Ask Question
IAPP CIPP-US Practice Test - Questions Answers, Page 4
Add to Whishlist
List of questions
Question 31
All of the following are tasks in the ''Discover'' phase of building an information management program EXCEPT?
Facilitating participation across departments and levels
Developing a process for review and update of privacy policies
Deciding how aggressive to be in the use of personal information
Understanding the laws that regulate a company's collection of information
The ''Discover'' phase of building an information management program is the first step in the process of creating a privacy framework. It involves identifying the types, sources, and flows of personal information within an organization, as well as the legal, regulatory, and contractual obligations that apply to it. The tasks in this phase include:
Conducting a data inventory and mapping exercise to document what personal information is collected, used, shared, and stored by the organization, and how it is protected.
Assessing the current state of privacy compliance and risk by reviewing existing policies, procedures, and practices, and identifying any gaps or weaknesses.
Understanding the laws that regulate a company's collection of information, such as the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), and the California Consumer Privacy Act (CCPA).
Facilitating participation across departments and levels to ensure that all stakeholders are involved and informed of the privacy goals and objectives, and to foster a culture of privacy awareness and accountability.
Developing a process for review and update of privacy policies is not a task in the ''Discover'' phase, but rather in the ''Implement'' phase, which is the third step in the process of creating a privacy framework. It involves putting the privacy policies and procedures into action, and ensuring that they are effective and compliant. The tasks in this phase include:
Developing a process for review and update of privacy policies to reflect changes in the business environment, legal requirements, and best practices, and to incorporate feedback from internal and external audits and assessments.
Implementing privacy training and awareness programs to educate employees and other relevant parties on their roles and responsibilities regarding privacy, and to promote a privacy-by-design approach.
Establishing privacy governance and oversight mechanisms to monitor and measure the performance and outcomes of the privacy program, and to ensure accountability and transparency.
Developing a process for responding to privacy incidents and requests from data subjects, regulators, and other parties, and to mitigate and remediate any privacy risks or harms.
IAPP CIPP/US Body of Knowledge, Domain I: Information Management from a U.S. Perspective, Section A: Building a Privacy Program
IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 1: Information Management from a U.S. Perspective, Section 1.1: Building a Privacy Program
Practice Exam - International Association of Privacy Professionals
Question 32
Which of the following describes the most likely risk for a company developing a privacy policy with standards that are much higher than its competitors?
Being more closely scrutinized for any breaches of policy
Getting accused of discriminatory practices
Attracting skepticism from auditors
Having a security system failure
A company that develops a privacy policy with standards that are much higher than its competitors may face the risk of being more closely scrutinized for any breaches of policy by regulators, customers, media, or other stakeholders. This is because the company sets a higher expectation for its privacy practices and may be held to a higher standard of accountability and transparency. If the company fails to comply with its own policy or experiences a data breach, it may face more severe consequences, such as reputational damage, loss of trust, legal liability, or regulatory sanctions.Reference:
IAPP CIPP/US Body of Knowledge, Section I, B, 2
[IAPP CIPP/US Study Guide, Chapter 1, Section 1.4]
Question 33
If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?
Uses the transferred data for limited purposes
Provides the same level of privacy protection as the organization
Notifies the organization if it can no longer meet its requirements for proper data handling
Enters a contract with the organization that states the third party will process data according to the consent agreement
According to the Privacy Shield Framework, an organization that transfers personal data to a third party acting as an agent must ensure that the agent does all of the following1:
Uses the transferred data only for limited and specified purposes;
Provides the same level of privacy protection as is required by the Privacy Shield Principles;
Takes reasonable and appropriate steps to ensure that the agent effectively processes the personal information transferred in a manner consistent with the organization's obligations under the Principles;
Requires the agent to notify the organization if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Principles;
Upon notice, takes reasonable and appropriate steps to stop and remediate unauthorized processing; and
Provides a summary or a representative copy of the relevant privacy provisions of its contract with that agent to the Department of Commerce upon request.
Therefore, the only option that is not required by the Privacy Shield Framework is D. Enters a contract with the organization that states the third party will process data according to the consent agreement. While the organization must obtain the individual's consent for certain types of data transfers, such as those involving sensitive data or onward transfers to controllers, the organization does not have to include the consent agreement in the contract with the agent.The contract must, however, ensure that the agent will process the data in accordance with the individual's choices and expectations, as well as the Privacy Shield Principles2.
Question 34
What was the original purpose of the Federal Trade Commission Act?
To ensure privacy rights of U.S. citizens
To protect consumers
To enforce antitrust laws
To negotiate consent decrees with companies violating personal privacy
The Federal Trade Commission Act (FTCA) was adopted in 1914 as part of the Progressive Era reforms that aimed to curb the power and influence of monopolies and trusts in the U.S. economy. The FTCA created the Federal Trade Commission (FTC) as an independent agency to investigate and prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce. The FTCA also gave the FTC the authority to issue cease and desist orders, seek injunctions, and impose civil penalties for violations of the law. The FTCA was intended to complement and supplement the existing antitrust laws, such as the Sherman Act and the Clayton Act, that prohibited restraints of trade, price-fixing, mergers, and other anticompetitive conduct.
The other options are not correct, because:
The FTCA did not explicitly address privacy rights of U.S. citizens, although the FTC later used its authority under the FTCA to enforce against unfair or deceptive privacy practices, such as making false or misleading claims, failing to disclose material information, or violating consumers' choices or expectations regarding their personal data.
The FTCA did not specifically focus on consumer protection, although the FTC later expanded its scope to include consumer protection issues, such as advertising and marketing, credit and finance, privacy and security, and consumer education. The FTC also enforced other consumer protection laws, such as the Truth in Lending Act, the Fair Credit Reporting Act, the Children's Online Privacy Protection Act, and the CAN-SPAM Act.
The FTCA did not authorize the FTC to negotiate consent decrees with companies violating personal privacy, although the FTC later used consent decrees as a common tool to settle privacy cases and impose remedial measures, such as audits, reports, and compliance programs. Consent decrees are agreements between the FTC and the parties involved in a case that resolve the FTC's charges without admitting liability or wrongdoing.
FTC website, Federal Trade Commission Act
Britannica website, Federal Trade Commission Act (FTCA)
IAPP CIPP/US Study Guide, Chapter 1: Introduction to the U.S. Privacy Environment, pp. 11-12
IAPP website, Federal Trade Commission Act, Section 5 of
Question 35
SCENARIO
Please use the following to answer the next QUESTION:
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. ''Doing your network?'' Matt asked hopefully.
''No,'' the boy said. ''I'm filling out a survey.''
Matt looked over his son's shoulder at his computer screen. ''What kind of survey?'' ''It's asking Questions about my opinions.''
''Let me see,'' Matt said, and began reading the list of Questions that his son had already answered. ''It's asking your opinions about the government and citizenship. That's a little odd. You're only ten.''
Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
Based on the incident, the FTC's enforcement actions against the marketer would most likely include what violation?
Intruding upon the privacy of a family with young children.
Collecting information from a child under the age of thirteen.
Failing to notify of a breach of children's private information.
Disregarding the privacy policy of the children's marketing industry.
Based on the incident, the FTC's enforcement actions against the marketer would most likely include the violation of collecting information from a child under the age of thirteen without obtaining verifiable parental consent, as required by the Children's Online Privacy Protection Act (COPPA) Rule. The COPPA Rule applies to operators of commercial websites and online services (including mobile apps) that collect, use, or disclose personal information from children under 13, and operators of general audience websites or online services that have actual knowledge that they are collecting, using, or disclosing personal information from children under 13. The COPPA Rule also applies to websites or online services that are directed to children under 13 and that collect personal information from users of any age. The COPPA Rule defines personal information to include full name, address, phone number, email address, date of birth, and other identifiers that permit the physical or online contacting of a specific individual. The COPPA Rule requires operators to post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from children; provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information online from children; give parents the choice of consenting to the operator's collection and internal use of a child's information, but prohibiting the operator from disclosing that information to third parties (unless disclosure is integral to the site or service, in which case, this must be made clear to parents); provide parents access to their child's personal information to review and/or have the information deleted; give parents the opportunity to prevent further use or online collection of a child's personal information; maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security; and retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use. The FTC has the authority to seek civil penalties and injunctive relief for violations of the COPPA Rule. The FTC has brought numerous enforcement actions against operators for violating the COPPA Rule, resulting in millions of dollars in penalties and orders to delete illegally collected data.Reference:
Children's Privacy | Federal Trade Commission
Kids' Privacy (COPPA) | Federal Trade Commission
FTC Is Escalating Scrutiny of Dark Patterns, Children's Privacy
FTC to Crack Down on Companies that Illegally Surveil Children Learning Online
FTC Takes Action Against Company for Collecting Children's Personal Information Without Parental Permission
[IAPP CIPP/US Certified Information Privacy Professional Study Guide], Chapter 5, pages 165-168.
