Question 211 · 236 in bank
Which of the following would NOT be regulated by the Illinois Biometric Information Privacy Act (BIPA)?
Show answer
Answer: A
Certified Information Privacy Professional — United States236 questions across 24 pages are complete and free, with no account or card.
236 questions in this bank
Free access · progress saved on this device
Which of the following would NOT be regulated by the Illinois Biometric Information Privacy Act (BIPA)?
Answer: A
Under the California Consumer Privacy Act (as amended by the California Privacy Rights Act), a consumer may initiate a civil action against a business for?
Answer: B
SCENARIO - Please use the following to answer the next question: Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customers’ privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships. Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hires Janice, a privacy professional, to help her develop one. After an initial assessment, Janice creates a first draft of a new policy. Cheryl reads through the draft and becomes concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer’s personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worries Cheryl, since stored personal information often helps her company to serve her customers, even if there are long gaps between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes. Janice understands Cheryl’s concerns and is already formulating some ideas for revision. She tries to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl is skeptical. It seems to her that classifying data and treating each type differently would cause undue difficulties in the company’s day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed. Even though the privacy policy is only a draft, Cheryl is beginning to see that changes within her company are going to be necessary. She tells Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She also expresses interest in employing a layered approach, creating documents listing applicable parts of the new policy for each department. What is the best reason for Cheryl to follow Janice’s suggestion about classifying customer data?
Answer: C
An addiction researcher at a hospital wishes to remotely review Protected Health Information (PHI). Which of the following explicitly establishes privacy protections for this processing activity?
Answer: B
Dobbs v. Jackson Women’s Health Organization led to the U.S. Department of Health and Human Services issuing public guidance regarding which of the following?
Answer: A
A state department of insurance supports consumer privacy by doing which of the following?
Answer: C
What is one of the primary reasons a court ruled that the 2017 Equifax breach of nearly 150 million consumers’ data was not considered a Fair Credit Reporting Act (FCRA) violation?
Answer: D
Kelly works for a company that does business in countries that are members of the Asia-Pacific Economic Cooperation (APEC) and participate in the APEC Privacy Framework. Recently, the company collected product feedback surveys from customers; these surveys included the customers' names and email addresses in case follow-ups were necessary. Jim from Marketing learned of this data and began planning a campaign to send customers who completed the surveys coupons via email. Kelly has privacy concerns about this that she wants to raise with her manager. Which principle of the APEC Privacy Framework will Kelly's concerns most likely involve?
Answer: D
In which of the following situations is a conflict between the GDPR and U.S. federal or state law most likely to arise?
Answer: A
SCENARIO - Please use the following to answer the next questions: Angela works in the privacy office of Fields Funds, a large investment firm in the United States. The firm was established in the 1990s and now has branch offices throughout the U.S. The firm's targeted customer base is investors with significant investment portfolios who trade on the U.S stock markets. Over the past few years however the firm has decided to expand its operations and focus on customers in different phases of working, saving, and investing. To this end. the firm established an affiliated financial services company. Digital Fields, which serves customers desiring a completely digital experience. Digital Fields is available only through a mobile app and provides users the ability to set up a checking and savings account and invest in a wide variety of stocks and mutual funds. Digital Fields targets investors who are just starting out or are interested in investing more modest funds. Additionally, Fields Funds created an affiliated entity. Free Fields, which provides free online tools, webinars, and informational materials to new investors or potential investors who don’t know where to start. Free Fields also offers a subscription to credit counseling newsletters targeted at individuals who find themselves in debt. Free Fields' services are provided at no cost, but individuals are required to create an account and share personal and demographic data in order to receive information tailored to their circumstances. Free Fields’ mission is to help individuals get to a place where they can start investing. Part of the strategic plan of Fields Funds and their affiliates is to become a data-driven organization. In essence they intend to use data to track the lifecycle of investors who progress through their investment entities, to target individuals who may benefit from stepping up in services, and to lure higher-wealth investors for charitable contributions. Fields Funds recently tasked an advanced analytics team with identifying data sets of interest, and with developing queries that will help Fields Fund move closer to these objectives. Fields Funds' executive management has come to Angela with several questions about data sharing among the three entities. Management asks Angela to support the analytics teams and the overall strategic objectives but to identify any potential issues with the intended uses of data, including those that may involve various federal requirements. Angela learns that the analytics team wishes to leverage the customer lists from Fields Funds. Digital Fields, and Free Fields to create a single database of investors and customers. The team will then use the data to identify trends in investment timing and amounts, carried debt and losses, and customer retention, among other trends. Once Free Fields is no longer affiliated with Fields Funds, which of the following would most likely apply to the personal information Free Fields may collect from consumers?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CIPP-US practice, question 211. 236 questions available.
Version 1.0.0. How we source questions