CIPP Class Questions Flashcards
True or false? The word privacy is not mentioned in the U.S. Constitution
True
Which of the following sources of law affect privacy for private-sector employees? Select all that apply.
A. Federal constitutional law B. Contract law
C. Torts
D. Statutes
B. Contract law
C. Torts
D. Statutes
True or false?
Federal law mandates substance use testing for certain positions.
True
Read the scenario and determine if it qualifies as an exception or non-exception to FERPA’s non-consensual disclosure rules:
- School Instruction Improvement Company, Inc. accesses school records to verify the demographics of the student body.
Disclosure allowed: Disclosing information to organizations on the behalf of schools for test development, student aid programs or instruction improvement is acceptable.
What are the advantages and disadvantages of BYOD programs in the workplace?
Advantages:
• Same home/work technology
• More flexibility • Efficiency and productivity
• Employer increased accessibility to employee
- Disadvantages:
- Lack of employer control
- Exposure of organization to security vulnerabilities and threats
In addition to the Americans with Disabilities Act, which federal laws* prohibit discrimination in the workplace?
Title VII of the Civil Rights Act of 1964 bars discrimination in employment due to race, color, religion, sex and national origin
• The Equal Pay Act of 1963 bars wage disparity based on sex
• The Age Discrimination Act bars discrimination against individuals over 40
• The Discrimination Act bars discrimination due to pregnancy, childbirth and related medical conditions
• The Americans with Disabilities Act of 1990 bars discrimination against qualified individuals with disabilities
• The Genetic Information Nondiscrimination Act of 2008 bars discrimination based on individuals’ genetic information
• The Bankruptcy Act provision 11 U.S.C. § 525(b) prohibits employment discrimination against persons who have filed for bankruptcy
• Some ambiguity on whether the statute applies to discrimination prior to the extension of an offer of employment; courts have read the statute both ways
True or false?
Health insurance providers may, under some circumstances, implement higher premiums based on genetic information.
False
What is COIT?
Consumerization of information technology (COIT): Use of personal computing devices in the workplace and online services (webmail, cloud storage, social media)
Which act was passed as part of the ECPA to address interception of electronic communications in facilities where electronic communication service is provided?
A. Privacy Protection Act (PPA)
B. Stored Communications Act (SCA)
C. Communications Assistance to Law Enforcement Act (CALEA)
D. Electronic Communications Privacy Act (ECPA)
B. Stored Communications Act (SCA)
Which act requires giving a privacy notice to subscribers at the time of the initial agreement (and annually thereafter) including the nature of personal information collected, how it is used, and retention period, as well as how to access and correct information?
A. Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM)
B. Telecommunications Act
C. Cable Communications Policy Act
D. Video Privacy Protection Act (VPPA)
C. Cable Communications Policy Act
Which of the following terms specifically means removing or blocking information from court documents?
A. Protective order
B. Protecting publicly available information (PPAI)
C. Electronic discovery
D. Redaction
D. Redaction
Which of the following are required for an entity to be considered a “business” under the California Consumer Privacy Act? Select all that apply.
A. An entity that makes $10 million in annual revenue
B. An entity that holds the personal information of 50,000 people, households or devices
C. An entity that makes at least half of its revenue from the sale of personal information
B. An entity that holds the personal information of 50,000 people, households or devices
C. An entity that makes at least half of its revenue from the sale of personal information
Which are exceptions to state breach notification laws? Select all that apply.
A. Entities subject to other, more stringent data breach notification laws
B. Entities that already follow breach notification procedures that are compatible with state law
C. Entities enrolled in self-certification programs that meet industry security standards
A. Entities subject to other, more stringent data breach notification laws
B. Entities that already follow breach notification procedures that are compatible with state law
True or false?
Technology companies that provide free teaching materials are subject to the laws and regulations of FERPA, PPRA and NCLBA.
True
Is there an overarching employment privacy law in the U.S.?
EXAMPLE ANSWER: There is no overarching law for employment privacy.
- Some constitutional, federal, state, tort and statutory laws impact privacy
- Contracts between employer and employee may impact privacy agreements
- There is considerable local variation and complexity on employment privacy issues
- Many U.S. labor laws mandate employee data collection and management practices, such as conducting background checks and ensuring and documenting a safe workplace environment
- Organizations also have incentives to gather information about employees and monitor the workplace to reduce the risk of being sued for negligent hiring or supervision
Read the scenario and determine if it qualifies as an exception or non-exception to FERPA’s non-consensual disclosure rules:
- Anystate University is putting together a financial aid proposal for a student who applied to the school and reviews their records to determine if the student is eligible for an academic scholarship.