Question 36
SCENARIO
Please use the following to answer the next QUESTION:
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. ''Doing your network?'' Matt asked hopefully.
''No,'' the boy said. ''I'm filling out a survey.''
Matt looked over his son's shoulder at his computer screen. ''What kind of survey?'' ''It's asking Questions about my opinions.''
''Let me see,'' Matt said, and began reading the list of Questions that his son had already answered. ''It's asking your opinions about the government and citizenship. That's a little odd. You're only ten.''
Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
How does Matt come to the decision to report the marketer's activities?
The marketer failed to make an adequate attempt to provide Matt with information
The marketer did not provide evidence that the prize books were appropriate for children
The marketer seems to have distributed his son's information without Matt's permission
The marketer failed to identify himself and indicate the purpose of the messages
Matt's decision to report the marketer's activities is based on his suspicion that the marketer violated the Children's Online Privacy Protection Act (COPPA), which is a federal law that regulates the online collection, use, and disclosure of personal information from children under 13 years of age1. According to COPPA, operators of websites or online services that are directed to children or knowingly collect personal information from children must:
Provide notice to parents about their information practices and obtain verifiable parental consent before collecting, using, or disclosing personal information from children12.
Give parents the choice of consenting to the operator's collection and internal use of a child's information, but prohibiting the operator from disclosing that information to third parties (unless disclosure is integral to the site or service, in which case, this must be made clear to parents)12.
Provide parents access to their child's personal information to review and/or have the information deleted and give parents the opportunity to prevent further use or online collection of a child's personal information12.
Maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security12.
Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use12.
Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children12.
In Matt's case, he did not receive any notice from the marketer about the survey or the contest, nor did he give his consent for the collection or disclosure of his son's personal information. He also did not have any access or control over his son's information or the ability to prevent further use or collection. Moreover, he noticed that his son's information seemed to have been shared with other marketers, as evidenced by the commercial emails in his son's inbox. These actions indicate that the marketer did not comply with COPPA's requirements and may have exposed his son's information to unauthorized or inappropriate parties.Therefore, Matt decided to report the marketer's activities to the proper authorities, such as the Federal Trade Commission (FTC), which enforces COPPA and can impose civil penalties for violations13.Reference:1: Children's Online Privacy Protection Act | Federal Trade Commission,1.2: 16 CFR Part 312 -- Children's Online Privacy Protection Rule,3.3: Children's Online Privacy Protection Act - Wikipedia,2.
Question 37
SCENARIO
Please use the following to answer the next QUESTION:
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. ''Doing your network?'' Matt asked hopefully.
''No,'' the boy said. ''I'm filling out a survey.''
Matt looked over his son's shoulder at his computer screen. ''What kind of survey?'' ''It's asking Questions about my opinions.''
''Let me see,'' Matt said, and began reading the list of Questions that his son had already answered. ''It's asking your opinions about the government and citizenship. That's a little odd. You're only ten.''
Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
How could the marketer have best changed its privacy management program to meet COPPA ''Safe Harbor'' requirements?
