Question 1

Which of the following is an important implication of the Dodd-Frank Wall Street Reform and Consumer

Protection Act?

Options :

A : Financial institutions must avoid collecting a customer’s sensitive personal information

B :

Financial institutions must help ensure a customer’s understanding of products and services

C : Financial institutions must use a prescribed level of encryption for most types of customer records

D : Financial institutions must cease sending e-mails and other forms of advertising to customers who opt out of direct marketing

Answer: B

Question 2

A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?

Options :

A : Department of Health and Human Services

B : The affected individuals

C : The local media

D : Medical providers

Answer: D

Question 3

SCENARIO

Please use the following to answer the next QUESTION:

A US-based startup company is selling a new gaming application. One day, the CEO of the company receives

an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an

EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data

handling practices.

The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in

the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her

withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup

company, was never informed of this request for erasure by the EU-based retail partner. The supervisory

authority investigating the complaint has threatened the suspension of data flows if the parties involved do not

cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by

identifying all personal data received from our company.”

This is an important partnership. Company executives know that its biggest fans come from Western Europe;

and this retailer is primarily responsible for the startup’s rapid market penetration.

As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer.

Upon review, the data privacy leader discovers that the Company’s documented data inventory is obsolete.

What is the data privacy leader’s next best source of information to aid the investigation?

Options :

A : Reports on recent purchase histories

B : Database schemas held by the retailer

C : Lists of all customers, sorted by country

D : Interviews with key marketing personnel

Answer: C

Question 4

Under the Fair and Accurate Credit Transactions Act (FACTA), what is the most appropriate action for a car dealer holding a paper folder of customer credit reports?

Options :

A : To follow the Disposal Rule by having the reports shredded

B : To follow the Red Flags Rule by mailing the reports to customers

C : To follow the Privacy Rule by notifying customers that the reports are being stored

D :

To follow the Safeguards Rule by transferring the reports to a secure electronic file

Answer: C

Question 5

Which of the following best describes an employer’s privacy-related responsibilities to an employee who has

left the workplace?

Options :

A :

An employer has a responsibility to maintain a former employee’s access to computer systems and

company data needed to support claims against the company such as discrimination.

B :

An employer has a responsibility to permanently delete or expunge all sensitive employment records to

minimize privacy risks to both the employer and former employee.

C :

An employer may consider any privacy-related responsibilities terminated, as the relationship between

employer and employee is considered primarily contractual.

D :

An employer has a responsibility to maintain the security and privacy of any sensitive employment

records retained for a legitimate business purpose.

Answer: B

Confidently Practice Online with Free CIPP-C Exam Cram

Buying Options: