Exam 4: Certified Information Privacy Professional/United States (CIPP/US)

What was the original purpose of the Federal Trade Commission Act?

SCENARIO Please use the following to answer the next question: Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. "Doing your homework?" Matt asked hopefully. "No," the boy said. "I'm filling out a survey." Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking questions about my opinions." "Let me see," Matt said, and began reading the list of questions that his son had already answered. "It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders. To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer questions about his favorite games and toys. Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities. How could the marketer have best changed its privacy management program to meet COPPA "Safe Harbor" requirements?

Which of the following does Title VII of the Civil Rights Act prohibit an employer from asking a job applicant?

Which was NOT one of the five priority areas listed by the Federal Trade Commission in its 2012 report, "Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers"?

John, a California resident, receives notification that a major corporation with $500 million in annual revenue has experienced a data breach. John's personal information in their possession has been stolen, including his full name and social security numb. John also learns that the corporation did not have reasonable cybersecurity measures in place to safeguard his personal information. Which of the following answers most accurately reflects John's ability to pursue a legal claim against the corporation under the California Consumer Privacy Act (CCPA)?

All of the following are tasks in the "Discover" phase of building an information management program EXCEPT?

Which jurisdiction must courts have in order to hear a particular case?

Smith Memorial Healthcare (SMH) is a hospital network headquartered in New York and operating in 7 other states. SMH uses an electronic medical record to enter and track information about its patients. Recently, SMH suffered a data breach where a third-party hacker was able to gain access to the SMH internal network. Because it is a HIPPA-covered entity, SMH made a notification to the Office of Civil Rights at the U.S. Department of Health and Human Services about the breach. Which statement accurately describes SMH's notification responsibilities?

Which of the following describes the most likely risk for a company developing a privacy policy with standards that are much higher than its competitors?

Under state breach notification laws, which is NOT typically included in the definition of personal information?

All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?

If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?

If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?

Which venture would be subject to the requirements of Section 5 of the Federal Trade Commission Act?

In which situation would a policy of "no consumer choice" or "no option" be expected?

Most states with data breach notification laws indicate that notice to affected individuals must be sent in the "most expeditious time possible without unreasonable delay." By contrast, which of the following states currently imposes a definite limit for notification to affected individuals?

What is a legal document approved by a judge that formalizes an agreement between a governmental agency and an adverse party called?

Which of the following became the first state to pass a law specifically regulating the collection of biometric data?

What type of material is exempt from an individual's right to disclosure under the Privacy Act?

Which of the following is commonly required for an entity to be subject to breach notification requirements under most state laws?