Study Cards

Question 1

Privacy program management is the structured approach of

Answer 1

combining several projects into a framework and life cycle to protect PI and individuals’ rights.

Question 2

The privacy operational life cycle involves four phases:

Answer 2

assess, protect, sustain and respond.

Question 3

The assess phase involves comparing the program to

Answer 3

industry best practices, corporate privacy policies, applicable laws and regulations and the organization’s privacy framework.

Question 4

The protect phase embeds privacy principles and information security management practices to

Answer 4

address, define and establish privacy practices.

Question 5

The sustain phase provides

Answer 5

monitoring, auditing and communication aspects of the management framework.

Question 6

The respond phase involves the principles of

Answer 6

information requests, legal compliance, incident response planning and incident handling, as well as accountability for data collected.

Question 7

Privacy program managers and teams are responsible for

Answer 7

compliance, accountability and alignment with organizational strategy.

Question 8

Accountability is the most important aspect of privacy program management. Privacy program managers are accountable for

Answer 8

safekeeping and responsible use of personal information.

Question 9

While _ with applicable laws and regulations is a key motivator for having a privacy program, it is not the only purpose of a program.

Answer 9

compliance

Question 10

Other important reasons to institute a privacy program are

Answer 10

meeting expectations of business clients and partners, and safeguarding data against attacks and threats.

Question 11

A successful privacy program integrates __ into functional areas across the organization.

Answer 11

privacy requirements and representation

Question 12

Examples of organizational areas that typically have specific privacy concerns include:

Answer 12

HR, marketing and business development, finance, information security, IT, and legal and compliance functions.

Question 13

What business function is most likely responsible for determining which employees may access subscribers’ sensitive PI?

Answer 13

Information security

Question 14

Privacy governance refers to

Answer 14

components guiding a privacy function toward compliance with laws and regulations, and enabling them to support the organization’s broader business goals

Question 15

Privacy governance supports the organization’s broader business goals, which are:

Answer 15

• Creating a privacy vision and mission statement
• Defining program scope
• Selecting a privacy framework
• Developing a privacy strategy
• Structuring the privacy team

Question 16

There is no standard organizational structure for privacy across organizations. When determining where privacy will sit in the organization, you may wish to consider

Answer 16

which department has the most influence; has global scope; is the best-funded; best executes enterprise projects; and/or is the strongest supporter of privacy.

Question 17

While strategies provide the why (why privacy is important), privacy program frameworks provide the what (what form the program will take), in the form of

Answer 17

implementation roadmaps that guide teams and prompt for the details to determine privacy-relevant decisions for the organization.

Question 18

Common privacy program frameworks include principles and standards such as __, OECD guidelines, GAPP, CSA, the APEC Privacy Framework, ETSI, and ISO; laws, regulations and programs such as PIPEDA and APPs, __, HIPAA, CNIL, and BCRs; and privacy program management solutions such as __, NIST, and WebTrust.

Answer 18

FIPs; GDPR; PbD

Question 19

The privacy policy life cycle phases involve:

Answer 19

• Drafting inward-facing policies that are practical, simple and easy to understand
• Getting approval from decision-makers and stakeholders
• Disseminating and socializing policies to all employees
• Training employees and enforcing policies
• Reviewing and revising policies regularly

Question 20

The privacy governance models are

Answer 20

centralized, localized/decentralized, or hybrid (a combination of both).

Question 21

In the centralized model,

Answer 21

one team or person is responsible for privacy-related affairs.

Question 22

In the local/decentralized model, decision-making is delegated to

Answer 22

lower levels of the organization, allowing decisions and information to flow from bottom to top.

Question 23

The hybrid model combines the centralized and local models and is

Answer 23

most common when a large organization makes an individual or team responsible for privacy-related affairs for the rest of the organization.

Question 24

The DPO position is a professional role with many responsibilities. Examples of the skills a DPO needs include:

Answer 24

• Experience assessing risk and best practice mitigation
• Knowledge of relevant laws and regulations
• Interpersonal flexibility; effective communication with business functions
• Project management and ability to manage own professional development
• Ability to fulfill the role autonomously
• Ability to handle requests/complaints and train others to help data subjects
• Credibility/no conflicts of interest

Question 25

Getting buy-in for a privacy strategy may mean changing an organization’s mindset. Recommendations include __; __; and __

Answer 25

building relationships and finding advocates;
pitching privacy;
creating steering groups of stakeholders.

Question 26

Once your privacy program has been established, you must

Answer 26

create awareness of the program both internally and externally.

Question 27

Some organizations use a RACI matrix, a tool used to embed responsibilities and identify:

Answer 27

Who is Responsible
Who is Accountable
Who needs to be Consulted
Who needs to be Informed

Question 28

Key functional areas help create and enforce the privacy program on an ongoing basis. Examples of these areas include:

Answer 28

marketing, learning and development, communications, IT and procurement.

Question 29

Auditing and analyzing a governance structure’s performance is essential to its success. The __ and __ functions review and analyze operations across all departments and communicate their results.

Answer 29

internal audit (IA) and risk management

Question 30

__ typically reports to an audit committee, helping to ensure it remains unbiased.

Answer 30

Internal audit

Question 31

__ ensures business and regulatory requirements are met through detailed analysis.

Answer 31

Risk management

Question 32

Some organizations use __ to help achieve compliance. Solutions may relate to areas such as assessment management, data mapping, deidentification and incident response.

Answer 32

privacy tech vendors

Question 33

Privacy technology is experiencing rapid growth. Reasons for this include the emergence of
comprehensive data protection laws and privacy regulations along with strict requirements and significant fines for noncompliance under many privacy laws, such as the GDPR. Another factor is __

Answer 33

growing consumer awareness of data breaches and increasing demands that organizations protect their information.

Question 34

The chief privacy officer for a telecommunications company wants to revise its privacy mission statement. What steps would be involved in this process? Select all that apply.
1. Evaluating the intended objective
2. Acquiring knowledge on privacy approaches
3. Gaining executive sponsor approval
4. Communicating the organization’s privacy stance to all stakeholders
5. Monitoring compliance with the company’s privacy policies

Answer 34

All except 5

Question 35

In differentiating between a privacy strategy and a privacy framework, how can strategy be defined?
1. As the why
2. As the what

Answer 35

As the why

Question 36

True or false? A law or regulation may constitute a privacy framework.

