A technology company develops an application (the "app") that collects personal data from high school athletes who are scholarship prospects for various colleges in various sports. The app is a social media-type application where athletes can post comments, videos, and other content. Coaches can post athletes' statistics for colleges to use for scouting purposes. In the app's settings, athletes can choose whether to put in their contact information, as well as information such as their place of birth, school GPA, dates of attendance, and any honors or awards they may have earned. All information that an athlete or coach puts into the app is publicly available. Why would the athletes' personal information in the app not be protected under FERPA?
Show answer
Answer: B
Question 222 · 236 in bank
If a U.S.-based company receives a subpoena from the U.S. Department of Justice for emails stored in a data center in Germany, what requires the company to turn over the emails?
Show answer
Answer: A
Question 223 · 236 in bank
SCENARIO - Please use the following to answer the next questions: Werkforce HR is a nationwide company that provides outsourced human resources services, including managing payroll, maintaining personnel files, completing background checks, and handling employee benefits. Werkforce's cloud-based human resources management software allows workers to clock in and out with fingerprint scans and manage their paid time off and benefits. Managers access the software to approve timesheets, and Werkforce and the client company’s HR department are both able to access the data in the cloud. Recently, Werkforce debuted a new feature of the software called WerkSmart that uses AI to evaluate job applications and video recordings submitted by applicants. WerkSmarts assessment of job candidates is recorded in an applicant’s profile in the cloud as either “Hire” or “Do Not Hire," based on its confidential and proprietary evaluation algorithm. A growing company called Crashpuppy, which develops and sells educational software, has just signed a three-year vendor agreement with Werkforce for its HR needs. For several months now, Crashpuppy has been using the Werkforce software, including the WerkSmart feature for hiring. Three weeks ago, Crashpuppy experienced two unrelated security incidents. In the first, known as the “Employee Incident,’ a scammer spoofed the Werkforce CEO’s email address and sent an email to Crashpuppy’s HR Director. The email asked the HR Director to send an employee roster "for routine product updates." The HR Director accessed the Werkforce cloud account, generated a report from employee data, and sent the report to the scammer. The report included each employee’s name, employee ID number, rate of pay, position title, email address, higher education history, length of tenure, age, race, sex, and disability status. The HR Director realized his mistake several days later when he spoke to the Workforce CEO and asked if she had received the spreadsheet. In the second incident, the “Applicant Incident,” a hacker accessed Crashpuppy’s WerkSmart account, exfiltrated all data related to approximately 5,000 applicants from all 50 states, and then encrypted the data in the Werkforce cloud. Crashpuppy received a ransom demand for $100 million in order to unencrypt the data. Both incidents become national news, and plaintiffs’ attorneys begin filing lawsuits against Werkforce and Crashpuppy on behalf of the employees and applicants. Crashpuppy would have to evaluate whether the data affected in the "Applicant Incident" is subject to state data privacy and security laws (such as the California Privacy Rights Act (CPRA) or the Colorado Privacy Act (CPA)). All of the following would help them do so EXCEPT?
Show answer
Answer: B
Question 224 · 236 in bank
SCENARIO - Please use the following to answer the next questions: Werkforce HR is a nationwide company that provides outsourced human resources services, including managing payroll, maintaining personnel files, completing background checks, and handling employee benefits. Werkforce's cloud-based human resources management software allows workers to clock in and out with fingerprint scans and manage their paid time off and benefits. Managers access the software to approve timesheets, and Werkforce and the client company’s HR department are both able to access the data in the cloud. Recently, Werkforce debuted a new feature of the software called WerkSmart that uses AI to evaluate job applications and video recordings submitted by applicants. WerkSmarts assessment of job candidates is recorded in an applicant’s profile in the cloud as either “Hire” or “Do Not Hire," based on its confidential and proprietary evaluation algorithm. A growing company called Crashpuppy, which develops and sells educational software, has just signed a three-year vendor agreement with Werkforce for its HR needs. For several months now, Crashpuppy has been using the Werkforce software, including the WerkSmart feature for hiring. Three weeks ago, Crashpuppy experienced two unrelated security incidents. In the first, known as the “Employee Incident,’ a scammer spoofed the Werkforce CEO’s email address and sent an email to Crashpuppy’s HR Director. The email asked the HR Director to send an employee roster "for routine product updates." The HR Director accessed the Werkforce cloud account, generated a report from employee data, and sent the report to the scammer. The report included each employee’s name, employee ID number, rate of pay, position title, email address, higher education history, length of tenure, age, race, sex, and disability status. The HR Director realized his mistake several days later when he spoke to the Workforce CEO and asked if she had received the spreadsheet. In the second incident, the “Applicant Incident,” a hacker accessed Crashpuppy’s WerkSmart account, exfiltrated all data related to approximately 5,000 applicants from all 50 states, and then encrypted the data in the Werkforce cloud. Crashpuppy received a ransom demand for $100 million in order to unencrypt the data. Both incidents become national news, and plaintiffs’ attorneys begin filing lawsuits against Werkforce and Crashpuppy on behalf of the employees and applicants. Which of the following practices would NOT have helped Crashpuppy limit the financial impact of the security incidents?
Show answer
Answer: C
Question 225 · 236 in bank
SCENARIO - Please use the following to answer the next questions: Werkforce HR is a nationwide company that provides outsourced human resources services, including managing payroll, maintaining personnel files, completing background checks, and handling employee benefits. Werkforce's cloud-based human resources management software allows workers to clock in and out with fingerprint scans and manage their paid time off and benefits. Managers access the software to approve timesheets, and Werkforce and the client company’s HR department are both able to access the data in the cloud. Recently, Werkforce debuted a new feature of the software called WerkSmart that uses AI to evaluate job applications and video recordings submitted by applicants. WerkSmarts assessment of job candidates is recorded in an applicant’s profile in the cloud as either “Hire” or “Do Not Hire," based on its confidential and proprietary evaluation algorithm. A growing company called Crashpuppy, which develops and sells educational software, has just signed a three-year vendor agreement with Werkforce for its HR needs. For several months now, Crashpuppy has been using the Werkforce software, including the WerkSmart feature for hiring. Three weeks ago, Crashpuppy experienced two unrelated security incidents. In the first, known as the “Employee Incident,’ a scammer spoofed the Werkforce CEO’s email address and sent an email to Crashpuppy’s HR Director. The email asked the HR Director to send an employee roster "for routine product updates." The HR Director accessed the Werkforce cloud account, generated a report from employee data, and sent the report to the scammer. The report included each employee’s name, employee ID number, rate of pay, position title, email address, higher education history, length of tenure, age, race, sex, and disability status. The HR Director realized his mistake several days later when he spoke to the Workforce CEO and asked if she had received the spreadsheet. In the second incident, the “Applicant Incident,” a hacker accessed Crashpuppy’s WerkSmart account, exfiltrated all data related to approximately 5,000 applicants from all 50 states, and then encrypted the data in the Werkforce cloud. Crashpuppy received a ransom demand for $100 million in order to unencrypt the data. Both incidents become national news, and plaintiffs’ attorneys begin filing lawsuits against Werkforce and Crashpuppy on behalf of the employees and applicants. In vetting the WerkSmart software, what information could Crashpuppy have requested from Werkforce to help it assess the potential risk regarding failure to hire claims from job applicants?
Show answer
Answer: A
Question 226 · 236 in bank
Which of the following is NOT a potential consequence of violating comprehensive state data security and privacy laws?
Show answer
Answer: C
Question 227 · 236 in bank
Your company wants to obtain a marketing list containing consumer personal information — including names, emails and IP addresses — from a third-party AdTech company. The AdTech company has masked and tokenized the personal information in the list. Under which of the following conditions would obtaining the data from the AdTech company NOT be considered a sale of personal information under the California Privacy Rights Act?
Show answer
Answer: C
Question 228 · 236 in bank
Under the Virginia Consumer Data Protection Act, a company would NOT need to publish an opt-out link on its website if the company only processed personal data for which of the following purposes?
Show answer
Answer: B
Question 229 · 236 in bank
Under the Illinois Biometric Information Privacy Act (BIPA), what can organizations be fined for?
Show answer
Answer: A
Question 230 · 236 in bank
Unlike the biometric information privacy statutes adopted by Washington and Texas, the Illinois Biometric Information Privacy Act (BIPA) is unique in that it does what?
Show answer
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page