CIPM STUDY GUIDE QUESTIONS WITH
100% CORRECT ANSWERS
What date is Data Privacy Day? - Answer-January 28
Data subjects: - Answer-Identified or identifiable individuals whose personal information
is being processed by an organization. Preparing to respond and effectively responding
to data subject requests is a critical component of any privacy program.
Transparency with Privacy Notices: - Answer-A privacy notice is an external statement
directed to current or potential customers or users. Provided when an organization
collects information from a data subject, it is a tool used to describe the organization's
privacy practices.
A privacy notice can help an organization comply with applicable laws, but it does not
provide blanket protection from privacy-related litigation. A privacy notice should be
considered a promise the organization makes to data subjects. If the organization
breaks those promises, it may face regulatory action or litigation.
Section 5 of the Federal Trade Commission Act: - Answer-Prohibits unfair and
deceptive trade practices and allows the U.S. FTC to investigate and bring enforcement
actions against companies engaging in unfair and deceptive trade practices. Similarly,
most states have consumer protection laws that provide state attorneys general (AGs)
with the authority to address unfair and deceptive business practices. In the U.S., the
FTC and AGs have routinely used this power to investigate whether companies act
contrary to the statements made in their privacy notices.
Guidelines for common incident response planning expectations by function (2 of 2): -
Answer-PR - Plan strategic and tactical communication to inform and influence
Union leadership - Represent union interests
Finance - Calculate and manage the bottom-line impact of containment and correction
President/CEO - Demonstrate value of preventing breaches through actions
Customer care - Offer insight on customer/caller behavior
To help operations run smoothly in a time of crisis, such as during an incident response,
many companies depend on a: - Answer-Business Continuity Plan (BCP). The plan is
typically drafted and maintained by key stakeholders and spells out departmental
responsibilities and actions teams must take before, during, and after an event. To
ensure proper execution of the BCP, all planning and response teams should know
which stakeholder is responsible for overseeing the plan and who, within a specific job
function, will lead them during an event.
,Your organization's privacy notice will typically provide the following information: -
Answer-Who your organization is and your organization's contact information
What information is collected, directly or indirectly
How your organization will use the information
With whom your organization will share the information
How the behavior of website users is monitored
How data subjects may exercise their rights
A layered approach to privacy notices provides a high-level summary of the various
sections of the privacy notice and allows the users to read more about that section by
clicking a link to that section or scrolling below. Such an approach has been endorsed
by: - Answer-Both the FTC and the EU's Article 29 Working Party (WP29), now the
European Data Protection Board (EDPB)
Just-in-time notice: - Answer-A type of layered approach provided immediately before
the data is collected - for instance, when a mobile application asks to track your
location. More information is typically available by clicking a link or hovering over the
notice.
In the U.S., consent may be affirmative (i.e., opt-in or implied), but express (i.e., not
implied) is now required in the EU. If relying on consent, it is important to keep a legally
admissible record that established what the individual consented to and establishes that
such individual agreed to the notice. [No Definition] - Answer-[No Definition]
Under the GDPR, electronic consent requires: - Answer-An affirmative act from the
individual establishing a freely given, specific, informed, and unambiguous indication of
the individual's agreement to the processing. A pre-ticked box is not sufficient to imply
consent; according to the WP29, a clear action, such as swiping a bar on a screen,
waving in front of a smart camera or turning a smartphone around may be sufficient.
There are two central concepts of choice: - Answer-Data subjects can either give their
consent to processing by opting in, or withhold or revoke such consent by opting out.
Compliance with COPPA: - Answer-Prior to collecting personal information online
(including via mobile applications) from a child under 13, organizations must obtain
verifiable parental consent from a parent or legal guardian of the child. The law provides
parents with the right of access, modification, and deletion of their child's personal
information. COPPA also provides parents with an opportunity to prevent and limited
further collection and use of their child's personal information.
Age threshold in other jurisdictions: - Answer-GDPR - 16 years old, but allows individual
countries to set the age threshold between 13 and 16 years old.
CCPA - requires organizations to obtain parental or legal guardian consent for children
under the age of 13 years old and the affirmative consent of children between 13 and 16
years of age prior to engaging in data selling.
,Data subject rights under the Federal Credit Reporting Act (FCRA): - Answer-
Customers can obtain access to all the information a consumer reporting agency has on
file about them. Such information is usually complied into a credit report and must be
provided to consumers free of charge once a year.