Answer 36

True

Question 37

What type of privacy governance model is defined by a one-team or one-person approach?
Localized/decentralized
Centralized
Hybrid

Answer 37

Centralized

Question 38

True or false? The privacy team should always comprise more than one person.

Answer 38

False

Question 39

Which business function ensures business and regulatory requirements are met through detailed market, credit, trade and counterparty analysis?
Internal audit
Procurement
Learning and development
Risk management

Answer 39

Risk management

Question 40

What is the most important aspect of privacy program management?
Vendor management
Audits
Data mapping
Accountability

Answer 40

Accountability

Question 41

True or false? Regulatory compliance is often the primary motivation for organizations to develop a privacy program.

Answer 41

True

Question 42

A privacy program should integrate privacy requirements and representation into which of the following functional areas? Select all that apply.
Human resources
Marketing and business development
Finance
Information security
IT
Legal and compliance

Answer 42

All are correct

Question 43

Customer service employees for a health insurance company are granted access to subscribers’ sensitive PI to help with questions about coverage and billing. What business function is most likely responsible for determining which employees may access subscribers’ sensitive PI?
Human resources
IT
Information security
Legal

Answer 43

Information security

Question 44

Which of the following is NOT a phase of the privacy operational life cycle?
Sustain
Respond
Consider
Assess

Answer 44

Consider

Question 45

Under GDPR, data subjects can:

Answer 45

Withdraw consent
Request a copy of their personal data or have it deleted
“Freeze” processing of their personal data
Object to automated decision-making

Question 46

Under GDPR, organizations must:

Answer 46

Implement PbD and privacy by default
Provide notice to process personal data
Provide notification of breaches (sometimes)
Conduct DPIAs (sometimes)
Consult regulators before processing (sometimes)
Follow rules for processing children’s data
Ensure compliance of data transfers
Take responsibility for vendor processing
Maintain appropriate data security
Keep records and demonstrate compliance
Appoint a DPO

Question 47

Under GDPR, regulators may:

Answer 47

Ask for records of compliance (register of processing activities, DPIAs, documentation, risk-analysis)
Impose temporary data processing bans, & require data breach notification
Order erasure of personal data
Suspend international data flows
Enforce penalties up to €20 million or 4 percent total annual revenue

Question 48

Under LGPD, data subjects can:
Confirm the existence of processing
Access their data
Correct incomplete, inaccurate or out-of-date data
Anonymize, block or delete unnecessary or excessive data or data processing in violation of the law
Export data to another service or product provider

Answer 48

Delete personal data processed pursuant to consent
Obtain information about entities with which data is shared
Obtain information about denying consent
Review decisions made solely based on automated processing
Oppose non-consent-based processing when in violation of the law

Question 49

Under LGPD, organizations must:
Implement privacy-by-design and -default processes
Develop incident response and remediation plans
Maintain appropriate data security
Notify data subjects and regulators of data breaches
Follow special rules for directly processing children’s data
Provide notice of intention to process PI
Appoint a data protection officer (for controllers)

Answer 49

Take responsibility for processing activities of third-party vendors
Create personal data protection impact report (RIPD)
Ensure adequacy or appropriate safeguards for data transfers
Keep records (in most circumstances) and demonstrate compliance
Comply with international data transfer requirements

Question 50

Under LGPD, regulators may:

Answer 50

Ask for records of compliance
Apply sanctions, e.g., warnings and corrective measures, publicizing the infraction, suspension or prohibition of processing activities
Enforce penalties up to 2 percent of a company’s annual revenue in Brazil to a maximum of 50 million reais per infraction

Question 51

The privacy team needs to work with regulators to understand:

Answer 51

• Fines and penalties for noncompliance
• The scope and authority of regulators and oversight agencies
• Recent or upcoming changes in privacy law

Question 52

These changes affect privacy-related legal obligations:

Answer 52

New processes
Acquisitions
Outsourcing agreements
Divestitures
Discontinued products and services
New products and services

Question 53

Different regions’ laws may be similar to, or vastly different from, one another, so some organizations __

Answer 53

create a roadmap or crosswalk to determine where legal requirements overlap.

Question 54

Fair Information Practices (FIPs) appear in various forms and applications. The __
are perhaps the most widely recognized framework for FIPs, defining purpose specification,
openness, individual participation, collection limitation, use limitation, security safeguards, data quality and accountability

Answer 54

OECD Guidelines

Question 55

Under the California Consumer Privacy Act, consumers have:

Answer 55

• The right to know what PI a business collects about them and how it is used and shared;
• The right to delete PI collected from them (with some exceptions);
• The right to opt out of the sale of their PI; and
• The right to non-discrimination for exercising their rights under the CCPA.

Question 56

Under the CCPA, businesses must:

Answer 56

• Provide a CCPA-compliant privacy policy or certain notices to consumers per the CCPA/CPRA privacy policy requirements [compliant privacy notice]
• Provide disclosures to consumers, such as categories of PI collected, purpose for collection, description of consumers’ rights [disclose their rights and how categories of data are used]
• Provide methods for submitting requests to know and to delete, and have a process to verify the identity of consumers attempting to exercise their rights [way to know and delete, verify ID]
• Respond to consumer requests in a timely manner
• Provide two or more methods for submitting requests to opt out, including a clear and conspicuous “Do Not Sell My Personal Information” link on the website to make it easy for consumers to [opt out] of the sale of their PI

Question 57

The CPRA amends and expands upon the CCPA in several ways, including:

Answer 57

Requiring the establishment of an enforcement agency, the California Privacy Protection Agency
Can opt out of PI sales and sharing
Can correct inaccurate PI that a business has about them
The right to limit use and disclosure of sensitive PI.

Question 58

International data transfers can be complex because you need to

Answer 58

comply with relevant laws across jurisdictions, and there must be a legal basis for transferring the data.

