Question 231 · 247 in bank
All of the following are components of a data collection notice EXCEPT identification of?
Show answer
Answer: C
Certified Information Privacy Manager247 questions across 25 pages are complete and free, with no account or card.
247 questions in this bank
Free access · progress saved on this device
All of the following are components of a data collection notice EXCEPT identification of?
Answer: C
All of the following are environmental controls EXCEPT?
Answer: D
SCENARIO - Please use the following to answer the next question: Liam is the newly appointed IT Compliance Manager at Mesa, a US-based outdoor clothing brand with a global E-commerce presence. During his second week, he is contacted by the company's IT Audit Manager, who informs him that the auditing team will be conducting a review of Mesa's privacy compliance risk in a month. A bit nervous about the audit, Liam asks his boss what his predecessor had completed related to privacy compliance before leaving the company. Liam is told that a consent management tool had been added to the website and they commissioned a privacy risk evaluation from a small consulting firm last year that determined that their risk exposure was relatively low given their current control environment. After reading the consultant's report, Liam realized that the scope of the assessment was limited to breach notification laws in the US and the Payment Card Industry's Data Security Standard (PCI DSS). Not wanting to let down his new team, Liam kept his concerns about the report to himself and figured he could try to put some additional controls into place before the audit. Having some privacy compliance experience in his last role, Liam thought he might start by having discussions with the E-commerce and marketing teams. The E-commerce Director informed him that they were still using the cookie consent tool forcibly placed on the home screen by the CIO, but could not understand the point since their office was not located in California or Europe. The Marketing Director touted his department's success with purchasing email lists and taking a shotgun approach to direct marketing. Both Directors highlighted their tracking tools on the website to enhance customer experience while learning more about where else the customer had shopped. The more people Liam met with, the more it became apparent that privacy awareness and the general control environment at Mesa needed help. With three weeks before the audit, Liam updated Mesa’s Privacy Notice himself, which was taken and revised from a competitor's website. He also wrote policies and procedures outlining the roles and responsibilities for privacy within Mesa and distributed the document to all departments he knew of with access to personal information. During this time, Liam also filled the backlog of data subject requests for deletion that had been sent to him by the Customer Service Manager. Liam worked with application owners to remove these individual's information and order history from the Customer Relationship Management (CRM) tool, the Enterprise Resource Planning (ERP), the data warehouse, and the email server. At the audit kick-off meeting, Liam explained to his boss and her team that there may still be some room for improvement, but he thought the risk had been mitigated to an appropriate level based on the work he had done thus far. After the audit had been completed, the Audit Manager and Liam met to discuss her team's findings, and much to his dismay, Liam was told that none of the work he had completed prior to the audit followed best practices for governance and risk mitigation. In fact, his actions only opened the company up to additional risk and scrutiny. Based on these findings, Liam worked with external counsel and an established privacy consultant to develop a remediation plan. All of the key phases of an audit have occurred in the scenario EXCEPT?
Answer: D
Under the General Data Protection Regulation (GDPR), what are the obligations of a processor that engages a sub-processor?
Answer: D
When conducting due diligence during an acquisition, what should a privacy professional avoid?
Answer: B
SCENARIO - Please use the following to answer the next question: You were recently hired by InStyle Data Corp. as a privacy manager to help InStyle Data Corp. became compliant with a new data protection law. The law mandates that businesses have reasonable and appropriate security measures in place to protect personal data. Violations of that mandate are heavily fined and the legislators have stated that they will aggressively pursue companies that don't comply with the new law. You are paired with a security manager and tasked with reviewing InStyle Data Corp.'s current state and advising the business how it can meet the “reasonable and appropriate security’ requirement. InStyle Data Corp has grown rapidly and has not kept a data inventory or completed a data mapping. InStyle Data Corp. has also developed security-related policies ad hoc and many have never been implemented. The various teams involved in the creation and testing of InStyle Data Corp.'s products experience significant turnover and do not have well defined roles. There's little documentation addressing what personal data is processed by which product and for what purpose. Work needs to begin on this project immediately so that InStyle Data Corp. can become compliant by the time the law goes into effect. You and your partner discover that InStyle Data Corp. regularly sends files containing sensitive personal data back to its customers, through email, sometimes using InStyle Data Corp employees personal email accounts. You also learn that InStyle Data Corp.'s privacy and information security teams are not informed of new personal data flows, new products developed by InStyle Data Corp. that process personal data, or updates to existing InStyle Data Corp. products that may change what or how the personal data is processed until after the product or update has gone live. Through a review of InStyle Data Corp’ test and development environment logs, you discover InStyle Data Corp. sometimes gives login credentials to any InStyle Data Corp. employee or contractor who requests them. The test environment only contains dummy data, but the development environment contains personal data, including Social Security Numbers, health information, and financial information. All credentialed InStyle Data Corp. employees and contractors have the ability to alter and delete personal data in both environments regardless of their role or what project they are working on. You and your partner provide a gap assessment citing the issues you spotted, along with recommended remedial actions and a method to measure implementation. InStyle Data Corp. implements all of the recommended security controls. You review the processes, roles, controls, and measures taken to appropriately protect the personal data at every step. However, you realize there is no plan for monitoring and nothing in place addressing sanctions for violations of the updated policies and procedures. InStyle Data Corp. pushes back, stating they do not have the resources for such monitoring. Having completed the gap assessment, you and your partner need to first undertake a thorough review of?
Answer: A
Integrating privacy requirements into functional areas across the organization happens at which stage of the privacy operational life cycle?
Answer: B
Under the GDPR, when the applicable lawful basis for the processing of personal data is a legal obligation with which the controller must comply, which right can the data subject exercise?
Answer: C
Under the European Data Protection Board, which Processing operation would require a Data Protection Impact Assessment (DPIA)?
Answer: C
Your company provides a SaaS tool for B2B services and does not interact with individual consumers. A client's current employee reaches out with a right to delete request, what is the most appropriate response?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CIPM practice, question 231. 247 questions available.
Version 1.0.0. How we source questions