CIPP-US practice questions 91–100

1. Question 91 · 236 in bank

   Which of the following best describes what a “private right of action” is?

   • AThe right of individuals to keep their information private.
   • BThe right of individuals to submit a request to access their information.
   • CThe right of individuals harmed by data processing to have their information deleted.
   • DThe right of individuals harmed by a violation of a law to file a lawsuit against the violation.

   Show answer

   Answer: D

   Next question

2. Question 92 · 236 in bank

   Which of the following is NOT a principle found in the APEC Privacy Framework?

   • AIntegrity of Personal Information.
   • BAccess and Correction.
   • CPreventing Harm.
   • DPrivacy by Design.

   Show answer

   Answer: D

   Next question

3. Question 93 · 236 in bank

   What is the most important action an organization can take to comply with the FTC position on retroactive changes to a privacy policy?

   • ADescribing the policy changes on its website.
   • BObtaining affirmative consent from its customers.
   • CPublicizing the policy changes through social media.
   • DReassuring customers of the security of their information.

   Show answer

   Answer: B

   Next question

4. Question 94 · 236 in bank

   Federal laws establish which of the following requirements for collecting personal information of minors under the age of 13?

   • AImplied consent from a minor’s parent or guardian, or affirmative consent from the minor.
   • BAffirmative consent from a minor’s parent or guardian before collecting the minor’s personal information online.
   • CImplied consent from a minor’s parent or guardian before collecting a minor’s personal information online, such as when they permit the minor to use the internet.
   • DAffirmative consent of a parent or guardian before collecting personal information of a minor offline (e.g., in person), which also satisfies any requirements for online consent.

   Show answer

   Answer: B

   Next question

5. Question 95 · 236 in bank

   If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?

   • AThe organization will still be in compliance with most sector-specific privacy and security laws.
   • BThe impact of an organizational data breach will be more severe than if the data had been segregated.
   • CTemporary employees will be able to find the data necessary to fulfill their responsibilities.
   • DThe organization will be able to address legal discovery requests efficiently without producing more information than necessary.

   Show answer

   Answer: B

   Next question

6. Question 96 · 236 in bank

   Which of the following best describes the ASIA-Pacific Economic Cooperation (APEC) principles?

   • AA bill of rights for individuals seeking access to their personal information.
   • BA code of responsibilities for medical establishments to uphold privacy laws.
   • CAn international court ruling on personal information held in the commercial sector.
   • DA baseline of marketers’ minimum responsibilities for providing opt-out mechanisms.

   Show answer

   Answer: A

   Next question

7. Question 97 · 236 in bank

   Which of the following became the first state to pass a law specifically regulating the practices of data brokers?

   • AWashington.
   • BCalifornia.
   • CNew York.
   • DVermont.

   Show answer

   Answer: D

   Next question

8. Question 98 · 236 in bank

   Acme Student Loan Company has developed an artificial intelligence algorithm that determines whether an individual is likely to pay their bill or default. A person who is determined by the algorithm to be more likely to default will receive frequent payment reminder calls, while those who are less likely to default will not receive payment reminders. Which of the following most accurately reflects the privacy concerns with Acme Student Loan Company using artificial intelligence in this manner?

   • AIf the algorithm uses risk factors that impact the automatic decision engine. Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.
   • BIf the algorithm makes automated decisions based on risk factors and public information, Acme need not determine if the algorithm has a disparate impact on protected classes.
   • CIf the algorithm’s methodology is disclosed to consumers, then it is acceptable for Acme to have a disparate impact on protected classes.
   • DIf the algorithm uses information about protected classes to make automated decisions, Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.

   Show answer

   Answer: A

   Next question

9. Question 99 · 236 in bank

   Global Manufacturing Co’s Human Resources department recently purchased a new software tool. This tool helps evaluate future candidates for executive roles by scanning emails to see what those candidates say and what is said about them. This provides the HR department with an automated “360 review” that lets them know how the candidate thinks and operates, what their peers and direct reports say about them, and how well they interact with each other. What is the most important step for the Human Resources Department to take when implementing this new software?

   • AMaking sure that the software does not unintentionally discriminate against protected groups.
   • BEnsuring that the software contains a privacy notice explaining that employees have no right to privacy as long as they are running this software on organization systems to scan email systems.
   • CConfirming that employees have read and signed the employee handbook where they have been advised that they have no right to privacy as long as they are using the organization’s systems, regardless of the protected group or laws enforced by EEOC.
   • DProviding notice to employees that their emails will be scanned by the software and creating automated profiles.

   Show answer

   Answer: A

   Next question

10. Question 100 · 236 in bank

    Which of the following would NOT constitute an exception to the authorization requirement under the HIPAA Privacy Rule?

    • ADisclosing health information for public health activities.
    • BDisclosing health information to file a child abuse report.
    • CDisclosing health information needed to treat a medical emergency.
    • DDisclosing health information needed to pay a third party billing administrator.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-US practice, question 91. 236 questions available.