Exam 4: Certified Information Privacy Professional/United States (CIPP/US)

What does the Massachusetts Personal Information Security Regulation require as it relates to encryption of personal information?

What is the main challenge financial institutions face when managing user preferences?

SCENARIO Please use the following to answer the next question: Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in California. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants' postings on social media, ask questions about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements. Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle's GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision. Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia's concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that even if the business grows a customer database of a few thousand, it's unlikely that a state agency would hassle an honest business if an accidental security incident were to occur. In any case, Celeste feels that all they need is common sense - like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she's right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina. Which law will be most relevant to Felicia's plan to ask applicants about drug addiction?

The U.S. Supreme Court has recognized an individual's right to privacy over personal issues, such as contraception, by acknowledging which of the following?

Which of the following became the first state to pass a law specifically regulating the practices of data brokers?

Sarah lives in San Francisco, California. Based on a dramatic increase in unsolicited commercial emails, Sarah believes that a major social media platform with over 50 million users has collected a lot of personal information about her. The company that runs the platform is based in New York and France. Why is Sarah entitled to ask the social media platform to delete the personal information they have collected about her?

Which entities must comply with the Telemarketing Sales Rule?

Which authority supervises and enforces laws regarding advertising to children via the Internet?

In 2014, Google was alleged to have violated the Family Educational Rights and Privacy Act (FERPA) through its Apps for Education suite of tools. For what specific practice did students sue the company?

Which of the following is an important implication of the Dodd-Frank Wall Street Reform and Consumer Protection Act?

According to Section 5 of the FTC Act, self-regulation primarily involves a company's right to do what?

Federal laws establish which of the following requirements for collecting personal information of minors under the age of 13?

An organization self-certified under Privacy Shield must, upon request by an individual, do what?

According to FERPA, when can a school disclose records without a student's consent?

What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH)?

Which of the following laws is NOT involved in the regulation of employee background checks?

What practice do courts commonly require in order to protect certain personal information on documents, whether paper or electronic, that is involved in litigation?

What is the main purpose of the CAN-SPAM Act?

What is a key way that the Gramm-Leach-Bliley Act (GLBA) prevents unauthorized access into a person's back account?

In which situation is a company operating under the assumption of implied consent?