ANSWER: Disclosure allowed: As it’s in connection with financial aid for which the student has applied.
Which state data security law is generally considered the most prescriptive in the nation?
A. California AB 1950 (2004)
B. Massachusetts 201 CMR 17
C. Washington state security law, HB 1149
B. Massachusetts 201 CMR 17
Under the Fair Credit Reporting Act (FCRA), which are employer requirements for obtaining a consumer report on an applicant? Select all that apply.
A. Have a permissible purpose
B. Provide notification of the intention to run a consumer report
C. Allow the applicant to receive a copy of the report
D. Obtain written authorization from the applicant
E. Use a qualified credit reporting agency
F. Provide notice to the credit reporting agency outlining the intended purpose of the report
G. Provide the applicant with notice and a copy of the report for dispute prior to adverse action
A. Have a permissible purpose
B. Provide notification of the intention to run a consumer report
C. Allow the applicant to receive a copy of the report
D. Obtain written authorization from the applicant
E. Use a qualified credit reporting agency
G. Provide the applicant with notice and a copy of the report for dispute prior to adverse action
What are the four steps involved in the development of a privacy program?
A. Discover, build, communicate, evolve
B. Research, design, build, audit
C. Brainstorm, propose, implement, follow-through
D. Test, learn, revise, monitor
A. Discover, build, communicate, evolve
Which authorities oversee privacy-related issues in the U.S.? Select all that apply.
A. The Federal Trade Commission (FTC)
B. State attorneys general
C. The national data protection authority
D. Federal financial regulators
A. The Federal Trade Commission (FTC)
B. State attorneys general
D. Federal financial regulator
Under what circumstances do limitations and exceptions to the HIPAA Privacy Rule apply?
De-identification: Information does not identify an individual via:
1. Removing data elements listed in the rule (name, address)
- An expert certifying that the risk of re-identifying is small
- Research: Can occur with the consent of the individual or without consent if an authorized entity approves it
- Other: Public health activities, such as reporting abuse or neglect, judicial and administrative proceedings, specialized government functions
- Entity must release PHI to the individual to whom it pertains or their rep. and to the secretary of HHS
Which is a provision of the Cybersecurity Information Sharing Act (CISA)? Select all that apply.
A. Companies must remove personal information before sharing
B. Companies are protected from liability for monitoring activities
C. Companies that process the personal information of 100,000 individuals or more are required to participate
D. Sharing information with the federal government does not waive privileges
E. Shared information is exempt from federal and state Freedom of Information laws
A. Companies must remove personal information before sharing
B. Companies are protected from liability for monitoring activities
D. Sharing information with the federal government does not waive privileges
E. Shared information is exempt from federal and state Freedom of Information laws
Rules that govern the collection and handling of personal information regarding internet activity can be categorized as what type of privacy?
Information privacy
True or false?
Most U.S. states have laws limiting the use of Social Security numbers.
True
True or false?
When federal laws do not provide a consumer protection that a state believes is necessary, the state may enact a law to provide the protection for its citizens.
True
Which of the following federal laws ensures that employee benefits programs are created fairly and administered properly?
A. The Health Insurance Portability and Accountability Act (HIPAA)
B. The Consolidated Omnibus Budget Reconciliation Act (COBRA)
C. The Employee Retirement Income Security Act (ERISA)
D. The Family and Medical Leave Act (FMLA)
C. The Employee Retirement Income Security Act (ERISA)
What are the DPO’s responsibilities?
To monitor compliance with the GDPR • Advise controller and processors • Manage risk • Cooperate with supervisory authorities • Communicate with data subjects and supervisory authorities • Exercise professional secrecy
examples of business activities that would cause a U.S. organization to fall under the scope of the GDPR
U.S. company offers a consumer cloud service in the EU
- U.S. company expresses its intention to deal with EU users (e.g., offering services via a European domain, local currency payment, shipment to the EU, local telephone hotline numbers)
- “U.S. company (Company A, the processor) offers data hosting services to another U.S. company (Company B, the controller). At face value, this arrangement would not be caught by the GDPR. However, if Company B (the controller) also acts on behalf of other legal entities within a group, and if personal data is transferred from these group legal entities to Company A (the processor), the arrangement may be caught by the GDPR. If one such group legal entity has an establishment in the EU (see no. 2 above), the GDPR comes into play via Article 3, Section 1.”
- The processor is a sub-processor of a principal processor based in the EU
Which of the examples of personal information may qualify as sensitive personal information? Select all that apply.
A. Social Security number
B. Bank account number
C. Driver’s license number D. Home phone number
E. Professional membership F. Medical history
G. Business email address
A. Social Security number
B. Bank account number
C. Driver’s license number
F. Medical history
Which are provisions of the Fair Credit Reporting Act (FCRA)?