Question 59

Several mechanisms allow organizations to transfer data internationally, including:

Answer 59

*adequacy decisions, *appropriate safeguards (standard contractual clauses, codes of conduct or self-certification mechanisms, ad hoc contractual clauses, international agreements and binding corporate rules); and *derogations.

Question 60

Which are common elements of privacy-related legislation across jurisdictions? Select all that apply.
Requirements for ensuring individual rights
Security obligations
Processor obligations
FIPs

Answer 60

All answers are correct except Processor obligations

Question 61

Privacy and data protection regulators have the right to impose penalties for
noncompliance, including fines.
True
False

Answer 61

True

Question 62

What can controllers and processors do to avoid incurring penalties from regulators for noncompliance with the GDPR? Select all that apply.
Know which regulators oversee which processing activities within the organization
Ensure regulators receive notification of data breaches under some circumstances
Know when legal obligations change due to changes in the organization
Conduct data protection impact assessments whenever personal data is being processed

Answer 62

All answers are correct except Conduct data protection impact assessments whenever personal data is being processed

Question 63

Using a valid mechanism for transferring PI internationally, such as binding corporate rules, allows for the legal processing of that data.
True
False

Answer 63

False

Question 64

Which international data transfer mechanism is used to demonstrate to regulators and consumers that a company adheres to certain information privacy standards?
Binding corporate rules
Standard contractual clauses
Adequacy decisions
Codes of conduct

Answer 64

Codes of conduct

Question 65

A general good practice is to adjust the privacy program to the most stringent legal requirements to which personal data processing is subject.
True
False

Answer 65

True

Question 66

A __ is a complete record of all the PI your organization stores, uses and processes.

Answer 66

data inventory, or data map

Question 67

_ can be used as a precursor to regulatory compliance and risk analysis; to assess data, systems and processes; and to inform data assessments, priorities, data life cycle management and data classification.

Answer 67

Data inventories
It should demonstrate data flows and classification, create a record of the authority of systems processing personal information and analyze data types/uses

Question 68

To create a comprehensive inventory of all PI being processed, an organization should determine

Answer 68

who creates the data inventory, which departments hold/use PI, and what questions should be asked.

Question 69

__ may be organized around the data life cycle, considering the collection, usage, storage, archiving and destruction of PI.

Answer 69

Intake questions

Question 70

Conducting a __ helps determine what compliance efforts are in place, areas that need improvement, and where additional controls must be developed.

Answer 70

gap analysis
It involves identifying gaps between standards and laws an organization is subject to and the organization’s current compliance efforts. Many laws overlap, so be sure to involve your Legal team in the process.

Question 71

A __ measures an organization’s compliance with laws, regulations, adopted standards and internal policies/procedures. It may involve the use of subjective standards (such as employee interviews) and/or objective standards (such as information system logs).

Answer 71

privacy assessment

Question 72

A __ is an analysis that assesses privacy risks associated with processing PI in relation to a project, product or service. Requirements around them may be mandated by industry, organizational policy, and laws and regulations.

Answer 72

privacy impact assessment

Question 73

Triggers for conducting a __ include preparing for the deployment of a project, product or service that involves the collection of PI; new or revised industry standards, organizational policies, or laws and regulations; and organizational changes to methods in which PI is handled.

Answer 73

PIA

Question 74

A __ has specific triggers and requirements under the GDPR and LGPD. They are intended to help incorporate privacy considerations into organizational planning and demonstrate GDPR compliance

Answer 74

data protection privacy impact assessment, DPIA

Question 75

Triggers for conducting __ include processing that is “likely to result in a high risk to the rights and freedoms of natural persons” (GDPR Article 35) and the use of new technologies

Answer 75

DPIAs

Question 76

DPIAs should include:

Answer 76

a description of the processing, including its purpose, and including, where applicable, the legitimate interest being pursued;
the necessity of the processing, its proportionality and the risks that it poses to data subjects;
and measures to address the risks identified.

Question 77

__ is a self-assessment tool for ensuring functions outside the privacy team are held accountable for privacy-related responsibilities. Once the privacy responsibilities of each department are documented, the departments may be asked specific questions about each responsibility

Answer 77

Attestation

Question 78

Mergers, acquisitions and divestitures should include a privacy checkpoint that evaluates:

Answer 78

new compliance requirements;
existing client agreements;
new resources, technologies and processes;
and applicable laws and standards.

Question 79

Vendor assessment is the evaluation of a vendor for

Answer 79

privacy and information security policies,
access controls,
where the personal information will be held,
and who has access to it

Question 80

These and other checklists can be used to
assess vendor risk

Answer 80

Privacy or security questionnaires, and privacy impact assessments

Question 81

Any technology that is new to an organization, even those that are ubiquitous elsewhere, requires

Answer 81

an assessment

Question 82

Assessing cloud computing vendors before procuring them can be challenging. Specific areas to focus on during a selection assessment of a cloud service provider include

Answer 82

certifications and standards, technologies, service road map, data management, information security, subcontractors and service dependencies, and data policies and protection.

Question 83

Which of the following is a common function of a data inventory? Select all that apply.
Assesses data, systems and processes
Informs data assessments
Informs data classification
Measures compliance with laws, regulations, standards and internal policies

Answer 83

All answers are correct except Measures compliance with laws, regulations, standards and internal policies

Question 84

Which of the following elements may be found in a data inventory? Select all that apply.
Data flows
Classification of data
Record of authority of organizational systems
Types and uses of data

Answer 84

All are correct

Question 85

Data inventories are almost always created and maintained by the legal function within an organization.
True
False

Answer 85

False

Question 86

Which of the following is a potential tool for keeping a data inventory up to date? Select all that apply.
A privacy impact assessment
GRC software
Spreadsheets and manual processes
An internally developed system

Answer 86

All answers are correct except A privacy impact assessment

Question 87

Which of the following is an assessment that measures how closely an organization’s practices align with its legal obligations and stated practices?
Privacy assessment
Privacy impact assessment
Data protection impact assessment
Physical assessment

Answer 87

Privacy assessment

Question 88

A privacy impact assessment can help facilitate privacy by design.
True
False

Answer 88

True

Question 89

Ideally, when should a PIA be conducted? Select all that apply
Prior to deployment of a project, product or service that involves the collection of PI
Directly following the deployment of a project, product or service to ensure that privacy considerations have been addressed
When there are new or revised industry standards, organizational policies, or laws and regulations
When the organization makes changes to methods in which PI is handled that create new privacy risks

Answer 89

All answers are correct except Directly following the deployment of a project, product or service to
ensure that privacy considerations have been addressed.

Question 90

Which of the following are methods for assessing vendors? Select all that apply.
Privacy and security questionnaires
Privacy impact assessments
Checklists
Audits

Answer 90

All answers are correct except Audits.

Question 91

__’s main focus is the control of information, while __ focuses on the information itself and the people represented by the information.

Answer 91

security; privacy

Question 92

Information security builds on __ to identify risk, take measures to mitigate risk, and track and evaluate risk.

Answer 92

risk management practices

Question 93

The existence of __ does not mean that data is not secure

Answer 93

risk

Question 94

Information security provides different kinds of controls to manage risk. Controls can be

Answer 94

administrative, physical or technical controls.

Question 95

Controls are also divided into different categories based on their objective: __ controls to prevent an incident from occurring; __ controls to identify and characterize an incident that has occurred or is in progress; and __ controls to limit the extent of any damage caused by
an incident.

Answer 95

preventive; detective; corrective

Question 96

ISO/IEC 27701 is considered the first mainstream global privacy management standard. It defines processes and

Answer 96

provides guidance for protecting PI on an ongoing basis
and specifies the requirements for establishing, implementing, maintaining and improving a privacy-specific information security management system.

Question 97

__ are non-technical privacy control measures established by management (for example, policies and procedures). They may derive from laws and regulations, self-regulatory regimes, industry practices, and corporate ethics and policies. Policies dictate them, which, in turn, establish what mechanism or process must be implemented to ensure the control is enabled.

Answer 97

Administrative controls

Question 98

__ govern who has the right to access specific information and may involve approaches from administrative, physical and technical control categories.

Answer 98

Access controls

Question 99

__ for managing user access can help ensure that only those who absolutely need access to certain information have it. These controls rely on basic security principles like need-to-know or -access and segregation of duties. They also involve __ management, which uses strategies such as unique user IDs and password management

Answer 99

Role-based controls and guidelines; user access

Question 100

__ offer ways to protect personal information. Examples are obfuscation, data minimization, common security practices and privacy-enhancing technologies.

Answer 100

Technical privacy controls

Question 101

__ embeds privacy into the design of technology, systems and practices to help ensure the existence of privacy from the outset.

Answer 101

Privacy by design (PbD)

Question 102

Privacy by design is based on seven foundational principles:
1. Proactive, not reactive; preventative, not remedial
2. Privacy as the default
3. Privacy embedded into design

Answer 102

4. Full functionality—positive-sum, not zero-sum
5. End-to-end security—life cycle protection
6. Visibility and transparency
7. Respect for user privacy

Question 103

__ is called out in __, with requirements and consequences for noncompliance. Its goal is to build information privacy into the design process and protect privacy by default.

Answer 103

Data protection by design and default; GDPR

Question 104

Several __ can be used individually or in combination to analyze risk. Models include
compliance;
Fair Information Practice Principles (FIPPs)-based;
and Factor Analysis of Information Risk (FAIR).

Answer 104

privacy risk models and frameworks

Question 105

__ include Risk Management Framework; Cybersecurity Framework; Privacy Framework; and NICE Framework.

Answer 105

NIST (National Institute of Standards and Technology) frameworks, at the Department of Commerce

Question 106

Two major groups of privacy design strategies for applying PbD are __ and __.
[1] strategies are based on an organization’s commitment to processing PI in a privacy-friendly way;
[2] strategies focus on technical ways to process data that maximize privacy.

Answer 106

process-oriented and data-oriented

Question 107

Security focuses on information and the people represented by that information.
True
False

Answer 107

False

Question 108

Which of the following is an example of a process-oriented privacy design strategy?
Demonstrating compliance with policies and processes
Separating the processing of data, either logically or physically
Abstracting data to limit the amount of detail in the data
Hiding data in ways that make it unconnectable or unobservable to others

Answer 108

Demonstrating compliance with policies and processes

Question 109

What type of security control may rely on segregation of duties?
Cryptography
Physical and environmental security
Access control
Systems acquisition, development and maintenance

Answer 109

Access control

Question 110

A scorecard of risk factors may assist an organization in doing what?
Evaluating security controls
Writing information security policies
Identifying risk
Determining the business purpose for processing personal information

Answer 110

Evaluating security controls

Question 111

A key difference between the U.S. and EU concepts of invasion of privacy is based on whether the invasion caused actual harm to the individual.
True
False

Answer 111

True

Question 112

Which of the following is an administrative control?
Responding to data subject access requests within one week of reception
Automatically aggregating personal information to render it anonymous
Using a vendor to encrypt outgoing email messages
Using a platform to mask sensitive information from users who do not need it

Answer 112

Responding to data subject access requests within one week of reception

Question 113

Data processing principles, such as those found in the GDPR, may be used to successfully implement privacy by design.
True
False

Answer 113

True

Question 114

A __ is an external communication made to an individual, customer or data subject that
describes how the organization collects, uses, shares, retains and discloses their PI.
In contrast, a __ is generally an internal document that is addressed to employees, stating how PI is going to be handled.

Answer 114

privacy notice; privacy policy

Question 115

An organization’s privacy policy should be:

Answer 115

clear and easy to understand, accessible to all employees, comprehensive yet concise, action-oriented, and measurable and testable.

Question 116

Common types of __ include those for acceptable use, information security, procurement, HR, and data retention and destruction.

Answer 116

privacy policies

Question 117

Common goals of internal information security policies include

Answer 117

protecting against unauthorized access;
providing stakeholders with information efficiently, while maintaining confidentiality, integrity and availability;
promoting compliance with laws, regulations, standards and other organizational policies;
promoting data quality.