Consumers can correct or delete any incorrect information that may be contained in
their files by notifying the credit reporting agency. If inaccurate information is discovered
in the consumer file, the credit reporting agency must examine the disputed information,
usually within 30 days of notification.
Consumers have the right to request removal of outdated negative information such as
civil suits, judgments, and liens from their consumer reports 7 years after the statute of
limitations has expired, while bankruptcies may be removed from credit reports after 10
years.
Consumers have several notification rights under FCRA, including the right to be
notified of adverse actions taken against them based on information contained in their
credit reports. If a financial institution submits or plans to submit negative information to
a credit reporting agency, the financial institution must provide a notice to the consumer
prior to furnishing such negative information.
FCRA obligations on employers: - Answer-FCRA places obligations upon employers to
obtain an applicant or employee's written consent prior to conducting a background
check. Additionally, FCRA requires employers to inform the applicant or employee that
the information obtained in the background check may be used to make the decision
about their employment. This information must be provided in a standalone written
notice separate from an employment application.
Data subject rights under the Health Insurance Portability and Accountability Act of
1996 (HIPAA): - Answer-Individuals have the right to obtain a copy of their medical
record and other health information. Usually, a copy of this information must be
provided within 30 days. An individual has the right to change any incorrect information
and add any information that may be missing or incomplete. In most cases, these
changes must be implemented within 60 days. Similarly, an individual has the right
know how their information has been shared with others and to limit information that an
individual may not want to be shared.
Data subject rights under the FTC-created National Do Not Call (DNC) Registry as a
part of revisions to its Telemarking Sales Rule (TSR):
Note: the FCC also enforces the DNC Registry and adopted its own do-not-call rule,
effectively plugging gaps in the FTC's jurisdiction and applying the registry to all
telemarketing of goods or services. - Answer-Consumers may file a complaint with the
FCC if they believe they have received an illegal call or text.
Consumers can sign up without charge for the DNC Registry in order to stop unwanted
commercial solicitation calls. The FTC enforces the DNC Registry by taking legal action
against companies and telemarketers who violate the applicable laws and rules.
, Data subject rights under the FTC'S Controlling the Assault of Non-Solicited
Pornography and Marketing Act (CAN-SPAM): - Answer-The FTC allows individuals to
forward unwanted or deceptive messages to the FTC in order to report and in effect
reduce the number of spam emails.
An individual may also file a complaint with the FTC regarding a company's unsolicited
emails and/or its refusal to honor a request to unsubscribe from the mailing list.
Data subject rights under the Privacy Act of 1974: - Answer-The Privacy Act of 1974
provides individuals with a right of access to their own records from each federal agency
that maintains a system of records, upon receipt of a written request from an individual.
The law also permits an individual to request an amendment of his or her records and to
challenge the accuracy of information that an agency has on file. Information collected
for one purpose may not be used for a different purpose. Lastly, individuals may bring
civil actions against agencies for violations of the act.
Freedom of Information Act (FOIA): - Answer-Under FOIA, federal agencies are
required to disclose any federal agency records or information upon request by the
public, unless the request falls under one of the nine exemptions and three exclusions
that protect national security interests, personal privacy, and law enforcement interests,
for example.
The nine exemptions to information that may be requested under FOIA: - Answer-1.
Information that is classified to protect national security
2. Information related solely to the internal personnel rules and practices of an agency
3. Information that is prohibited from disclosure by another federal law
4. Trade secrets or commercial or financial information that is confidential or privileged
5. Privileged communications within or between agencies
6. Information that, if disclosed, would invade another individual's personal privacy
7. Information compiled for various law enforcement purposes
8. Information that concerns the supervision of financial institutions
9. Geological information on wells
Congress has provided special protection for information requests for three categories
of law enforcement and national security records: - Answer-1. Protects the existence of
an ongoing criminal law enforcement investigation when the subject of the investigation
is unaware that it is pending and disclosure could reasonably be expected to interfere
with enforcement proceedings
2. Limited to criminal enforcement agencies and protects the existence of informant
records when the informant's status has not been officially confirmed
3. Limited to the FBI and protects the existence of foreign intelligence or
counterintelligence, or international terrorism records when the existence of such
records is classified
California Online Privacy Protection Act (CalOPPA): - Answer-The law applies to any
website or online service operator in the U.S. and possibly the world whose website
collects personally identifiable information (PII) from California consumers. The law
100% CORRECT ANSWERS
What date is Data Privacy Day? - Answer-January 28
Data subjects: - Answer-Identified or identifiable individuals whose personal information
is being processed by an organization. Preparing to respond and effectively responding
to data subject requests is a critical component of any privacy program.
Transparency with Privacy Notices: - Answer-A privacy notice is an external statement
directed to current or potential customers or users. Provided when an organization
collects information from a data subject, it is a tool used to describe the organization's
privacy practices.
A privacy notice can help an organization comply with applicable laws, but it does not
provide blanket protection from privacy-related litigation. A privacy notice should be
considered a promise the organization makes to data subjects. If the organization
breaks those promises, it may face regulatory action or litigation.
Section 5 of the Federal Trade Commission Act: - Answer-Prohibits unfair and
deceptive trade practices and allows the U.S. FTC to investigate and bring enforcement
actions against companies engaging in unfair and deceptive trade practices. Similarly,
most states have consumer protection laws that provide state attorneys general (AGs)
with the authority to address unfair and deceptive business practices. In the U.S., the
FTC and AGs have routinely used this power to investigate whether companies act
contrary to the statements made in their privacy notices.
Guidelines for common incident response planning expectations by function (2 of 2): -
Answer-PR - Plan strategic and tactical communication to inform and influence
Union leadership - Represent union interests
Finance - Calculate and manage the bottom-line impact of containment and correction
President/CEO - Demonstrate value of preventing breaches through actions
Customer care - Offer insight on customer/caller behavior
To help operations run smoothly in a time of crisis, such as during an incident response,
many companies depend on a: - Answer-Business Continuity Plan (BCP). The plan is
typically drafted and maintained by key stakeholders and spells out departmental
responsibilities and actions teams must take before, during, and after an event. To
ensure proper execution of the BCP, all planning and response teams should know
which stakeholder is responsible for overseeing the plan and who, within a specific job
function, will lead them during an event.
,Your organization's privacy notice will typically provide the following information: -
Answer-Who your organization is and your organization's contact information
What information is collected, directly or indirectly
How your organization will use the information
With whom your organization will share the information
How the behavior of website users is monitored
How data subjects may exercise their rights
A layered approach to privacy notices provides a high-level summary of the various
sections of the privacy notice and allows the users to read more about that section by
clicking a link to that section or scrolling below. Such an approach has been endorsed
by: - Answer-Both the FTC and the EU's Article 29 Working Party (WP29), now the
European Data Protection Board (EDPB)
Just-in-time notice: - Answer-A type of layered approach provided immediately before
the data is collected - for instance, when a mobile application asks to track your
location. More information is typically available by clicking a link or hovering over the
notice.
In the U.S., consent may be affirmative (i.e., opt-in or implied), but express (i.e., not
implied) is now required in the EU. If relying on consent, it is important to keep a legally
admissible record that established what the individual consented to and establishes that
such individual agreed to the notice. [No Definition] - Answer-[No Definition]
Under the GDPR, electronic consent requires: - Answer-An affirmative act from the
individual establishing a freely given, specific, informed, and unambiguous indication of
the individual's agreement to the processing. A pre-ticked box is not sufficient to imply
consent; according to the WP29, a clear action, such as swiping a bar on a screen,
waving in front of a smart camera or turning a smartphone around may be sufficient.
There are two central concepts of choice: - Answer-Data subjects can either give their
consent to processing by opting in, or withhold or revoke such consent by opting out.
Compliance with COPPA: - Answer-Prior to collecting personal information online
(including via mobile applications) from a child under 13, organizations must obtain
verifiable parental consent from a parent or legal guardian of the child. The law provides
parents with the right of access, modification, and deletion of their child's personal
information. COPPA also provides parents with an opportunity to prevent and limited
further collection and use of their child's personal information.
Age threshold in other jurisdictions: - Answer-GDPR - 16 years old, but allows individual
countries to set the age threshold between 13 and 16 years old.
CCPA - requires organizations to obtain parental or legal guardian consent for children
under the age of 13 years old and the affirmative consent of children between 13 and 16
years of age prior to engaging in data selling.
,Data subject rights under the Federal Credit Reporting Act (FCRA): - Answer-
Customers can obtain access to all the information a consumer reporting agency has on
file about them. Such information is usually complied into a credit report and must be
provided to consumers free of charge once a year.
