CIPP-US practice questions 101–110

1. Question 101 · 236 in bank

   What type of material is exempt from an individual’s right to disclosure under the Privacy Act?

   • AMaterial required by statute to be maintained and used solely for research purposes.
   • BMaterial reporting investigative efforts to prevent unlawful persecution of an individual.
   • CMaterial used to determine potential collaboration with foreign governments in negotiation of trade deals.
   • DMaterial reporting investigative efforts pertaining to the enforcement of criminal law.

   Show answer

   Answer: B

   Next question

2. Question 102 · 236 in bank

   Which of the following best describes an employer’s privacy-related responsibilities to an employee who has left the workplace?

   • AAn employer has a responsibility to maintain a former employee’s access to computer systems and company data needed to support claims against the company such as discrimination.
   • BAn employer has a responsibility to permanently delete or expunge all sensitive employment records to minimize privacy risks to both the employer and former employee.
   • CAn employer may consider any privacy-related responsibilities terminated, as the relationship between employer and employee is considered primarily contractual.
   • DAn employer has a responsibility to maintain the security and privacy of any sensitive employment records retained for a legitimate business purpose.

   Show answer

   Answer: D

   Next question

3. Question 103 · 236 in bank

   All of the following common law torts are relevant to employee privacy under US law EXCEPT?

   • AInfliction of emotional distress.
   • BIntrusion upon seclusion.
   • CDefamation
   • DConversion.

   Show answer

   Answer: D

   Next question

4. Question 104 · 236 in bank

   Which law provides employee benefits, but often mandates the collection of medical information?

   • AThe Occupational Safety and Health Act.
   • BThe Americans with Disabilities Act.
   • CThe Employee Medical Security Act.
   • DThe Family and Medical Leave Act.

   Show answer

   Answer: D

   Next question

5. Question 105 · 236 in bank

   John, a California resident, receives notification that a major corporation with $500 million in annual revenue has experienced a data breach. John’s personal information in their possession has been stolen, including his full name and social security numb. John also learns that the corporation did not have reasonable cybersecurity measures in place to safeguard his personal information. Which of the following answers most accurately reflects John’s ability to pursue a legal claim against the corporation under the California Consumer Privacy Act (CCPA)?

   • AJohn has no right to sue the corporation because the CCPA does not address any data breach rights.
   • BJohn cannot sue the corporation for the data breach because only the state’s Attoney General has authority to file suit under the CCPA.
   • CJohn can sue the corporation for the data breach but only to recover monetary damages he actually suffered as a result of the data breach.
   • DJohn can sue the corporation for the data breach to recover monetary damages suffered as a result of the data breach, and in some circumstances seek statutory damages irrespective of whether he suffered any financial harm.

   Show answer

   Answer: D

   Next question

6. Question 106 · 236 in bank

   Smith Memorial Healthcare (SMH) is a hospital network headquartered in New York and operating in 7 other states. SMH uses an electronic medical record to enter and track information about its patients. Recently, SMH suffered a data breach where a third-party hacker was able to gain access to the SMH internal network. Because it is a HIPPA-covered entity, SMH made a notification to the Office of Civil Rights at the U.S. Department of Health and Human Services about the breach. Which statement accurately describes SMH’s notification responsibilities?

   • AIf SMH is compliant with HIPAA, it will not have to make a separate notification to individuals in the state of New York.
   • BIf SMH has more than 500 patients in the state of New York, it will need to make separate notifications to these patients.
   • CIf SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York.
   • DIf SMH makes credit monitoring available to individuals who inquire, it will not have to make a separate notification to individuals in the state of New York.

   Show answer

   Answer: A

   Next question

7. Question 107 · 236 in bank

   Sarah lives in San Francisco, California. Based on a dramatic increase in unsolicited commercial emails, Sarah believes that a major social media platform with over 50 million users has collected a lot of personal information about her. The company that runs the platform is based in New York and France. Why is Sarah entitled to ask the social media platform to delete the personal information they have collected about her?

   • AAny company with a presence in Europe must comply with the General Data Protection Regulation globally, including in response to data subject deletion requests.
   • BUnder Section 5 of the FTC Act, the Federal Trade Commission has held that refusing to delete an individual’s personal information upon request constitutes an unfair practice.
   • CThe California Consumer Privacy Act entitles Sarah to request deletion of her personal information.
   • DThe New York “Stop Hacks and Improve Electronic Data Security” (SHIELD) Act requires that businesses under New York’s jurisdiction must delete customers’ personal information upon request.

   Show answer

   Answer: C

   Next question

8. Question 108 · 236 in bank

   Which of the following is an example of federal preemption?

   • AThe Payment Card Industry’s (PCI) ability to self-regulate and enforce data security standards for payment card data.
   • BThe U.S. Federal Trade Commission’s (FTC) ability to enforce against unfair and deceptive trade practices across sectors and industries.
   • CThe California Consumer Privacy Act (CCPA) regulating businesses that have no physical brick-and-mortal presence in California, but which do business there.
   • DThe U.S. Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act prohibiting states from passing laws that impose greater obligations on senders of email marketing.

   Show answer

   Answer: D

   Next question

9. Question 109 · 236 in bank

   Which of these organizations would be required to provide its customers with an annual privacy notice?

   • AThe Four Winds Tribal College.
   • BThe Golden Gavel Auction House.
   • CThe King County Savings and Loan.
   • DThe Breezy City Housing Commission.

   Show answer

   Answer: C

   Next question

10. Question 110 · 236 in bank

    Which entity within the Department of Health and Human Services (HHS) is the primary enforcer of the Health Insurance Portability and Accountability Act (HIPAA) “Privacy Rule”?

    • AOffice for Civil Rights.
    • BOffice of Social Services.
    • COffice of Inspector General.
    • DOffice of Public Health and Safety.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-US practice, question 101. 236 questions available.