CIPP-A practice questions 31–40

1. Question 31 · 93 in bank

   Hong Kong's New Guidance on Direct Marketing clarified that direct marketing rules under the new regime do NOT apply if what condition exists?

   • AThe data subject’s personal data is collected from public registers or third parties.
   • BThe products or services are being offered by the organization's parent company.
   • CThe data subject has already given consent for other services offered by the company.
   • DThe products or services are being offered for the exclusive use of an individual's organization.

   Show answer

   Answer: C

   Next question

2. Question 32 · 93 in bank

   SCENARIO – Please use the following to answer the next question: Fitness For Everyone ("FFE") is a gym on Hong Kong Island that is affiliated with a network of gyms throughout Southeast Asia. When prospective members of the gym stop in, call in or submit an inquiry online, they are invited for a free trial session. At first, the gym asks prospective clients only for basic information: a full name, contact number, age and their Hong Kong ID number, so that FFE's senior trainer Kelvin can reach them to arrange their first appointment. One day, a potential customer named Stephen took a tour of the gym with Kelvin and then decided to join FFE for six months. Kelvin pulled out a registration form and explained FFE's policies, placing a circle next to the part that read "FEE and affiliated third parties" may market new products and services using the contact information provided on the form to Stephen "for the duration of his membership." Stephen asked if he could opt-out of the marketing communications. Kelvin shrugged and said that it was a standard part of the contract and that most gyms have it, but that even so Kelvin's manager wanted the item circled on all forms. Stephen agreed, signed the registration form at the bottom of the page, and provided his credit card details for a monthly gym fee. He also exchanged instant messenger/cell details with Kelvin so that they could communicate about personal training sessions scheduled to start the following week. After attending the gym consistently for six months, Stephen's employer transferred him to another part of the Island, so he did not renew his FFE membership. One year later, Stephen started to receive numerous text messages each day from unknown numbers, most marketing gym or weight loss products. Suspecting that FFE shared his information widely, he contacted his old FFE branch and asked reception if they still had his information on file. They did, but offered to delete it if he wished. He was told FFE's process to purge his information from all the affiliated systems might take 8 to 12 weeks. FFE also informed him that Kelvin was no longer employed by FFE and had recently started working for a competitor. FFE believed that Kelvin may have shared the mobile contact details of his clients with the new gym, and apologized for this inconvenience. Assuming that Kelvin received a commission for sharing his former client list with the new employer, and the new employer used Stephen's data to engage in direct marketing to Stephen, which of the following penalties could Kelvin face under Part VI A of the Ordinance?

   • ANo penalty, as FFE and the new employer are the responsible parties.
   • BViolation of the terms of his employment agreement.
   • CA maximum $500,000 HKD fine.
   • DUp to five years imprisonment.

   Show answer

   Answer: B

   Next question

3. Question 33 · 93 in bank

   SCENARIO – Please use the following to answer the next question: Fitness For Everyone ("FFE") is a gym on Hong Kong Island that is affiliated with a network of gyms throughout Southeast Asia. When prospective members of the gym stop in, call in or submit an inquiry online, they are invited for a free trial session. At first, the gym asks prospective clients only for basic information: a full name, contact number, age and their Hong Kong ID number, so that FFE's senior trainer Kelvin can reach them to arrange their first appointment. One day, a potential customer named Stephen took a tour of the gym with Kelvin and then decided to join FFE for six months. Kelvin pulled out a registration form and explained FFE's policies, placing a circle next to the part that read "FEE and affiliated third parties" may market new products and services using the contact information provided on the form to Stephen "for the duration of his membership." Stephen asked if he could opt-out of the marketing communications. Kelvin shrugged and said that it was a standard part of the contract and that most gyms have it, but that even so Kelvin's manager wanted the item circled on all forms. Stephen agreed, signed the registration form at the bottom of the page, and provided his credit card details for a monthly gym fee. He also exchanged instant messenger/cell details with Kelvin so that they could communicate about personal training sessions scheduled to start the following week. After attending the gym consistently for six months, Stephen's employer transferred him to another part of the Island, so he did not renew his FFE membership. One year later, Stephen started to receive numerous text messages each day from unknown numbers, most marketing gym or weight loss products. Suspecting that FFE shared his information widely, he contacted his old FFE branch and asked reception if they still had his information on file. They did, but offered to delete it if he wished. He was told FFE's process to purge his information from all the affiliated systems might take 8 to 12 weeks. FFE also informed him that Kelvin was no longer employed by FFE and had recently started working for a competitor. FFE believed that Kelvin may have shared the mobile contact details of his clients with the new gym, and apologized for this inconvenience. Which of the following FFE data retention policies would be permitted under Section 26 of the Personal Data (Privacy) Ordinance and Hong Kong Data Protection Principle 2 regarding accuracy and retention?