Question 118

Vendors should be held to the same privacy standards as the organization they serve. When engaging vendors, remember to:

Answer 118

create a policy that outlines selection and logistics; identify vendors and their legal obligations; evaluate risk, policies and server locations; develop a thorough contract; and monitor vendors’ practices and performance

Question 119

Vendors that provide cloud computing services may pose distinct privacy challenges. Therefore, a cloud computing acceptable use policy should:

Answer 119

maintain compliance; require that agreements be approved by leadership; maintain data privacy and security; and mitigate risks of using cloud-based services

Question 120

HR handles diverse employee personal information and typically has policies to guide processing.
Concerns can be addressed through several types of HR policies, including those related to

Answer 120

communications, hiring and reviews, and financial information.

Question 121

__ should support the idea that PI should only be retained for as long as necessary to perform its stated purpose. Triggers and methods should be documented and followed consistently, and align with laws, regulations and standards.

Answer 121

Data retention and destruction policies

Question 122

Approaches for enabling employees to integrate privacy policies into daily tasks include:

Answer 122

aligning policies with existing business procedures such as HR functions, procurement and contract management, and risk management;
training employees using tools like classes or simulations;
and raising awareness through activities like Data Privacy Day and lunch-and-learn sessions.

Question 123

Once you have created and launched privacy-related policies, __.

Answer 123

ensure they are regularly audited and enforced.
Policies should be testable and evidence should be readily available. Enforcement should include clear and consistent consequences. Consider whether an independent internal auditor may aid your organization’s ongoing auditing process.

Question 124

A marketing team works with their legal department to create an external communication to customers that describes how their personal information is going to be handled. What is this communication?
A privacy notice
A privacy policy
An information security policy
A data retention and destruction policy

Answer 124

A privacy notice

Question 125

How may an organization enable employees to integrate privacy policies into their daily tasks? Select all that apply.
Align policies with existing business procedures
Raise awareness
Train employees
Audit and enforce privacy policies

Answer 125

All responses are correct except Audit and enforce privacy policies

Question 126

What is the purpose of an acceptable use policy?
Providing instructions to employees, students, guests, etc. for easily accessing the organization’s network or internet connection
Stipulating rules and constraints for people within and outside the organization who access the network or internet connection
Evaluating risks associated with using vendors for processing personal information
Stipulating events that may trigger the necessary processing of personal information outside the organization’s originally stated purpose

Answer 126

Stipulating rules and constraints for people within and outside the organization who access the network or internet connection

Question 127

Which of the following are some of the common purposes of internal information security policies?
Select all that apply.
Protecting against unauthorized access
Providing stakeholders with information efficiently, while maintaining confidentiality, integrity and availability
Promoting data quality
Specifying detailed steps for HR hiring practices

Answer 127

All responses are correct except Specifying detailed steps for HR hiring practices

Question 128

Laws and regulations may include data retention requirements.
True
False

Answer 128

True

Question 129

A _ provides data that helps to answer specific questions about business operations.

Answer 129

metric

Question 130

An organization should develop generic _ _ to reflect data privacy compliance, datadriven decisions and the overall impact of the privacy program.

Answer 130

privacy metrics

Question 131

Metrics have primary, secondary, and tertiary audiences. Differences between the audiences are based on

Answer 131

interest level, influence, ownership and responsibility of privacy within the business objectives.

Question 132

Typical members of a _ audience include the legal and privacy officers, senior leadership, CIOs, CSOs, PMs, information system owners and CISOs.

Answer 132

primary

Question 133

_ audience members include the CFO, training organizations, HR, IGs and HIPAA security officials.

Answer 133

secondary

Question 134

The _ audience includes external watchdog groups, sponsors and stockholders.

Answer 134

tertiary

Question 135

A metric owner is responsible for managing the metric throughout its life cycle. Responsibilities include:

Answer 135

knowing what is critical about the metric and how it fits into business objectives
monitoring performance with the metric
updating process documentation (including the metric’s definition)
performing regular reviews
and incorporating improvements into the process.

Question 136

Four common ways to analyze privacy program metrics are:

Answer 136

trend analysis, return on investment (or ROI), business resiliency and program maturity.

Question 137

_ _ provides quantitative measurement for the costs, benefits, strengths and weaknesses of an organization’s privacy controls in order to maximize the benefits of investments that prevent loss.

Answer 137

ROI analysis

Question 138

Organizations can monitor privacy programs to track

Answer 138

compliance and risk,
organizational alignment with regulatory and legislative changes,
and vulnerabilities in the internal and external environments.

Question 139

Tracking compliance and risk involves reviewing the _ of personal information throughout its life cycle.

Answer 139

collection, use, and retention

Question 140

_ is often done using publications and/or external vendors.

Answer 140

Tracking regulatory and legislative changes

Question 141

Tracking environmental vulnerabilities involves

Answer 141

monitoring internal and external threats, including building access, data access and authentication, and lack of awareness or training

Question 142

Forms of privacy program performance monitoring include:

Answer 142

• Active scanning tools, such as data loss prevention (DLP) network
• Audit activities
• Breach monitoring, detection and notification
• Complaint monitoring
• Data retention/records management strategies
• Dashboards
• Control-based monitoring
• HR practices, such as hiring and termination;
• Monitoring data
• Monitoring building access/use
• Monitoring internal and external conditions
• Regulation-based monitoring

Question 143

Audit involves:

Answer 143

monitoring and measuring privacy practices to comply with laws, regulations, consent orders and industry practices.

Question 144

Audits should answer two questions:

Answer 144

1) Do the privacy operations do what they were designed to do? 2) Are data privacy controls correctly managed?

Question 145

Privacy program audits typically fall into one of three categories:

Answer 145

first party, second party or third party.

Question 146

First-party audits are performed by internal employees. They are self-assessments used to

Answer 146

evaluate risk management culture;
identify privacy risk factors;
and evaluate control design and implementation.

Question 147

_, often known as “supplier audits,” typically involve the organization auditing existing suppliers or subcontractors.