By receiving FTC approval for the content of its emails
By making a COPPA privacy notice available on website
By participating in an approved self-regulatory program
By regularly assessing the security risks to consumer privacy
The Children's Online Privacy Protection Act (COPPA) is a federal law that protects the privacy of children under 13 who use online sites and services. COPPA requires operators of such sites and services to obtain verifiable parental consent before collecting, using, or disclosing personal information from children, and to provide notice of their information practices to parents and the public.COPPA also gives parents the right to access, review, and delete their children's personal information, and to limit further collection or use of such information.1
One way for operators to comply with COPPA is to participate in an approved self-regulatory program, also known as a ''safe harbor'' program. These are programs that are run by industry groups or other organizations that set and enforce standards for privacy protection that meet or exceed the requirements of COPPA. Operators that join a safe harbor program and follow its guidelines are deemed to be in compliance with COPPA and are subject to the review and disciplinary procedures of the program instead of FTC enforcement actions.The FTC has approved several safe harbor programs, such as CARU, ESRB, iKeepSafe, kidSAFE, PRIVO, and TRUSTe.2
By participating in an approved self-regulatory program, the marketer in the scenario could have best changed its privacy management program to meet COPPA ''Safe Harbor'' requirements. This would mean that the marketer would have to adhere to the guidelines of the program, which would likely include obtaining verifiable parental consent before collecting personal information from children, providing clear and prominent privacy notices on its website and emails, honoring parents' choices and requests regarding their children's data, and ensuring the security and confidentiality of the data collected.The marketer would also benefit from the oversight and assistance of the program in ensuring compliance and resolving any complaints or disputes.3Reference:1: Complying with COPPA: Frequently Asked Questions4, Section A2: COPPA Safe Harbor Program3: IAPP CIPP/US Certified Information Privacy Professional Study Guide, page 143.
Question 38
What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH)?
Make electronic health records (EHRs) part of regular care
Bill the majority of patients electronically for their health care
Send health information and appointment reminders to patients electronically
Keep electronic updates about the Health Insurance Portability and Accountability Act
The HITECH Act was enacted as part of the American Recovery and Reinvestment Act of 2009 to promote the adoption and use of health information technology, especially electronic health records (EHRs), in the United States. The HITECH Act established the Medicare and Medicaid EHR Incentive Programs, which provide financial incentives to eligible health care providers who demonstrate meaningful use of certified EHR technology. Meaningful use is defined as using EHRs to improve quality, safety, efficiency, and coordination of care, as well as to engage patients and protect their privacy and security. To qualify for the incentive payments, health care providers must meet certain objectives and measures that demonstrate meaningful use of EHRs as part of their regular care. Some of these objectives and measures include:
Protect electronic protected health information (ePHI)
Generate prescriptions electronically
Implement clinical decision support (CDS)
Use computerized provider order entry (CPOE) for medication, laboratory, and diagnostic imaging orders
Timely patient access to electronic files
Exchange health information with other providers and public health agencies
Report clinical quality measures and public health data
Therefore, the correct answer is A. Making EHRs part of regular care is an important action that a health care provider must take if she wants to qualify for funds under the HITECH Act.Reference:
What is the HITECH Act? 2024 Update, section ''The Meaningful Use Program''
The HITECH Act explained: Definition, compliance, and violations, section ''HITECH Act definition and summary'' and ''Why was the HITECH Act created and why is it important?''
Proposed Rulemaking to Implement HITECH Act Modifications, section ''The Health Information Technology for Economic and Clinical Health (HITECH) Act''
Health Information Technology for Economic and Clinical Health (HITECH) Audits, section ''The American Recovery & Reinvestment Act of 2009 (ARRA, or Recovery Act)''
What is HITECH Compliance? Understanding and Meeting HITECH Requirements, section ''HITECH Compliance Requirements''
Question 39
All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?
Unlock Premium Member
Question 40
A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?
Related questions
Export
If you didn't receive an email within 5 minutes, you should submit a support request to [email protected].
|
BASIC - 1 Month
$
3
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
PLUS - 2 Months
$
15
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
PRO - 6 Months
$
40
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Selling illegal goods, money scams etc.
Serious attack on a group.
Harassing an individual (including doxing)
Threatening or glorifying violence or serious harm, including self-harm
Nudity/Sexual content
Sexually explicit or suggestive imagery or writing involving minors
Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans
Reusing content without attribution (link and blockquotes)
Not in English or has very bad formatting, grammar, and spelling
Author's credential is offensive, spam, or impersonation
Ex. Illegal content, incomplete question...
Question