   • ARetain the data of members who have been suspended for non-payment, in the event that the data is needed to seek compensation in a court of law.
   • BRetain all member data and documents in original form for two years after account termination, to better inform marketing efforts focused on re-activating accounts of former customers.
   • CRetain an anonymous data set after account termination indicating dates of membership, age, and other statistical data, to be included in aggregate reports about gym membership trends.
   • DRetain copies of files of customers who utilized personal trainer services for six months after account termination, to allow trainers to respond to inquiries from personal physicians about training-related injuries.

   Show answer

   Answer: C

   Next question

4. Question 34 · 93 in bank

   SCENARIO – Please use the following to answer the next question: Fitness For Everyone ("FFE") is a gym on Hong Kong Island that is affiliated with a network of gyms throughout Southeast Asia. When prospective members of the gym stop in, call in or submit an inquiry online, they are invited for a free trial session. At first, the gym asks prospective clients only for basic information: a full name, contact number, age and their Hong Kong ID number, so that FFE's senior trainer Kelvin can reach them to arrange their first appointment. One day, a potential customer named Stephen took a tour of the gym with Kelvin and then decided to join FFE for six months. Kelvin pulled out a registration form and explained FFE's policies, placing a circle next to the part that read "FEE and affiliated third parties" may market new products and services using the contact information provided on the form to Stephen "for the duration of his membership." Stephen asked if he could opt-out of the marketing communications. Kelvin shrugged and said that it was a standard part of the contract and that most gyms have it, but that even so Kelvin's manager wanted the item circled on all forms. Stephen agreed, signed the registration form at the bottom of the page, and provided his credit card details for a monthly gym fee. He also exchanged instant messenger/cell details with Kelvin so that they could communicate about personal training sessions scheduled to start the following week. After attending the gym consistently for six months, Stephen's employer transferred him to another part of the Island, so he did not renew his FFE membership. One year later, Stephen started to receive numerous text messages each day from unknown numbers, most marketing gym or weight loss products. Suspecting that FFE shared his information widely, he contacted his old FFE branch and asked reception if they still had his information on file. They did, but offered to delete it if he wished. He was told FFE's process to purge his information from all the affiliated systems might take 8 to 12 weeks. FFE also informed him that Kelvin was no longer employed by FFE and had recently started working for a competitor. FFE believed that Kelvin may have shared the mobile contact details of his clients with the new gym, and apologized for this inconvenience. Which of the following practices would likely violate Hong Kong's Data Protection Principle 1 regarding data collection?

   • AFFE's collection of full name from prospective clients.
   • BFFE affiliates' receipt of Stephen's contact information.
   • CFFE's collection of age and HKID from prospective clients.
   • DFFE's collection of Stephen's messenger cell details through Kelvin.

