Question 201 · 247 in bank
A “right to erasure” request could be rejected if the processing of personal data is for?
Show answer
Answer: B
Certified Information Privacy Manager247 questions across 25 pages are complete and free, with no account or card.
247 questions in this bank
Free access · progress saved on this device
A “right to erasure” request could be rejected if the processing of personal data is for?
Answer: B
A marketing team regularly exports spreadsheets to use for analysis including customer name, birthdate and home address. These spreadsheets are routinely shared between members of various teams via email even with employees that do not need such granular data. What is the best way to lower overall risk?
Answer: B
The best way to help ensure that reasonable and appropriate security measures are in place to protect personal data is to establish?
Answer: B
As the Data Protection Officer (DPO) for the growing company, Vision 3468, what would be the most cost effective way to monitor changes in laws and regulations?
Answer: D
Which of the following is TRUE of a privacy program with decentralized governance?
Answer: C
SCENARIO - Please use the following to answer the next question: Liam is the newly appointed IT Compliance Manager at Mesa, a US-based outdoor clothing brand with a global E-commerce presence. During his second week, he is contacted by the company's IT Audit Manager, who informs him that the auditing team will be conducting a review of Mesa's privacy compliance risk in a month. A bit nervous about the audit, Liam asks his boss what his predecessor had completed related to privacy compliance before leaving the company. Liam is told that a consent management tool had been added to the website and they commissioned a privacy risk evaluation from a small consulting firm last year that determined that their risk exposure was relatively low given their current control environment. After reading the consultant's report, Liam realized that the scope of the assessment was limited to breach notification laws in the US and the Payment Card Industry's Data Security Standard (PCI DSS). Not wanting to let down his new team, Liam kept his concerns about the report to himself and figured he could try to put some additional controls into place before the audit. Having some privacy compliance experience in his last role, Liam thought he might start by having discussions with the E-commerce and marketing teams. The E-commerce Director informed him that they were still using the cookie consent tool forcibly placed on the home screen by the CIO, but could not understand the point since their office was not located in California or Europe. The Marketing Director touted his department's success with purchasing email lists and taking a shotgun approach to direct marketing. Both Directors highlighted their tracking tools on the website to enhance customer experience while learning more about where else the customer had shopped. The more people Liam met with, the more it became apparent that privacy awareness and the general control environment at Mesa needed help. With three weeks before the audit, Liam updated Mesa’s Privacy Notice himself, which was taken and revised from a competitor's website. He also wrote policies and procedures outlining the roles and responsibilities for privacy within Mesa and distributed the document to all departments he knew of with access to personal information. During this time, Liam also filled the backlog of data subject requests for deletion that had been sent to him by the Customer Service Manager. Liam worked with application owners to remove these individual's information and order history from the Customer Relationship Management (CRM) tool, the Enterprise Resource Planning (ERP), the data warehouse, and the email server. At the audit kick-off meeting, Liam explained to his boss and her team that there may still be some room for improvement, but he thought the risk had been mitigated to an appropriate level based on the work he had done thus far. After the audit had been completed, the Audit Manager and Liam met to discuss her team's findings, and much to his dismay, Liam was told that none of the work he had completed prior to the audit followed best practices for governance and risk mitigation. In fact, his actions only opened the company up to additional risk and scrutiny. Based on these findings, Liam worked with external counsel and an established privacy consultant to develop a remediation plan. What maturity level should the internal audit assign to Mesa’s privacy policies and procedures if they use the Privacy Maturity Model (PMM)?
Answer: A
SCENARIO - Please use the following to answer the next question: Liam is the newly appointed IT Compliance Manager at Mesa, a US-based outdoor clothing brand with a global E-commerce presence. During his second week, he is contacted by the company's IT Audit Manager, who informs him that the auditing team will be conducting a review of Mesa's privacy compliance risk in a month. A bit nervous about the audit, Liam asks his boss what his predecessor had completed related to privacy compliance before leaving the company. Liam is told that a consent management tool had been added to the website and they commissioned a privacy risk evaluation from a small consulting firm last year that determined that their risk exposure was relatively low given their current control environment. After reading the consultant's report, Liam realized that the scope of the assessment was limited to breach notification laws in the US and the Payment Card Industry's Data Security Standard (PCI DSS). Not wanting to let down his new team, Liam kept his concerns about the report to himself and figured he could try to put some additional controls into place before the audit. Having some privacy compliance experience in his last role, Liam thought he might start by having discussions with the E-commerce and marketing teams. The E-commerce Director informed him that they were still using the cookie consent tool forcibly placed on the home screen by the CIO, but could not understand the point since their office was not located in California or Europe. The Marketing Director touted his department's success with purchasing email lists and taking a shotgun approach to direct marketing. Both Directors highlighted their tracking tools on the website to enhance customer experience while learning more about where else the customer had shopped. The more people Liam met with, the more it became apparent that privacy awareness and the general control environment at Mesa needed help. With three weeks before the audit, Liam updated Mesa’s Privacy Notice himself, which was taken and revised from a competitor's website. He also wrote policies and procedures outlining the roles and responsibilities for privacy within Mesa and distributed the document to all departments he knew of with access to personal information. During this time, Liam also filled the backlog of data subject requests for deletion that had been sent to him by the Customer Service Manager. Liam worked with application owners to remove these individual's information and order history from the Customer Relationship Management (CRM) tool, the Enterprise Resource Planning (ERP), the data warehouse, and the email server. At the audit kick-off meeting, Liam explained to his boss and her team that there may still be some room for improvement, but he thought the risk had been mitigated to an appropriate level based on the work he had done thus far. After the audit had been completed, the Audit Manager and Liam met to discuss her team's findings, and much to his dismay, Liam was told that none of the work he had completed prior to the audit followed best practices for governance and risk mitigation. In fact, his actions only opened the company up to additional risk and scrutiny. Based on these findings, Liam worked with external counsel and an established privacy consultant to develop a remediation plan. What key error related to program governance did Liam make prior to the audit kick-off meeting?
