CIPP/US CHAPTER on 4 Information
management principles Practice Study Guide
Questions with Distinction level Marking
scheme version 2024/2025
Data Subject - correct answer the individual about whom
information is being processed, such as the patient at a medical
facility, the employee of a company or the customer of a retail
store.
Data Controller - correct answer organization w/authority to
decide how/why PI is to be processed
Data Processor - correct answer An individual or
organization, often a third-party outsourcing service, that
processes data on behalf of the data controller.
Comprehensive Model - correct answer A method of data
protection to govern the collection, use and dissemination of
personal information in the public and private sectors, generally
with an official or agency responsible for overseeing
enforcement.
Reasons to adopt:
* remedy past injustices
* ensure consistency w/European privacy laws
* promote electronic commerce
, Sectoral Model - correct answer This framework protects
personal information by enacting laws that address a particular
industry sector.
Co-regulatory model - correct answer Used in Australia and
New Zealand, this model emphasizes industry development of
enforceable codes or standards for privacy and data protection,
against the backdrop of legal requirements by the government.
Example: COPPA
self-regulatory model - correct answer emphasizes creation of
codes of practices by company, industry, or independent body
Example: Payment Card Data Security Standard (PCI DSS)
3 Categories of People - correct answer Privacy
Fundamentalists (Strong Desire to Protect Privacy)
Privacy Unconcerned (Low Worries about Privacy)
Privacy Pragmatists (Varies with Context. Give up for Benefits)
Personal Information - 4 Risks - correct answer 1) Legal -
Compliance with Laws, Contracts & Industry Standards
2) Reputational
3) Operational (Administratively Efficient)
management principles Practice Study Guide
Questions with Distinction level Marking
scheme version 2024/2025
Data Subject - correct answer the individual about whom
information is being processed, such as the patient at a medical
facility, the employee of a company or the customer of a retail
store.
Data Controller - correct answer organization w/authority to
decide how/why PI is to be processed
Data Processor - correct answer An individual or
organization, often a third-party outsourcing service, that
processes data on behalf of the data controller.
Comprehensive Model - correct answer A method of data
protection to govern the collection, use and dissemination of
personal information in the public and private sectors, generally
with an official or agency responsible for overseeing
enforcement.
Reasons to adopt:
* remedy past injustices
* ensure consistency w/European privacy laws
* promote electronic commerce
, Sectoral Model - correct answer This framework protects
personal information by enacting laws that address a particular
industry sector.
Co-regulatory model - correct answer Used in Australia and
New Zealand, this model emphasizes industry development of
enforceable codes or standards for privacy and data protection,
against the backdrop of legal requirements by the government.
Example: COPPA
self-regulatory model - correct answer emphasizes creation of
codes of practices by company, industry, or independent body
Example: Payment Card Data Security Standard (PCI DSS)
3 Categories of People - correct answer Privacy
Fundamentalists (Strong Desire to Protect Privacy)
Privacy Unconcerned (Low Worries about Privacy)
Privacy Pragmatists (Varies with Context. Give up for Benefits)
Personal Information - 4 Risks - correct answer 1) Legal -
Compliance with Laws, Contracts & Industry Standards
2) Reputational
3) Operational (Administratively Efficient)