Answer 147

Second-party audits

Question 148

Third-party audits are required under consent decree or by a regulator. They are conducted by independent outside sources. They provide a formal record of

Answer 148

what was audited and when,
insight into areas that comply/do not comply,
details to support findings
and suggested corrective actions.

Question 149

External watchdog groups, sponsors and stockholders typically make up which audience for privacy program metrics?
Primary
Secondary
Tertiary
None of the above

Answer 149

Tertiary

Question 150

Which of the following is NOT typically a responsibility of a privacy metric owner?
Tracking the costs of analyzing data for the metric on an organization’s profit and loss statement
Ensuring improvements are incorporated and maintained in the process
Scheduling regular reviews to determine if the metric is still required, capable of meeting goals and providing value to the organization
Understanding how the metric fits into the organization’s business objectives

Answer 150

Tracking the costs of analyzing data for the metric on an organization’s profit and loss statement

Question 151

A privacy officer is trying to make the case to his CFO to invest more of the budget into incident prevention and preparedness. He wants to show that the likely financial gain of this investment is greater than the direct costs to the organization. Which category of metrics would be most useful to him?
Business resiliency
Program maturity
Return on investment (ROI)
Trend analysis

Answer 151

Return on investment (ROI)

Question 152

A privacy audit should reveal whether the privacy operations do what they were designed
to do and whether privacy controls are correctly managed.
True
False

Answer 152

True

Question 153

Employing dashboards, active scanning tools, and data retention and records management strategies are all ways to do what?
Monitor privacy program performance
Ensure an organization minimizes the processing of personal data
Increase information security
Provide resolutions to privacy-related complaints

Answer 153

Monitor privacy program performance

Question 154

Which category of audits may align to an ISO standard, NIST special publication or other industry framework?
First-party audits
Supplier audits
Third-party audits
Data protection commissioner audits

Answer 154

Third-party audits

Question 155

Which of the following is a valid reason for an organization to conduct a privacy audit?
It has expanded its industry base
It has made staffing cutbacks and shifted its business priorities
There has been a confirmed security incident
All of the above

Answer 155

All of the above

Question 156

The privacy officer for a corporation is analyzing trends on a series of privacy program metrics. She notices a conspicuous absence of privacy incidents in the past two years and wants to include this in her reporting. This information is known as a(n):
Time series
Uncertainty variable
Irregular component
Cyclical component

Answer 156

Irregular component

Question 157

Potential consequences of inadequate privacy training and awareness programs include:

Answer 157

noncompliance with laws and regulations
personal information being handled in ways that differ from organizational policy
and reputational harm or damage to relationships with customers.

Question 158

_ communicates an organization’s privacy message, policies and processes, and motivates individuals to retain and follow that information. It incorporates measurable outputs and outcomes via attendance and assessment metrics. In contrast, _ activities reinforce lessons learned in training through diverse methods.

Answer 158

Training , awareness

Question 159

Method and delivery options for privacy training programs include:

Answer 159

in-person or virtual instruction;
self-led e-learning modules;
simulations;
and just-in-time information.

Question 160

Method and delivery options for awareness efforts include:

Answer 160

newsletters with privacy topics; email reminders; company intranet announcements; posters, signage and stickers; blog posts; internal messages when the organization has a data breach; meetings; Data Privacy Day; and Privacy Awareness Week.

Question 161

Privacy training should include

Answer 161

anyone who handles personal information on behalf of the organization.

Question 162

To ensure ongoing awareness, the privacy team and other relevant departments can take the following operational actions:

Answer 162

develop and use internal and external communication plans;
communicate information about the organization’s privacy program;
ensure policy flexibility for incorporating changes to compliance requirements;
and identify, catalog and maintain documents requiring updates as privacy requirements change.

Question 163

The following high-level steps may be used to create a privacy training program:

Answer 163

• Ensure a privacy policy exists and is up to date
• Ensure employees are trained on the policy
• Ensure training records exist
• Use metrics to measure results
• Update the training based on feedback and changes to compliance obligations
• Reinforce learning with awareness activities

Question 164

Considerations for creating a successful training program include:

Answer 164

partnering with the training department/HR; making it fun and customized to participants; using motivators like digital badges; ensure all new employees are trained; ensuring repeat training is provided as needed; and soliciting feedback.

Question 165

Establishing a privacy training program can help your organization think about privacy and meet obligations to protect personal information in ways such as:

Answer 165

• Establishing a common understanding of privacy
• Reducing human error
• Considering privacy up front
• Improving customer interactions
• Expanding the privacy office’s eyes and ears
• Changing conversations

Question 166

Some common mistakes privacy professionals can make regarding privacy training and awareness include:

Answer 166

• Not covering the basics
• Not giving employees proper rules for handling and processing personal data, e.g., acceptable use policies (AUP)
• Assuming everyone is as conscientious about privacy issues and current topics as privacy professionals are
• Thinking one communication channel is sufficient; some concepts must be explained in
  multiple ways and repeated several times
• Not effectively using a past incident as a learning opportunity

Question 167

What should privacy training and awareness programs do? Select all that apply.
Communicate privacy policies
Communicate processes and procedures, such as for data usage and retention, access
control and incident reporting
Motivate and incentivize participants to follow privacy policies and procedures
Use measures, such as attendance and assessments

Answer 167

All responses are correct

Question 168

An organization should be responsible to train whom on privacy? Select all that apply.
A member of the customer service team
A receptionist
A customer
A driver responsible for business waste disposal

Answer 168

All except a customer

Question 169

Which of the following qualifies as an awareness method?
A company intranet announcement
A series of self-led e-learning modules
Just-in-time information presented online or via a manual, tip sheet or infographic

Answer 169

A company intranet announcement

Question 170

Which strategy could be used to motivate a team and help them remember the training materials?
A competitive simulation game that tests knowledge and skills gained from the training
A dashboard that shows members of the team who have completed the training
Metrics showing results (e.g., finding increased compliance with a data destruction policy
after training)

Answer 170

A competitive simulation game that tests knowledge and skills gained from the training

Question 171

A _ is the privacy information that you make available or provide to individuals when
you collect information about them.