Answer: D
SCENARIO - Please use the following to answer the next question: Liam is the newly appointed IT Compliance Manager at Mesa, a US-based outdoor clothing brand with a global E-commerce presence. During his second week, he is contacted by the company's IT Audit Manager, who informs him that the auditing team will be conducting a review of Mesa's privacy compliance risk in a month. A bit nervous about the audit, Liam asks his boss what his predecessor had completed related to privacy compliance before leaving the company. Liam is told that a consent management tool had been added to the website and they commissioned a privacy risk evaluation from a small consulting firm last year that determined that their risk exposure was relatively low given their current control environment. After reading the consultant's report, Liam realized that the scope of the assessment was limited to breach notification laws in the US and the Payment Card Industry's Data Security Standard (PCI DSS). Not wanting to let down his new team, Liam kept his concerns about the report to himself and figured he could try to put some additional controls into place before the audit. Having some privacy compliance experience in his last role, Liam thought he might start by having discussions with the E-commerce and marketing teams. The E-commerce Director informed him that they were still using the cookie consent tool forcibly placed on the home screen by the CIO, but could not understand the point since their office was not located in California or Europe. The Marketing Director touted his department's success with purchasing email lists and taking a shotgun approach to direct marketing. Both Directors highlighted their tracking tools on the website to enhance customer experience while learning more about where else the customer had shopped. The more people Liam met with, the more it became apparent that privacy awareness and the general control environment at Mesa needed help. With three weeks before the audit, Liam updated Mesa’s Privacy Notice himself, which was taken and revised from a competitor's website. He also wrote policies and procedures outlining the roles and responsibilities for privacy within Mesa and distributed the document to all departments he knew of with access to personal information. During this time, Liam also filled the backlog of data subject requests for deletion that had been sent to him by the Customer Service Manager. Liam worked with application owners to remove these individual's information and order history from the Customer Relationship Management (CRM) tool, the Enterprise Resource Planning (ERP), the data warehouse, and the email server. At the audit kick-off meeting, Liam explained to his boss and her team that there may still be some room for improvement, but he thought the risk had been mitigated to an appropriate level based on the work he had done thus far. After the audit had been completed, the Audit Manager and Liam met to discuss her team's findings, and much to his dismay, Liam was told that none of the work he had completed prior to the audit followed best practices for governance and risk mitigation. In fact, his actions only opened the company up to additional risk and scrutiny. Based on these findings, Liam worked with external counsel and an established privacy consultant to develop a remediation plan. Why do Mesa's E-commerce and marketing efforts need to be compliant with the General Data Protection Regulation (GDPR)?
Answer: A
SCENARIO - Please use the following to answer the next question: Liam is the newly appointed IT Compliance Manager at Mesa, a US-based outdoor clothing brand with a global E-commerce presence. During his second week, he is contacted by the company's IT Audit Manager, who informs him that the auditing team will be conducting a review of Mesa's privacy compliance risk in a month. A bit nervous about the audit, Liam asks his boss what his predecessor had completed related to privacy compliance before leaving the company. Liam is told that a consent management tool had been added to the website and they commissioned a privacy risk evaluation from a small consulting firm last year that determined that their risk exposure was relatively low given their current control environment. After reading the consultant's report, Liam realized that the scope of the assessment was limited to breach notification laws in the US and the Payment Card Industry's Data Security Standard (PCI DSS). Not wanting to let down his new team, Liam kept his concerns about the report to himself and figured he could try to put some additional controls into place before the audit. Having some privacy compliance experience in his last role, Liam thought he might start by having discussions with the E-commerce and marketing teams. The E-commerce Director informed him that they were still using the cookie consent tool forcibly placed on the home screen by the CIO, but could not understand the point since their office was not located in California or Europe. The Marketing Director touted his department's success with purchasing email lists and taking a shotgun approach to direct marketing. Both Directors highlighted their tracking tools on the website to enhance customer experience while learning more about where else the customer had shopped. The more people Liam met with, the more it became apparent that privacy awareness and the general control environment at Mesa needed help. With three weeks before the audit, Liam updated Mesa’s Privacy Notice himself, which was taken and revised from a competitor's website. He also wrote policies and procedures outlining the roles and responsibilities for privacy within Mesa and distributed the document to all departments he knew of with access to personal information. During this time, Liam also filled the backlog of data subject requests for deletion that had been sent to him by the Customer Service Manager. Liam worked with application owners to remove these individual's information and order history from the Customer Relationship Management (CRM) tool, the Enterprise Resource Planning (ERP), the data warehouse, and the email server. At the audit kick-off meeting, Liam explained to his boss and her team that there may still be some room for improvement, but he thought the risk had been mitigated to an appropriate level based on the work he had done thus far. After the audit had been completed, the Audit Manager and Liam met to discuss her team's findings, and much to his dismay, Liam was told that none of the work he had completed prior to the audit followed best practices for governance and risk mitigation. In fact, his actions only opened the company up to additional risk and scrutiny. Based on these findings, Liam worked with external counsel and an established privacy consultant to develop a remediation plan. The phases of an audit described in this narrative are Plan and ?
Answer: C
Under the General Data Protection Regulation (GDPR), international data transfer is allowed using the mechanisms in all of the following scenarios EXCEPT between companies who?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CIPM practice, question 201. 247 questions available.
Version 1.0.0. How we source questions