Consumers can correct or delete any incorrect information that may be contained in
their files by notifying the credit reporting agency. If inaccurate information is discovered
in the consumer file, the credit reporting agency must examine the disputed information,
usually within 30 days of notification.
Consumers have the right to request removal of outdated negative information such as
civil suits, judgments, and liens from their consumer reports 7 years after the statute of
limitations has expired, while bankruptcies may be removed from credit reports after 10
years.
Consumers have several notification rights under FCRA, including the right to be
notified of adverse actions taken against them based on information contained in their
credit reports. If a financial institution submits or plans to submit negative information to
a credit reporting agency, the financial institution must provide a notice to the consumer
prior to furnishing such negative information.
FCRA obligations on employers: - Answer-FCRA places obligations upon employers to
obtain an applicant or employee's written consent prior to conducting a background
check. Additionally, FCRA requires employers to inform the applicant or employee that
the information obtained in the background check may be used to make the decision
about their employment. This information must be provided in a standalone written
notice separate from an employment application.
Data subject rights under the Health Insurance Portability and Accountability Act of
1996 (HIPAA): - Answer-Individuals have the right to obtain a copy of their medical
record and other health information. Usually, a copy of this information must be
provided within 30 days. An individual has the right to change any incorrect information
and add any information that may be missing or incomplete. In most cases, these
changes must be implemented within 60 days. Similarly, an individual has the right
know how their information has been shared with others and to limit information that an
individual may not want to be shared.
Data subject rights under the FTC-created National Do Not Call (DNC) Registry as a
part of revisions to its Telemarking Sales Rule (TSR):
Note: the FCC also enforces the DNC Registry and adopted its own do-not-call rule,
effectively plugging gaps in the FTC's jurisdiction and applying the registry to all
telemarketing of goods or services. - Answer-Consumers may file a complaint with the
FCC if they believe they have received an illegal call or text.
Consumers can sign up without charge for the DNC Registry in order to stop unwanted
commercial solicitation calls. The FTC enforces the DNC Registry by taking legal action
against companies and telemarketers who violate the applicable laws and rules.
, Data subject rights under the FTC'S Controlling the Assault of Non-Solicited
Pornography and Marketing Act (CAN-SPAM): - Answer-The FTC allows individuals to
forward unwanted or deceptive messages to the FTC in order to report and in effect
reduce the number of spam emails.
An individual may also file a complaint with the FTC regarding a company's unsolicited
emails and/or its refusal to honor a request to unsubscribe from the mailing list.
Data subject rights under the Privacy Act of 1974: - Answer-The Privacy Act of 1974
provides individuals with a right of access to their own records from each federal agency
that maintains a system of records, upon receipt of a written request from an individual.
The law also permits an individual to request an amendment of his or her records and to
challenge the accuracy of information that an agency has on file. Information collected
for one purpose may not be used for a different purpose. Lastly, individuals may bring
civil actions against agencies for violations of the act.
Freedom of Information Act (FOIA): - Answer-Under FOIA, federal agencies are
required to disclose any federal agency records or information upon request by the
public, unless the request falls under one of the nine exemptions and three exclusions
that protect national security interests, personal privacy, and law enforcement interests,
for example.
The nine exemptions to information that may be requested under FOIA: - Answer-1.
Information that is classified to protect national security
2. Information related solely to the internal personnel rules and practices of an agency
3. Information that is prohibited from disclosure by another federal law
4. Trade secrets or commercial or financial information that is confidential or privileged
5. Privileged communications within or between agencies
6. Information that, if disclosed, would invade another individual's personal privacy
7. Information compiled for various law enforcement purposes
8. Information that concerns the supervision of financial institutions
9. Geological information on wells
Congress has provided special protection for information requests for three categories
of law enforcement and national security records: - Answer-1. Protects the existence of
an ongoing criminal law enforcement investigation when the subject of the investigation
is unaware that it is pending and disclosure could reasonably be expected to interfere
with enforcement proceedings
2. Limited to criminal enforcement agencies and protects the existence of informant
records when the informant's status has not been officially confirmed
3. Limited to the FBI and protects the existence of foreign intelligence or
counterintelligence, or international terrorism records when the existence of such
records is classified
California Online Privacy Protection Act (CalOPPA): - Answer-The law applies to any
website or online service operator in the U.S. and possibly the world whose website
collects personally identifiable information (PII) from California consumers. The law