Answer 171

privacy notice

Question 172

Privacy notices have multiple purposes, including

Answer 172

compliance;
processing personal information fairly and transparently;
making information accessible regarding how personal information is used;
meeting individuals’ expectations;
and building trust and confidence.

Question 173

A privacy notice typically explains:

Answer 173

• Who the organization is
• What information it collects
• How it will use the information
• With whom it will share the information
• Whether information is collected directly or indirectly
• What are likely future uses of the information

Question 174

Strategies to keep privacy notices accessible to customers or external stakeholders include using a _ (short notice with key information and links); _ (appears at the time of data input and provides additional information); _ (shows different processing types using a clear design and icon/symbol key); and _ (easily navigated summary of privacy information and metrics).

Answer 174

layered approach
just-in-time notice
icons/symbols
privacy dashboards

Question 175

Privacy notices inform individuals of an organization’s privacy practices, but do not _. Consent is required by law in many, but not all, cases and may not be the only reliable basis for processing personal information.

Answer 175

solicit or imply consent

Question 176

An organization’s procedures around withdrawal of consent may address

Answer 176

when and how consent may be withdrawn,
rules for communicating with individuals,
methods for withdrawing consent,
and documentation of requests and actions taken.

Question 177

There are several areas to consider when tailoring privacy notices to children and ensuring parental consent for children under the age threshold:

Answer 177

• Compliance: some laws specify rules for providing privacy notice to children and obtaining parental consent
• Language and delivery: present privacy in ways children can understand
• Age: laws and regulations may establish an age threshold for consent
• Purpose of processing: some purposes may trigger certain rules, like prohibiting the tracking of children for behavioral advertising

Question 178

Laws and regulations may require an organization to allow individuals the ability to _ —and information about its processing—upon request. Information must be provided completely, in a timely manner, without charge, and in the same form the request was made. There may be limits to this right, like protections for the rights and freedoms of others.

Answer 178

access and correct their personal information

Question 179

Many countries have data privacy laws stipulating how organizations in their jurisdiction must respond to data subject requests. Given the requirements of various global privacy laws, it is critical for organizations to _

Answer 179

have robust policies related to data subject rights and be able to respond in a timely manner

Question 180

_ affect organizations within and outside the EU, given the broad scope of the GDPR.

Answer 180

EU-specific data subject rights

Question 181

Data portability is a right under the GDPR that applies in cases of processing based on consent or contractual necessity. It means that

Answer 181

personal data must be transferrable from an organization in a format that is structured, commonly used and machine-readable.

Question 182

Under the GDPR, individuals have the right to _ in certain circumstances—for example, if they withdraw consent.

Answer 182

request erasure of their personal data

Question 183

Erasure entails both _. Controllers must also ensure third parties erase personal data.

Answer 183

ceasing processing and deleting data

Question 184

Erasure has been broadened to include _, which applies when personal data has been made public by the organization.

Answer 184

the right to be forgotten

Question 185

Internal procedures for handling privacy-related complaints should define and enable
mechanisms for:

Answer 185

• Differentiating between sources and types of complaints
• Designating proper recipients
• Implementing a centralized intake process
• Tracking the process
• Reporting and documenting resolutions
• Redress

Question 186

Departments and roles designated with receiving complaints should be _ through dedicated phone numbers, email addresses and/or physical addresses.

Answer 186

easy to reach

Question 187

A privacy notice typically explains what? Select all that apply.
How personal information will be destroyed
How personal information will be stored
With whom personal information will be shared
What information will be collected

Answer 187

With whom personal information will be shared; what information will be collected

Question 188

The chief privacy officer of a technology company has revised its privacy notice for users who download the company’s applications onto their smartphones. The notice needs to be easily accessible to users so they can refer to it when desired. What is an appropriate solution to this design challenge?
Layered approach
Privacy dashboard
Icons/symbols
Just-in-time notice

Answer 188

Privacy dashboard

Question 189

What may an organization’s procedures address regarding requests for withdrawal of consent? Select
all that apply.
When and how consent may be withdrawn
Rules for communicating with individuals
Methods for withdrawing consent
Documentation of requests and actions taken

Answer 189

All of them

Question 190

Upon request from an individual, an organization must always provide access to their personal information and information about the processing performed upon it.
True
False

Answer 190

False

Question 191

Under the EU’s General Data Protection Regulation, erasure entails not only deleting
personal data but also informing regulators once the personal data has been deleted.
True
False

Answer 191

False

Question 192

Internal procedures for handling privacy-related complaints should implement a centralized intake process.
True
False

Answer 192

True

Question 193

A _ compromises the confidentiality, integrity or availability of data and may not require notification. A _ results in the confirmed disclosure of data to an unauthorized party and requires external notification.

Answer 193

incident; breach

Question 194

Only the _ or _ should declare a breach.

Answer 194

privacy office; legal office

Question 195

Data breaches risks to organizations include:

Answer 195

loss of revenue, legal and regulatory costs, loss of business, loss of consumer trust, impact on business relationships and damage to public perception

Question 196

Data breaches risks to individuals include:

Answer 196

emotional distress, identity theft, personal reputational harm and financial damage

Question 197

The top cause of data breaches is _, which may involve malware, hacking or phishing attempts. Other common causes are device loss or theft and unintended disclosure of information.

Answer 197

malicious or criminal attacks

Question 198

An organization must determine _ associated with collected data and _ affected individuals

Answer 198

who is liable for harm; who should notify

Question 199

While prevention focuses on ways to stop an incident or breach from occurring, _ focuses on measures for optimally responding to one.

Answer 199

preparedness

Question 200

_ are vital in preparing for an incident. All employees should have a basic understanding of security procedures and how to report a suspected incident.

Answer 200

Training and awareness

Question 201

A common incident preparedness training activity is _, a structured, readinesstesting simulation involving members of multiple departments

Answer 201

the tabletop exercise

Question 202

_ is a key step in incident preparation. The organization must determine who will lead the plan creation, gather information, and develop processes and procedures.

Answer 202

Creating a formal incident response plan

Question 203

There is no _, and an organization must consider how it will classify an event as a privacy incident or a breach.

