Free CIPP-C Mock Exam – Practice Online Confidently

Which of the following types of information would an organization generally NOT be required to disclose tolaw enforcement?

SCENARIOPlease use the following to answer the next QUESTION:A US-based startup company is selling a new gaming application. One day, the CEO of the company receivesan urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by anEU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s datahandling practices.The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties inthe United States. Further, the complainant accuses the EU-based retailer of failing to respond to herwithdrawal of consent and request for erasure of her personal data. Your organization, the US-based startupcompany, was never informed of this request for erasure by the EU-based retail partner. The supervisoryauthority investigating the complaint has threatened the suspension of data flows if the parties involved do notcooperate with the investigation. The letter closes with an urgent request: “Please act immediately byidentifying all personal data received from our company.”This is an important partnership. Company executives know that its biggest fans come from Western Europe;and this retailer is primarily responsible for the startup’s rapid market penetration.As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer.Upon review, the data privacy leader discovers that the Company’s documented data inventory is obsolete.What is the data privacy leader’s next best source of information to aid the investigation?

Under the Fair and Accurate Credit Transactions Act (FACTA), what is the most appropriate action for a car dealer holding a paper folder of customer credit reports? 

According to the FTC Report of 2012, what is the main goal of Privacy by Design? 

A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?