the app. which it hosts in the cloud. MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the serviceRiya is the Privacy Officer at Miraculous, responsible for the practice's compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices. as well as negotiating the terms of vendor agreements. Riya is currently reviewing the suitability of the MedApps app from a privacy perspective.Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps' optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedAppsaIf MedApps receives an access request under CCPAfrom a California-based app user, how should It handle the request?

MedApps should promptly forward the request to Miraculous for instructions on handling.

MedApps should immediately begin deleting the user's data.

MedApps should provide the privacy notice in an easily readable format

MedApps should decline the request because MedApps is not based In California.

MedApps should promptly forward the request to Miraculous for instructions on handling.

What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?

The truncation of account numbers on credit card receipts

The ability to correct inaccurate credit report information

The truncation of account numbers on credit card receipts

The right to request removal from email lists.

The issuing of notice when third-party data is used in an adverse decision

Which of the following would best provide a sufficient consumer disclosure under the Fair Credit Reporting Act (FCRA) prior to a consumer report being obtained for employment purposes?

A verbal notice provided with a conditional offer of employment

A notice provision in an electronic employment application.

A notice provision in a mailed offer letter.

SCENARIOPlease use the following to answer the next question;Jane is a U.S. citizen and a senior software engineer at California-based Jones Labs, a major software supplier to the U.S. Department of Defense and other U.S. federal agencies Jane's manager, Patrick, is a French citizen who has been living in California for over a decade. Patrick has recently begun to suspect that Jane is an insider secretly transmitting trade secrets to foreign intelligence. Unbeknownst to Patrick, the FBI has already received a hint from anonymous whistleblower, and jointly with the National Secunty Agency is investigating Jane's possible implication in a sophisticated foreign espionage campaignEver since the pandemic. Jane has been working from home. To complete her daily tasks she uses her corporate laptop, which after each togin conspicuously provides notice that the equipment belongs to Jones Labs and may be monitored according to the enacted privacy policy and employment handbook Jane also has a corporate mobile phone that she uses strictly for business, the terms of which are defined in her employment contract and elaborated upon in her employee handbook. Both the privacy policy and the employee handbook are revised annually by a reputable California law firm specializing in privacy law. Jane also has a personal iPhone that she uses for private purposes only.Jones Labs has its primary data center in San Francisco, which is managed internally by Jones Labs engineers The secondary data center, managed by Amazon AWS. is physically located in the UK for disaster recovery purposes. Jones Labs' mobile devices backup is managed by a mid-sized mobile delense company located in Denver, which physically stores the data in Canada to reduce costs. Jones Labs MS Office documents are securely stored in a Microsoft Office 365 dataWhen storing Jane's fingerprint for remote authentication. Jones Labs should consider legality issues under which of the following9

The applicable state law such as Illinois BIPA

The Privacy Rule of the HITECH Act.

The California loT Security Law (SB 327).

The applicable state law such as Illinois BIPA

The federal Genetic Information Nondiscrimination Act (GINA).

SCENARIOPlease use the following to answer the next question;Jane is a U.S. citizen and a senior software engineer at California-based Jones Labs, a major software supplier to the U.S. Department of Defense and other U.S. federal agencies Jane's manager, Patrick, is a French citizen who has been living in California for over a decade. Patrick has recently begun to suspect that Jane is an insider secretly transmitting trade secrets to foreign intelligence. Unbeknownst to Patrick, the FBI has already received a hint from anonymous whistleblower, and jointly with the National Secunty Agency is investigating Jane's possible implication in a sophisticated foreign espionage campaignEver since the pandemic. Jane has been working from home. To complete her daily tasks she uses her corporate laptop, which after each togin conspicuously provides notice that the equipment belongs to Jones Labs and may be monitored according to the enacted privacy policy and employment handbook Jane also has a corporate mobile phone that she uses strictly for business, the terms of which are defined in her employment contract and elaborated upon in her employee handbook. Both the privacy policy and the employee handbook are revised annually by a reputable California law firm specializing in privacy law. Jane also has a personal iPhone that she uses for private purposes only.Jones Labs has its primary data center in San Francisco, which is managed internally by Jones Labs engineers The secondary data center, managed by Amazon AWS. is physically located in the UK for disaster recovery purposes. Jones Labs' mobile devices backup is managed by a mid-sized mobile delense company located in Denver, which physically stores the data in Canada to reduce costs. Jones Labs MS Office documents are securely stored in a Microsoft Office 365 dataUnder Section 702 of F1SA. The NSA may do which of the following without a Foreign Intelligence Surveillance Court warrant?

Compel AWS to disclose email communications between two Chinese nationals residing in the EU.

Compel AWS to disclose Jane's email communications with a Taiwanese national residing in Taiwan.

Compel AWS to disclose email communications between two Chinese nationals residing in the EU.

Compel Microsoft to disclose Patnck's Skype calls with a Brazilian national living in Peru.

Compel Jane to disclose the PIN code for her corporate mobile phone.

