Grab latest IAPP CIPP-US Dumps as PDF Updated on 2022 [Q51-Q65]

Rate this post

Grab latest IAPP CIPP-US Dumps as PDF Updated on 2022

Newly Released CIPP-US Dumps for Certified Information Privacy Professional Certified

For more info visit:

The IAPP CIPP-US: Certified Information Privacy Professional/United States (CIPP/US)

NO.51 Which of the following best describes the ASIA-Pacific Economic Cooperation (APEC) principles?

A bill of rights for individuals seeking access to their personal information.

A code of responsibilities for medical establishments to uphold privacy laws.

An international court ruling on personal information held in the commercial sector.

A baseline of marketers’ minimum responsibilities for providing opt-out mechanisms.

NO.52 What is the main purpose of the Global Privacy Enforcement Network?

To promote universal cooperation among privacy authorities

To investigate allegations of privacy violations internationally

To protect the interests of privacy consumer groups worldwide

To arbitrate disputes between countries over jurisdiction for privacy laws

NO.53 Which of the following statements is most accurate in regard to data breach notifications under federal and state laws:

You must notify the Federal Trade Commission (FTC) in addition to affected individuals if over 500 individuals are receiving notice.

When providing an individual with required notice of a data breach, you must identify what personal information was actually or likely compromised.

When you are required to provide an individual with notice of a data breach under any state’s law, you must provide the individual with an offer for free credit monitoring.

The only obligations to provide data breach notification are under state law because currently there is no federal law or regulation requiring notice for the breach of personal information.

NO.54 When developing a company privacy program, which of the following relationships will most help a privacy professional develop useful guidance for the organization?

Relationships with individuals within the privacy professional community who are able to share expertise and leading practices for different industries.

Relationships with clients, vendors, and customers whose data will be primarily collected and used throughout the organizational program.

Relationships with company leaders responsible for approving, implementing, and periodically reviewing the corporate privacy program.

Relationships with individuals across company departments and at different levels in the organization’s hierarchy.

NO.55 Acme Student Loan Company has developed an artificial intelligence algorithm that determines whether an individual is likely to pay their bill or default. A person who is determined by the algorithm to be more likely to default will receive frequent payment reminder calls, while those who are less likely to default will not receive payment reminders.
Which of the following most accurately reflects the privacy concerns with Acme Student Loan Company using artificial intelligence in this manner?

If the algorithm uses risk factors that impact the automatic decision engine. Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.

If the algorithm makes automated decisions based on risk factors and public information, Acme need not determine if the algorithm has a disparate impact on protected classes.

If the algorithm’s methodology is disclosed to consumers, then it is acceptable for Acme to have a disparate impact on protected classes.

If the algorithm uses information about protected classes to make automated decisions, Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.

NO.56 Federal laws establish which of the following requirements for collecting personal information of minors under the age of 13?

Implied consent from a minor’s parent or guardian, or affirmative consent from the minor.

Affirmative consent from a minor’s parent or guardian before collecting the minor’s personal information online.

Implied consent from a minor’s parent or guardian before collecting a minor’s personal information online, such as when they permit the minor to use the internet.

Affirmative consent of a parent or guardian before collecting personal information of a minor offline (e.g., in person), which also satisfies any requirements for online consent.

NO.57 All of the following are tasks in the “Discover” phase of building an information management program EXCEPT?

Facilitating participation across departments and levels

Developing a process for review and update of privacy policies

Deciding how aggressive to be in the use of personal information

Understanding the laws that regulate a company’s collection of information

NO.58 Which of the following best describes an employer’s privacy-related responsibilities to an employee who has left the workplace?

An employer has a responsibility to maintain a former employee’s access to computer systems and company data needed to support claims against the company such as discrimination.

An employer has a responsibility to permanently delete or expunge all sensitive employment records to minimize privacy risks to both the employer and former employee.

An employer may consider any privacy-related responsibilities terminated, as the relationship between employer and employee is considered primarily contractual.

An employer has a responsibility to maintain the security and privacy of any sensitive employment records retained for a legitimate business purpose.

NO.59 SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state’s Do Not Call list, as well as the people on it. “If they were really serious about not being bothered,” Evan said, “They’d be on the national DNC list. That’s the only one we’re required to follow. At SunriseLynx, we call until they ask us not to.” Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call “another time.” This, to Larry, is a clear indication that they don’t want to be called at all. Evan doesn’t see it that way.
Larry believes that Evan’s arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi a. However, following Evan’s political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan’s leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker’s belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
Based on the way he uses social media, Evan is susceptible to a lawsuit based on?

Defamation

Discrimination

Intrusion upon seclusion

Publicity given to private life

NO.60 The FTC often negotiates consent decrees with companies found to be in violation of privacy principles. How does this benefit both parties involved?

It standardizes the amount of fines.

It simplifies the audit requirements.

It avoids potentially harmful publicity.

It spares the expense of going to trial.

NO.61 Which jurisdiction must courts have in order to hear a particular case?

Subject matter jurisdiction and regulatory jurisdiction

Subject matter jurisdiction and professional jurisdiction

Personal jurisdiction and subject matter jurisdiction

Personal jurisdiction and professional jurisdiction

NO.62 John, a California resident, receives notification that a major corporation with $500 million in annual revenue has experienced a data breach. John’s personal information in their possession has been stolen, including his full name and social security numb. John also learns that the corporation did not have reasonable cybersecurity measures in place to safeguard his personal information.
Which of the following answers most accurately reflects John’s ability to pursue a legal claim against the corporation under the California Consumer Privacy Act (CCPA)?

John has no right to sue the corporation because the CCPA does not address any data breach rights.

John cannot sue the corporation for the data breach because only the state’s Attoney General has authority to file suit under the CCPA.

John can sue the corporation for the data breach but only to recover monetary damages he actually suffered as a result of the data breach.

John can sue the corporation for the data breach to recover monetary damages suffered as a result of the data breach, and in some circumstances seek statutory damages irrespective of whether he suffered any financial harm.

NO.63 According to the FTC Report of 2012, what is the main goal of Privacy by Design?

Obtaining consumer consent when collecting sensitive data for certain purposes

Establishing a system of self-regulatory codes for mobile-related services

Incorporating privacy protections throughout the development process

Implementing a system of standardization for privacy notices

NO.64 SCENARIO
Please use the following to answer the next question:
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients’ Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.
He was also curious about the hospital’s use of a billing company. He questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients’ care.
On his first day Declan became familiar with all areas of the hospital’s large radiology department. As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non-encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.
Despite Declan’s concern about this issue, he was amazed by the hospital’s effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan’s day ended with many questions, he was pleased about his new position.
How can the radiology department address Declan’s concern about paper waste and still comply with the Health Insurance Portability and Accountability Act (HIPAA)?

State the privacy policy to the patient verbally

Post the privacy notice in a prominent location instead

Direct patients to the correct area of the hospital website

Confirm that patients are given the privacy notice on their first visit

NO.65 Which of these organizations would be required to provide its customers with an annual privacy notice?

The Four Winds Tribal College.

The Golden Gavel Auction House.

The King County Savings and Loan.

The Breezy City Housing Commission.