Answer 203

one definitive way to detect a breach

Question 204

Some breach response tasks may happen in parallel. It can be helpful to think about them in these categories:

Answer 204

securing your operations, notifying appropriate parties and fixing vulnerabilities

Question 205

Securing operations involves _ immediately to prevent further loss.

Answer 205

mobilizing the breach response team

Question 206

After ensuring a breach is contained, organizations should begin _

Answer 206

analyzing vulnerabilities and addressing third parties that might have been involved

Question 207

Internally, response teams must _ to executives, so they know they are as informed as possible.

Answer 207

manage expectations around communications

Question 208

When communicating news of a breach, it is important to coordinate efforts across steps and keep messages consistent in all communications. Messaging should be consistent for several reasons, including

Answer 208

to help avoid issues with legal liability and a loss of trust and consumer confidence.

Question 209

Internal and external announcements should be delivered

Answer 209

around the same time to avoid leaks, align messaging and demonstrate transparency.

Question 210

At minimum, internal communications to employees about a breach should convey the following:

Answer 210

information that may affect how they do their jobs; what to keep confidential or internal; and the designated press contact.

Question 211

Where there is _, notification may not be desirable. Factors to consider include

Answer 211

no legal obligation to notify;
the nature of the data elements breached, number of individuals affected and whether the breach is likely to lead to harm.

Question 212

Breach investigation is a subset of breach response and occurs once _.

Answer 212

breach investigators conclude that sensitive information has been compromised

Question 213

Breach investigators can:

Answer 213

capture forensic images of affected systems, collect and analyze evidence, and outline remediation steps.

Question 214

Breach reporting obligations for legal compliance vary by jurisdiction, but tend to adhere to certain principles, including

Answer 214

preventing harm, collection limitation, accountability, monitoring and enforcement, and mandatory reporting.

Question 215

The major categories of costs for a data breach are

Answer 215

legal, first-party, remediation and intangible costs.

Question 216

Legal costs
- _
First-party costs
o _
Remediation costs
* _
Intangible costs
> _

Answer 216

• Punitive costs;
  o Legal counsel
  o Crisis management/PR
  o Forensic investigators
  o Call center support
  o Equipment replacement and security enhancements
  o Insurance
  o Card replacement
  o Employee training;
• Victim notification
• Remediation offers and oversight
• Victim damages;
  > Lost revenue and stock value
  > Customer retention
  > Opportunity costs

Question 217

Cyber liability insurance may be a viable funding source for helping to offset breach response and recovery costs, such as:

Answer 217

Forensic investigations
Outside counsel fees
Crisis management services
PR experts
Breach notification
Call center costs
Credit monitoring
Fraud resolution services

Question 218

One way to learn from a breach is to _

Answer 218

conduct a breach or incident response review.

Question 219

Q’s for determining a breach and identifying affected data

Answer 219

• Was there indeed a data breach? If so, what data was exposed?
• Has the original vulnerability at the third-party vendor been resolved?
• What type(s) of data was impacted?
• Where was the data located?
• How much data was affected?

Question 220

Q’s for notifying stakeholders

Answer 220

• Which stakeholders must be notified?
• Who else must be notified: regulators, media, AtlantiPulse customers?
• What recourse may AtlantiPulse, through One Earth, need to offer affected parties?

Question 221

Q’s for following a process

Answer 221

• Do One Earth and AtlantiPulse have incident management processes in place?
• Is there a decision tree for notifications and actions in the event of a data breach?

Question 222

Q’s for Identifying vendor issues

Answer 222

• Was there privacy-related language in the contract with which the vendor did not comply?
• Did One Earth adequately assess AtlantiPulse’s third-party vendors during the acquisition?
• Do all existing AtlantiPulse third-party contracts include consistent privacy-related language? If not, how does One Earth bring these contracts into compliance with privacy language required by One Earth’s global privacy policy?
• Does One Earth need to terminate this vendor because of the data breach?

Question 223

All breaches are incidents, but not all incidents are breaches.
True
False

Answer 223

True

Question 224

Which of the following is a potential risk to an organization, rather than an individual, in the event of a data breach?
Regulatory fines
Emotional distress due to the release of confidential information
Personal reputational harm
Financial damage from misuse of credit/debit cards

Answer 224

Regulatory fines

Question 225

Employee training for incident preparedness can help which of the following? Select all that apply.
Exposing gaps in applications, plans and procedures before an incident occurs
Reducing financial liability and regulatory exposure
Lowering breach-related costs, including legal counsel and consumer notification
Cultivating greater overall security for customers, partners and employees

Answer 225

All responses are correct

Question 226

Which of the following are critical duties of an organization’s legal team in planning and responding to an incident? Select all that apply.
Limiting liability and economic consequences
Advising on response requirements
Serving as an information conduit to employees
Establishing and maintaining a consistent message

Answer 226

Limiting liability and economic consequences; advising on response requirements

Question 227

The process of responding to a breach comprises tasks that may happen in parallel.
True
False

Answer 227

True

Question 228

Why might an organization choose not to notify affected individuals of a data breach? Select all that
apply.
There is no legal obligation
The breach impacts a small percentage of those whose data the organization holds
The affected information is unusable or unlikely to cause harm
Notification may result in fines imposed on the organization

Answer 228

All responses are correct except Notification may result in fines imposed on the organization

Question 229

Though breach reporting obligations vary by jurisdiction, they tend to adhere to which of the following sets of principles?
Preventing harm, collection limitation, accountability, monitoring and enforcement, and mandatory reporting
Preventing harm, limiting access, storage limitations and mandatory disclosure
Preventing harm, protecting the public, accountability and transparency

Answer 229

Preventing harm, collection limitation, accountability, monitoring and enforcement, and mandatory reporting

Question 230

Legal counsel, call center support, employee training, crisis management and PR, and forensic investigators are all examples of what?
First-party costs associated with a data breach
External costs associated with a data breach
Breach prevention measures
Elements a privacy officer must oversee during breach response

Answer 230

First-party costs associated with a data breach

Question 231

When communicating about a breach, an organization should make internal announcements well in advance of external announcements.
True
False

Answer 231

False