According to the Family Educational Rights and Privacy Act (FERPA). when can a school disclose records without a student's consent?

If the disclosure is for the purpose of providing transcripts to a school where a student intends to enroll.

If the disclosure Is not to be conducted through email to the third party

If the disclosure would not reveal a student's student identification number

If the disclosure is made to practitioners who are involved in a student's hearth care.

If the disclosure is for the purpose of providing transcripts to a school where a student intends to enroll.

A software company wants to use web scraping to collect personal data from professional networking websites in order to train an artificial intelligence program to evaluate Job applications. The company has identified several actions for limiting their potential legal liability regarding affected data subjects and professional networking websites. Which of the following would be the least effective action for helping them do this?

Adding a notice to the company website's terms of use disclosing the use of web scraping

Following the terms of use posted on professional networking websites that are scraped.

Adding a notice to the company website's terms of use disclosing the use of web scraping

Limiting the amount of the personally identifiable information they collect

Decertifying the scraped data before selling it to any third parties.

Due to cookie deprecation, businesses will be required to simplify their tracking practices by doing what?

Deleting their existing data sets of any third-party cookies

Ensuring only registered users are tracked.

Running analytics only in dedicated sandboxes

Purging existing IDs that identify visitors by browser.

Deleting their existing data sets of any third-party cookies

The Clarifying Lawful Overseas Use of Data (CLOUD) Act is primarily intended to do which of the following?

Update the legal mechanisms through which federal law enforcement may obtain data that service providers maintain in a foreign country

Codify a treaty with the EU that permits the cross-border transfer of personal information from the EU to the United States in compliance with the General Data Protection Regulation (GDPR).

Update the legal mechanisms through which federal law enforcement may obtain data that service providers maintain in a foreign country

Establish baseline pnvacy obligations that US companies must comply with for personal information, even if stored in a foreign country

Prohibit foreign companies from using the personal Information of US. citizens without their consent

Which of the following most accurately describes the regulatory status ot pandemic contact-tracing apps in the United States?

Contact tracing is subject to a patchwork of federal and state privacy laws

Contact tracing is covered exclusively under the Health Insurance Portability and Accountability Act (HIPAA).

Contact tracing is regulated by the U.S. Centers for Disease Control and Prevention (CDC).

Contact tracing is subject to a patchwork of federal and state privacy laws

Contact tracing is not regulated in the United States.

Which power was NOT granted to the California Privacy Protection Agency by the California Privacy Rights Act (CPRA)?

Overriding decisions of the Attorney General regarding CCPA enforcement

Adopting and updating CCPA regulations

Investigating possible violations of the CCPA on the agency's own initiative.

Overriding decisions of the Attorney General regarding CCPA enforcement

Imposing administrative fines for violations of the CCPA

Which of the following data elements is most likely to be subject to comprehensive state data security and privacy laws?

Account holders' social security numbers, maintained by a bank.

Users' sexual orientations, maintained by a social media website

Individual drivers' license numbers, maintained by a state agency.

Contact details of individuals who report emergencies, maintained by local authorities

Which of the following conditions would NOT be sufficient to excuse an entity from providing breach notification under state law?

If the data involved was accessed but not exported.

If the data involved was encrypted.

If the data involved was accessed but not exported.

If the entity was subject to the GLBA Safeguards Rule.

If the entity followed internal notification procedures compatible with state law.

The use of cookies on a website by a service provider is generally not deemed a 'sale' of personal information by CCPA, as long as which of the following conditions is met?

The information collected by the service provider is necessary to perform debugging and the business and service provider have entered into an appropriate agreement.

The third party stores personal information to trigger a response to a consumer's request to exercise their right to opt in.

The analytics cookies placed by the service provider are capable of being tracked but cannot be linked to a particular consumer of that business.

The service provider retains personal information obtained in the course of providing the services specified in the agreement with the subcontractors.

The information collected by the service provider is necessary to perform debugging and the business and service provider have entered into an appropriate agreement.

Under the Driver's Privacy Protection Act (DPPA), which of the following parties would require consent of an individual in order to obtain his or her Department of Motor Vehicle information?

Marketers wishing to distribute bulk materials.

Law enforcement agencies performing investigations.

Insurance companies needing to investigate claims.

Attorneys gathering information related to lawsuits.

Marketers wishing to distribute bulk materials.

Which of the following federal agencies does NOT have regulatory authority related to privacy?

Consumer Financial Protection Bureau.

U.S. Department of Transportation.

IAPP CIPP-US Practice Test 5 - Free Online Exam Prep & Questions

A financial services company install 'bossware' software on its employees' remote computers to monitor performance. The software logs screenshots, mouse movements, and keystrokes to determine whether an employee is being productive. The software can also enable the computer webcams to record video footage.

Which of the following would best support an employee claim for an intrusion upon seclusion tort?

Become a Premium Member for full access

Unlock Premium Member

IAPP CIPP-US Practice Test 5

Question

IAPP CIPP-US Practice Tests

Practice Tests