   Show answer

   Answer: D

   Next question

5. Question 35 · 93 in bank

   SCENARIO – Please use the following to answer the next question: Fitness For Everyone ("FFE") is a gym on Hong Kong Island that is affiliated with a network of gyms throughout Southeast Asia. When prospective members of the gym stop in, call in or submit an inquiry online, they are invited for a free trial session. At first, the gym asks prospective clients only for basic information: a full name, contact number, age and their Hong Kong ID number, so that FFE's senior trainer Kelvin can reach them to arrange their first appointment. One day, a potential customer named Stephen took a tour of the gym with Kelvin and then decided to join FFE for six months. Kelvin pulled out a registration form and explained FFE's policies, placing a circle next to the part that read "FEE and affiliated third parties" may market new products and services using the contact information provided on the form to Stephen "for the duration of his membership." Stephen asked if he could opt-out of the marketing communications. Kelvin shrugged and said that it was a standard part of the contract and that most gyms have it, but that even so Kelvin's manager wanted the item circled on all forms. Stephen agreed, signed the registration form at the bottom of the page, and provided his credit card details for a monthly gym fee. He also exchanged instant messenger/cell details with Kelvin so that they could communicate about personal training sessions scheduled to start the following week. After attending the gym consistently for six months, Stephen's employer transferred him to another part of the Island, so he did not renew his FFE membership. One year later, Stephen started to receive numerous text messages each day from unknown numbers, most marketing gym or weight loss products. Suspecting that FFE shared his information widely, he contacted his old FFE branch and asked reception if they still had his information on file. They did, but offered to delete it if he wished. He was told FFE's process to purge his information from all the affiliated systems might take 8 to 12 weeks. FFE also informed him that Kelvin was no longer employed by FFE and had recently started working for a competitor. FFE believed that Kelvin may have shared the mobile contact details of his clients with the new gym, and apologized for this inconvenience. Which of the following types of text messages are permissible, regardless of Stephen's withdrawal of consent?

   • AFrom the FFE retention department, offering a special discount for reactivating membership.
   • BFrom health care services provided by Hong Kong's Hospital Authority or Department of Health.
   • CFrom an FFE affiliate that provides a mechanism to opt out of further communications by reply-texting "OO."
   • DFrom an FFE affiliate in the region Stephen was transferred to, offering services similar to those he purchased previously.

   Show answer

   Answer: C

   Next question

6. Question 36 · 93 in bank

   In Hong Kong's revised Breach Guidance Note of 2015, what course of action did the Commissioner recommend that companies take immediately after experiencing a breach?

   • AProceed under the assumption that the breach is a threat to personal safety.
   • BEnlist the aid of law enforcement to determine the cause of the breach.
   • CQuickly issue a notification to the data subjects affected by the breach.
   • DImmediately gather essential information in relation to the breach.

   Show answer

   Answer: B

   Next question

7. Question 37 · 93 in bank

   How was the Supreme Court's ruling in the Maneka Gandhi v Union of India case significant to Indian law?

   • AIt expanded the interpretation of right to life under Article 21 of the Constitution.
   • BIt established that privacy is a fundamental right granted by the Constitution under Article 21.
   • CIt upheld that the impounding of passports for "public interest" is allowable under Section 10(3)(c) of the Passports Act.
   • DIt ruled that under Article 32 of the Constitution individuals may file writ petitions when they feel their rights were violated.

   Show answer

   Answer: A

   Next question

8. Question 38 · 93 in bank

   Which of the following entities do NOT fall under India's Right to Information Act of 2005?

   • AHigh courts.
   • BState legislatures.
   • CLaw enforcement agencies.
   • DNational Security Guard.

   Show answer

   Answer: D

   Next question

9. Question 39 · 93 in bank

   In India, the obligation to appoint a Grievance Officer applies ONLY to companies that?

   • ADeal with sensitive personal data.
   • BConduct cross-border data transfers.
   • CAre considered part of the public sector.
   • DLack alternate enforcement mechanisms.

   Show answer

   Answer: A

   Next question

10. Question 40 · 93 in bank

    Section 43A of India's IT Rules 2011 requires which of the following for a privacy policy?

    • AIt should be available and produced on request.
    • BIt should be published on the website of the body corporate.
    • CIt should be emailed or faxed to data providers by the body corporate.
    • DIt should be shown to the data provider at the time of data collection.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-A practice, question 31. 93 questions available.