Question 1

According to the FTC Report of 2012, what is the main goal of Privacy by Design?

Options :

A : Obtaining consumer consent when collecting sensitive data for certain purposes

B : Establishing a system of self-regulatory codes for mobile-related services

C : Incorporating privacy protections throughout the development process

D : Implementing a system of standardization for privacy notices

Answer: C

Question 2

If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as anagent, the organization must ensure the third party does all of the following EXCEPT?

Options :

A : Uses the transferred data for limited purposes

B : Provides the same level of privacy protection as the organization

C : Notifies the organization if it can no longer meet its requirements for proper data handling

D : Enters a contract with the organization that states the third party will process data according to the consent agreement

Answer: D

Question 3

What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH)?

Options :

A : Make electronic health records (EHRs) part of regular care

B : Bill the majority of patients electronically for their health care

C : Send health information and appointment reminders to patients electronically

D : Keep electronic updates about the Health Insurance Portability and Accountability Act

Answer: A

Question 4

Which of the following types of information would an organization generally NOT be required to disclose tolaw enforcement?

Options :

A : Information about medication errors under the Food, Drug and Cosmetic Act

B : Money laundering information under the Bank Secrecy Act of 1970

C : Information about workspace injuries under OSHA requirements

D : Personal health information under the HIPAA Privacy Rule

Answer: D

Question 5

SCENARIOPlease use the following to answer the next QUESTION:A US-based startup company is selling a new gaming application. One day, the CEO of the company receivesan urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by anEU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s datahandling practices.The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties inthe United States. Further, the complainant accuses the EU-based retailer of failing to respond to herwithdrawal of consent and request for erasure of her personal data. Your organization, the US-based startupcompany, was never informed of this request for erasure by the EU-based retail partner. The supervisoryauthority investigating the complaint has threatened the suspension of data flows if the parties involved do notcooperate with the investigation. The letter closes with an urgent request: “Please act immediately byidentifying all personal data received from our company.”This is an important partnership. Company executives know that its biggest fans come from Western Europe;and this retailer is primarily responsible for the startup’s rapid market penetration.As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer.Upon review, the data privacy leader discovers that the Company’s documented data inventory is obsolete.What is the data privacy leader’s next best source of information to aid the investigation?

Options :

A : Reports on recent purchase histories

B : Database schemas held by the retailer

C : Lists of all customers, sorted by country

D : Interviews with key marketing personnel

Answer: C

Free CIPP-C Mock Exam – Practice Online Confidently

Buying Options: