CIPP/E IAPP STUDY EXAMS GUIDE QUESTIONS AND
ANSWERS SURE A+
✔✔Binding Safe Processor Rules - ✔✔Previously, the EU distinguished between
Binding Corporate Rules for controllers and Binding Safe Professor Rules for
processors. With the General Data Protection Regulation, there is now no distinction
between the two in this context and Binding Corporate Rules are appropriate for both.
✔✔Breach Disclosure - ✔✔The requirement that an organization notify regulators
and/or victims of incidents affecting the confidentiality and security of personal data. The
requirements in this arena vary wildly by jurisdiction. It is a transparency mechanism
that highlights operational failures, which helps mitigate damage and aids in the
understanding of causes of failure.
*Associated laws: FCRA, GLBA, HIPAA, various U.S. state laws
✔✔Bring Your Own Device (BYOD) - ✔✔Use of employees' own personal computing
devices for work purposes.
✔✔California Consumer Privacy Act - ✔✔The first state-level comprehensive privacy
law in the U.S. The CCPA applies broadly to businesses that collect personal
information from California consumers, imposing extensive transparency and disclosure
obligations. It also creates consumers' rights to access their personal data and to
request its deletion; to opt-out of the sale of their personal data; and to
nondiscrimination on the basis of their exercising any of their CCPA rights. In Nov.
2020, California passed the California Privacy Rights Act, which amends the CCPA and
includes additional consumer protections and business obligations. The majority of the
CPRA's provisions will enter into force Jan. 1, 2023, with a look back to Jan. 2022
✔✔California Investigative Consumer Reporting Agencies Act (CICRAA) - ✔✔A
California state law that requires employees to notify applicants and employees of their
intention to obtain and use a consumer report
✔✔California Online Privacy Protection Act (CalOPPA) - ✔✔Requires that all websites
catering to California citizens provide a privacy statement to visitors and a easy-to-find
link to it on their web pages. Websites that carry personal data on children less than 18
years of age must permit those children to delete data collected about them. Websites
also must inform visitors of the type of Do Not Track mechanisms they support or if they
do not support any at all.
*Associated term(s): Do Not Track
✔✔California Privacy Rights Act (CPRA) - ✔✔The CPRA amends the California
Consumer Privacy Act and includes additional privacy protections for consumers. It also
,creates an enforcement agency, the California Privacy Protection Agency. The majority
of the CPRA's provisions will enter into force Jan. 01, 2023, with a look-back to Jan.
2022. The CPRA passed as a ballot initiative in Nov. 2020.
✔✔Case Law - ✔✔Principles of law that have been established by judges in past
decisions. When similar issues arise again, judges look to the past decisions as
precedents and decide the new case in a manner that is consistent with past decisions.
✔✔CCTV - ✔✔Originally an acronym for "closed circuit television," CCTV has come to
be shorthand for any video surveillance system. Originally, such systems relied on
coaxial cable and was truly only accessible on premise. Today, most surveillance
systems are hosted via TCP/IP networks and can be accessed remotely, and the
footage much more easily shared, eliciting new and different privacy concerns.
✔✔Children's Online Privacy Protection Act (COPPA) of 1998 - ✔✔A U.S. federal law
that applies to the operators of commercial websites and online services that are
directed to children under the age of 13. It also applies to general audience websites
and online services that have actual knowledge that they are collecting personal
information from children under the age of 13. COPPA requires these website operators
to: post a privacy notice on the homepage of the website; provide notice about
collection practices to parents; obtain verifiable parental consent before collecting
personal information from children; give parents a choice as to whether their child's
personal information will be disclosed to third parties; provide parents access and the
opportunity to delete the child's personal information and opt out of future collection or
use of the information, and maintain the confidentiality, security, and integrity of
personal information collected from children.
✔✔Choice - ✔✔In the context of consent, choice refers to the idea that consent must be
freely given and that data subjects must have a genuine choice as to whether to provide
personal data or not. If there is no true choice it is unlikely the consent will be deemed
valid under the General Data Protection Regulation.
✔✔Cloud Computing - ✔✔The provision of information technology services over the
Internet. These services may be provided by a company for its internal users in a
"private cloud" or by third-party suppliers. The services can include software,
infrastructure (i.e., servers), hosting and platforms (i.e., operating systems). Cloud
computing has numerous applications, from personal webmail to corporate data
storage, and can be subdivided into different types of service models.
✔✔Collection Limitation - ✔✔A fair information practices principle, it is the principle
stating there should be limits to the collection of personal data, that any such data
should be obtained by lawful and fair means and, where appropriate, with the
knowledge or consent of the data subject.
, ✔✔Commercial Activity - ✔✔Under Canada's PIPEDA, "commercial activity" means any
particular transaction, act or conduct, or any regular course of conduct, that is of a
commercial character, including the selling, bartering or leasing of donor, membership
or other fundraising lists. Non-profit associations, unions and private schools are likely
to be found to exist outside of this definition.
✔✔Commercial Electronic Message (CEM) - ✔✔Any form of electronic messaging,
including e-mail, SMS text messages and messages sent via social networking about
which it would be reasonable to conclude its purpose is to encourage participation in a
commercial activity. Examples include electronic messages that offer to purchase, sell,
barter or lease products, goods, services, land or an interest or right in land; offers to
provide a business, investment or gaming opportunity; advertises or promotes anything
previously mentioned.
✔✔Common Law - ✔✔Unwritten legal principles that have developed over time based
on social customs and expectations.
✔✔Communications Privacy - ✔✔One of the four classes of privacy, along with
information privacy, bodily privacy and territorial privacy. It encompasses protection of
the means of correspondence, including postal mail, telephone conversations,
electronic email, and other forms of communicative behavior and apparatus.
✔✔Comprehensive Laws - ✔✔Laws that govern the collection, use and dissemination
of personal information in the public and private sectors.
*associated term(s): Omnibus Laws
✔✔Computer Forensics - ✔✔The discipline of assessing and examining an information
system for relevant clues even after it has been compromised by an exploit.
✔✔Confidentiality - ✔✔Data is "confidential" if it is protected against unauthorized or
unlawful processing. The General Data Protection Regulation requires that an
organization be able to ensure the ongoing confidentiality, integrity, availability and
resilience of processing systems and services as part of its requirements for appropriate
security. In addition, the GDPR requires that persons authorized to process the
personal data have committed themselves to confidentiality or are under an appropriate
statutory obligation of confidentiality.
✔✔Confirmed Opt-In (Double Opt-In) - ✔✔An email approach where marketers send a
confirmation email requiring a response from the subscriber before the subscriber
receives the actual marketing email.
✔✔Consent - ✔✔This privacy requirement is one of the fair information practices.
Individuals must be able to prevent the collection of their personal data, unless the
disclosure is required by law. If an individual has choice about the use of disclosure of
ANSWERS SURE A+
✔✔Binding Safe Processor Rules - ✔✔Previously, the EU distinguished between
Binding Corporate Rules for controllers and Binding Safe Professor Rules for
processors. With the General Data Protection Regulation, there is now no distinction
between the two in this context and Binding Corporate Rules are appropriate for both.
✔✔Breach Disclosure - ✔✔The requirement that an organization notify regulators
and/or victims of incidents affecting the confidentiality and security of personal data. The
requirements in this arena vary wildly by jurisdiction. It is a transparency mechanism
that highlights operational failures, which helps mitigate damage and aids in the
understanding of causes of failure.
*Associated laws: FCRA, GLBA, HIPAA, various U.S. state laws
✔✔Bring Your Own Device (BYOD) - ✔✔Use of employees' own personal computing
devices for work purposes.
✔✔California Consumer Privacy Act - ✔✔The first state-level comprehensive privacy
law in the U.S. The CCPA applies broadly to businesses that collect personal
information from California consumers, imposing extensive transparency and disclosure
obligations. It also creates consumers' rights to access their personal data and to
request its deletion; to opt-out of the sale of their personal data; and to
nondiscrimination on the basis of their exercising any of their CCPA rights. In Nov.
2020, California passed the California Privacy Rights Act, which amends the CCPA and
includes additional consumer protections and business obligations. The majority of the
CPRA's provisions will enter into force Jan. 1, 2023, with a look back to Jan. 2022
✔✔California Investigative Consumer Reporting Agencies Act (CICRAA) - ✔✔A
California state law that requires employees to notify applicants and employees of their
intention to obtain and use a consumer report
✔✔California Online Privacy Protection Act (CalOPPA) - ✔✔Requires that all websites
catering to California citizens provide a privacy statement to visitors and a easy-to-find
link to it on their web pages. Websites that carry personal data on children less than 18
years of age must permit those children to delete data collected about them. Websites
also must inform visitors of the type of Do Not Track mechanisms they support or if they
do not support any at all.
*Associated term(s): Do Not Track
✔✔California Privacy Rights Act (CPRA) - ✔✔The CPRA amends the California
Consumer Privacy Act and includes additional privacy protections for consumers. It also
,creates an enforcement agency, the California Privacy Protection Agency. The majority
of the CPRA's provisions will enter into force Jan. 01, 2023, with a look-back to Jan.
