ExamGecko
Question list
Search
Search

Related questions











Question 166 - CIPP-US discussion

Report
Export

SCENARIO -

Please use the following to answer the next question:

Jane is a U.S. citizen and a senior software engineer at California-based Jones Labs, a major software supplier to the U.S. Department of Defense and other U.S. federal agencies. Jane's manager, Patrick, is a French citizen who has been living in California for over a decade. Patrick has recently begun to suspect that Jane is an insider secretly transmitting trade secrets to foreign intelligence. Unbeknownst to Patrick, the FBI has already received a hint from anonymous whistleblower, and jointly with the National Security Agency is investigating Jane's possible implication in a sophisticated foreign espionage campaign.

Ever since the pandemic, Jane has been working from home. To complete her daily tasks she uses her corporate laptop, which after each login conspicuously provides notice that the equipment belongs to Jones Labs and may be monitored according to the enacted privacy policy and employment handbook. Jane also has a corporate mobile phone that she uses strictly for business, the terms of which are defined in her employment contract and elaborated upon in her employee handbook. Both the privacy policy and the employee handbook are revised annually by a reputable California law firm specializing in privacy law. Jane also has a personal iPhone that she uses for private purposes only.

Jones Labs has its primary data center in San Francisco, which is managed internally by Jones Labs engineers. The secondary data center, managed by Amazon AWS, is physically located in the UK for disaster recovery purposes. Jones Labs' mobile devices backup is managed by a mid-sized mobile defense company located in Denver, which physically stores the data in Canada to reduce costs. Jones Labs MS Office documents are securely stored in a Microsoft Office 365 data center based in Ireland. Manufacturing data of Jones Labs is stored in Taiwan and managed by a local supplier that has no presence in the U.S.

Before inspecting any GPS geolocation data from Jane's corporate mobile phone, Patrick should first do what?

A.

Obtain prior consent from Jane pursuant to the Telephone Consumer Protection Act

Answers
A.

Obtain prior consent from Jane pursuant to the Telephone Consumer Protection Act

B.

Revise emerging workplace privacy best practices with a reputable advocacy organization.

Answers
B.

Revise emerging workplace privacy best practices with a reputable advocacy organization.

C.

Obtain a subpoena from law enforcement, or a court order, directing Jones Labs to collect the GPS geolocation data.

Answers
C.

Obtain a subpoena from law enforcement, or a court order, directing Jones Labs to collect the GPS geolocation data.

D.

Ensure that such activity is permitted under Jane's employment contract or the company's employee privacy policy.

Answers
D.

Ensure that such activity is permitted under Jane's employment contract or the company's employee privacy policy.

Suggested answer: D

Explanation:

Patrick should first ensure that inspecting GPS geolocation data from Jane's corporate mobile phone is permitted under Jane's employment contract or the company's employee privacy policy. This is because Jane has a reasonable expectation of privacy in her location information, even if she uses a corporate-owned device for business purposes. The Fourth Amendment protects individuals from unreasonable searches and seizures by the government, and the Electronic Communications Privacy Act (ECPA) prohibits unauthorized interception or access to electronic communications by private parties. Therefore, Patrick cannot inspect Jane's GPS data without a valid legal basis, such as consent, contract, or court order. Obtaining prior consent from Jane pursuant to the Telephone Consumer Protection Act (A) is not relevant, as this law regulates unsolicited calls and text messages, not location tracking. Revising emerging workplace privacy best practices with a reputable advocacy organization (B) is not sufficient, as Patrick still needs to comply with the existing legal obligations and contractual terms. Obtaining a subpoena from law enforcement, or a court order, directing Jones Labs to collect the GPS geolocation data is not necessary, as Patrick is not acting on behalf of the government or in response to a legal request. However, if Patrick does obtain such a legal order, he should also comply with it and notify Jane of the disclosure, unless prohibited by law.Reference:

IAPP CIPP/US Study Guide, Chapter 4, Section 4.1.2, p. 115-116

IAPP CIPP/US Study Guide, Chapter 4, Section 4.2.1, p. 118-119

IAPP CIPP/US Study Guide, Chapter 4, Section 4.2.2, p. 120-121

IAPP CIPP/US Study Guide, Chapter 4, Section 4.2.3, p. 122-123

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.1, p. 124-125

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.2, p. 126-127

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.3, p. 128-129

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.4, p. 130-131

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.5, p. 132-133

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.6, p. 134-135

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.7, p. 136-137

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.8, p. 138-139

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.9, p. 140-141

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.10, p. 142-143

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.11, p. 144-145

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.12, p. 146-147

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.13, p. 148-149

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.14, p. 150-151

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.15, p. 152-153

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.16, p. 154-155

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.17, p. 156-157

asked 22/11/2024
Eduardo Messias Andrade e Oliveira
35 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first