Select all that apply.
A. Consumers have the ability to access and correct their information
B. Consumers may request annual updates and alerts
C. Use of consumer reports is limited to “permissible purposes”
D. Use of consumer reports is limited to three instances per six months
A. Consumers have the ability to access and correct their information
C. Use of consumer reports is limited to “permissible purposes
True or false? An organization that does not process personal data that forms part of a filing system, nor processes personal data by automated means, but does process personal data in a place where member state law applies is subject to the GDPR.
False
you must respond to requests of information in connection with criminal investigations and litigation, which laws did you have to comply when responding to such requests .
EXAMPLE ANSWERS:
• Acts involving the access of financial data
- The Electronic Communications Privacy Act (ECPA)
- The Communications Assistance to Law Enforcement Act (CALEA)
How do the CCPA and GDPR different?
- Definitions of key terms and concepts (e.g., controller)
- No definition of sensitive data under the CCPA
- No private right of action—except for data breaches—under the CCPA
What is a pen register?
A. A list of consumers who have requested to be notified if their personal information is shared with law enforcement
B. A list of law enforcement personnel who may obtain sensitive personal information without a court order
C. Records kept by financial institutions on certain financial transactions
D. A device that records the telephone numbers of all outgoing calls
D. A device that records the telephone numbers of all outgoing calls
Which legislation provides rights to parents of minors regarding sensitive information from students via surveys?
A. Family Educational Rights and Privacy Act (FERPA)
B. Protection of Pupil Rights Amendment (PPRA)
C. Children’s Online Privacy Protection Act (COPPA)
B. Protection of Pupil Rights Amendment (PPRA)
Under the Right to Financial Privacy Act (RFPA), which of the following may allow a government authority access to customer financial records?
Select all that apply.
A. Appropriate formal written request from an authorized government authority
B. Appropriate administrative subpoena or summons
C. Qualified search warrant
D. Legitimate interest of an authorized government authority
E. Customer authorization
F. Appropriate judicial subpoena
A. Appropriate formal written request from an authorized government authority
B. Appropriate administrative subpoena or summons
C. Qualified search warrant
E. Customer authorization
F. Appropriate judicial subpoena
Which are requirements under HIPAA’s Privacy Rule? Select all that apply.
A. A detailed privacy notice provided at the date of first service delivered
B. Opt-out authorization for use or disclosure of personal health information outside of HIPAA guidelines
C. Limited use and disclosure of personal health information for business associates, such as billing companies
D. Safeguards in place to protect the confidentiality and integrity of all personal health information
A. A detailed privacy notice provided at the date of first service delivered
C. Limited use and disclosure of personal health information for business associates, such as billing companies
D. Safeguards in place to protect the confidentiality and integrity of all personal health information
From the standpoint of a privacy professional, how was the collection and storage of personal information impacted by the Snowden revelations?
The case study of Edward Snowden illustrates that further reforms were necessary.Snowden’s revelations led to reforms enacted via the USA FREEDOM Act.
What actions can an organization take to proactively protect personal information in the event it is required to turn over electronic data for litigation?
- Place limits on using company email for personal use
- Discourage conducting company business on personal devices
- Implement policies and practices for when an employee leaves the organization
What is a Data Protection Officer (DPO)?
A staff member or contractor tasked with ensuring and demonstrating compliance with EU data protection law; an expert in data protection law and practices.
True or false?
Materials submitted to courts during trials are usually publicly available
True
Which act was passed during the Cold War to enable national security to track the activities of agents of the Soviet Union and its foreign allies?
A. USA PATRIOT Act
B. Foreign Intelligence Surveillance Act (FISA)
C. Cybersecurity Information Sharing Act (CISA)
D. USA FREEDOM Act
B. Foreign Intelligence Surveillance Act (FISA)
Which of the following has provided standards and best practices for managing electronic discovery compliance through data retention policies?
A. “E-discovery” rules
B. The Hague Convention on the Taking of Evidence
C. The Sedona Conference
D. The GDPR
C. The Sedona Conference
What are the key privacy protections of HIPAA’s Privacy Rule?
The HIPAA Privacy Rule was developed in 2000, revised in 2002 and modified in 2013 to implement amendments under HITECH (discussed further in this module)
- • Covered entities must provide detailed privacy notice at the date of first service delivery
- Uses or disclosures outside of HIPAA’s guidelines require opt-in authorization
- Use and disclosure of PHI for situations other than treatment is limited
- Individuals have the right to access and copy their own PHI from a covered entity and to amend their PHI
True or false?
Data destruction requirements are often built into state data security laws
False