2022. The CPRA passed as a ballot initiative in Nov. 2020.
✔✔Case Law - ✔✔Principles of law that have been established by judges in past
decisions. When similar issues arise again, judges look to the past decisions as
precedents and decide the new case in a manner that is consistent with past decisions.
✔✔CCTV - ✔✔Originally an acronym for "closed circuit television," CCTV has come to
be shorthand for any video surveillance system. Originally, such systems relied on
coaxial cable and was truly only accessible on premise. Today, most surveillance
systems are hosted via TCP/IP networks and can be accessed remotely, and the
footage much more easily shared, eliciting new and different privacy concerns.
✔✔Children's Online Privacy Protection Act (COPPA) of 1998 - ✔✔A U.S. federal law
that applies to the operators of commercial websites and online services that are
directed to children under the age of 13. It also applies to general audience websites
and online services that have actual knowledge that they are collecting personal
information from children under the age of 13. COPPA requires these website operators
to: post a privacy notice on the homepage of the website; provide notice about
collection practices to parents; obtain verifiable parental consent before collecting
personal information from children; give parents a choice as to whether their child's
personal information will be disclosed to third parties; provide parents access and the
opportunity to delete the child's personal information and opt out of future collection or
use of the information, and maintain the confidentiality, security, and integrity of
personal information collected from children.
✔✔Choice - ✔✔In the context of consent, choice refers to the idea that consent must be
freely given and that data subjects must have a genuine choice as to whether to provide
personal data or not. If there is no true choice it is unlikely the consent will be deemed
valid under the General Data Protection Regulation.
✔✔Cloud Computing - ✔✔The provision of information technology services over the
Internet. These services may be provided by a company for its internal users in a
"private cloud" or by third-party suppliers. The services can include software,
infrastructure (i.e., servers), hosting and platforms (i.e., operating systems). Cloud
computing has numerous applications, from personal webmail to corporate data
storage, and can be subdivided into different types of service models.
✔✔Collection Limitation - ✔✔A fair information practices principle, it is the principle
stating there should be limits to the collection of personal data, that any such data
should be obtained by lawful and fair means and, where appropriate, with the
knowledge or consent of the data subject.
, ✔✔Commercial Activity - ✔✔Under Canada's PIPEDA, "commercial activity" means any
particular transaction, act or conduct, or any regular course of conduct, that is of a
commercial character, including the selling, bartering or leasing of donor, membership
or other fundraising lists. Non-profit associations, unions and private schools are likely
to be found to exist outside of this definition.
✔✔Commercial Electronic Message (CEM) - ✔✔Any form of electronic messaging,
including e-mail, SMS text messages and messages sent via social networking about
which it would be reasonable to conclude its purpose is to encourage participation in a
commercial activity. Examples include electronic messages that offer to purchase, sell,
barter or lease products, goods, services, land or an interest or right in land; offers to
provide a business, investment or gaming opportunity; advertises or promotes anything
previously mentioned.
✔✔Common Law - ✔✔Unwritten legal principles that have developed over time based
on social customs and expectations.
✔✔Communications Privacy - ✔✔One of the four classes of privacy, along with
information privacy, bodily privacy and territorial privacy. It encompasses protection of
the means of correspondence, including postal mail, telephone conversations,
electronic email, and other forms of communicative behavior and apparatus.
✔✔Comprehensive Laws - ✔✔Laws that govern the collection, use and dissemination
of personal information in the public and private sectors.
*associated term(s): Omnibus Laws
✔✔Computer Forensics - ✔✔The discipline of assessing and examining an information
system for relevant clues even after it has been compromised by an exploit.
✔✔Confidentiality - ✔✔Data is "confidential" if it is protected against unauthorized or
unlawful processing. The General Data Protection Regulation requires that an
organization be able to ensure the ongoing confidentiality, integrity, availability and
resilience of processing systems and services as part of its requirements for appropriate
security. In addition, the GDPR requires that persons authorized to process the
personal data have committed themselves to confidentiality or are under an appropriate
statutory obligation of confidentiality.
✔✔Confirmed Opt-In (Double Opt-In) - ✔✔An email approach where marketers send a
confirmation email requiring a response from the subscriber before the subscriber
receives the actual marketing email.
✔✔Consent - ✔✔This privacy requirement is one of the fair information practices.
Individuals must be able to prevent the collection of their personal data, unless the
disclosure is required by law. If an individual has choice about the use of disclosure of
