2024 Updates For the Latest CIPP-US Free Exam Study Guide!
Best CIPP-US Exam Preparation Material with New Dumps Questions
NEW QUESTION # 68
Which was NOT one of the five priority areas listed by the Federal Trade Commission in its 2012 report,
"Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers"?
- A. Do Not Track
- B. International data transfers
- C. Large platform providers
- D. Promoting enforceable self-regulatory codes
Answer: A
Explanation:
The Federal Trade Commission (FTC) issued its 2012 report, "Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers"1, which outlined a framework for privacy protection based on three main principles: privacy by design, simplified consumer choice, and greater transparency. The report also identified five priority areas for the FTC's privacy enforcement and policy efforts, which were:
* Data brokers
* Large platform providers
* Mobile
* Promoting enforceable self-regulatory codes
* International data transfers
Do Not Track was not one of the five priority areas, but rather a specific mechanism for implementing the principle of simplified consumer choice. The report endorsed the development of a Do Not Track system that would allow consumers to opt out of online behavioral advertising across websites and platforms1. The report also noted the progress made by various stakeholders, such as the World Wide Web Consortium (W3C), the Digital Advertising Alliance (DAA), and browser companies, in advancing the Do Not Track initiative1. References: 1: Federal Trade Commission, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers (March 2012), available at 1.
NEW QUESTION # 69
Under the Driver's Privacy Protection Act (DPPA), which of the following parties would require consent of an individual in order to obtain his or her Department of Motor Vehicle information?
- A. Marketers wishing to distribute bulk materials.
- B. Insurance companies needing to investigate claims.
- C. Law enforcement agencies performing investigations.
- D. Attorneys gathering information related to lawsuits.
Answer: A
Explanation:
The Driver's Privacy Protection Act (DPPA) is a federal law that regulates the disclosure of personal information obtained by state departments of motor vehicles (DMVs). The DPPA prohibits DMVs and other entities that receive such information from DMVs from disclosing it to anyone without the express consent of the individual to whom the information pertains, unless the disclosure falls under one of the 14 exceptions listed in the statute.
Some of the exceptions that allow disclosure of personal information from DMV records without consent are:
* For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a government agency in carrying out its functions.
* For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and removal of non-owner records from the original owner records of motor vehicle manufacturers.
* For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.
* For use in connection with any civil, criminal, administrative, or arbitral proceeding in any federal, state, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a federal, state, or local court.
* For use in research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals.
* For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.
* For use in providing notice to the owners of towed or impounded vehicles.
* For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection.
* For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license that is required under chapter 313 of title 49.
* For use in connection with the operation of private toll transportation facilities.
* For any other use specifically authorized under the law of the state that holds the record, if such use is related to the operation of a motor vehicle or public safety.
None of the exceptions above apply to the use of personal information from DMV records by marketers wishing to distribute bulk materials. Therefore, such use would require the consent of the individual to whom the information pertains, according to the DPPA. Hence, option D is the correct answer.
Option A is incorrect, as law enforcement agencies performing investigations are exempt from the consent requirement under the first exception.
Option B is incorrect, as insurance companies needing to investigate claims are exempt from the consent requirement under the sixth exception.
Option C is incorrect, as attorneys gathering information related to lawsuits are exempt from the consent requirement under the fourth exception.
References:
* [IAPP CIPP/US Study Guide], Chapter 8: Federal Privacy Laws, pp. 181-182.
* CIPP/US Practice Questions (Sample Questions), Question 31.
NEW QUESTION # 70
Which of the following state laws has an entity exemption for organizations subject to the Gramm-Leach-Bliley Act (GLBA)?
- A. California Privacy Rights Act.
- B. Virginia Consumer Data Protection Act
- C. Nevada Privacy Law.
- D. California Consumer Privacy Act.
Answer: A
Explanation:
The Virginia Consumer Data Protection Act (VCDPA) is a state law that provides comprehensive privacy rights and obligations for consumers and businesses in Virginia. The VCDPA applies to any entity that conducts business in Virginia or produces products or services that are targeted to residents of Virginia and that either: (a) controls or processes personal data of at least 100,000 consumers; or (b) controls or processes personal data of at least 25,000 consumers and derives over 50% of gross revenue from the sale of personal data. However, the VCDPA also provides several exemptions for certain types of entities and data, including an entity exemption for financial institutions or data subject to the Gramm-Leach-Bliley Act (GLBA). This means that organizations that are regulated by the GLBA are not subject to the VCDPA, regardless of the type or source of data they collect or process. The GLBA is a federal law that regulates the collection, use, and disclosure of personal financial information by financial institutions and their affiliates. The GLBA applies to any business that is significantly engaged in financial activities, such as banks, credit unions, securities firms, insurance companies, and certain fintech companies. The GLBA requires financial institutions to provide notice and choice to consumers about their privacy practices, to safeguard the security and confidentiality of consumer information, and to limit the sharing of consumer information with third parties. The GLBA also preempts state laws only to the extent that they are inconsistent with the GLBA, unless the state law provides greater protection to consumers.
The other state laws listed in the question do not have an entity exemption for organizations subject to the GLBA, but they may have partial or data exemptions for certain types of information that are regulated by the GLBA. For example, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are state laws that provide comprehensive privacy rights and obligations for consumers and businesses in California. The CCPA and the CPRA apply to any business that collects or sells the personal information of California residents and that meets one or more of the following thresholds: (a) has annual gross revenues in excess of $25 million; (b) alone or in combination, annually buys, receives for the business's commercial purposes, sells, or shares for commercial purposes, the personal information of 50,000 or more consumers, households, or devices; or derives 50% or more of its annual revenues from selling consumers' personal information. However, the CCPA and the CPRA also provide several exemptions for certain types of entities and data, including a data exemption for personal information collected, processed, sold, or disclosed pursuant to the GLBA, if it is in conflict with the GLBA. This means that information that is subject to the GLBA is exempt from the privacy requirements of the CCPA and the CPRA, but not from the data breach liability provisions. The CCPA and the CPRA do not exempt financial institutions or other entities that are regulated by the GLBA from their scope, unless they only collect or process information that is subject to the GLBA.
The Nevada Privacy Law is a state law that provides privacy rights and obligations for consumers and operators of websites or online services in Nevada. The Nevada Privacy Law applies to any person who owns or operates an Internet website or online service for commercial purposes that collects and maintains covered information from consumers who reside in Nevada and use or visit the Internet website or online service.
Covered information includes any one or more of the following items of personally identifiable information about a consumer collected by an operator through an Internet website or online service and maintained by the operator in an accessible form: (a) a first and last name; (b) a home or other physical address which includes the name of a street and the name of a city or town; an electronic mail address; (d) a telephone number; (e) a social security number; (f) an identifier that allows a specific person to be contacted either physically or online; or (g) any other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable. However, the Nevada Privacy Law also provides several exemptions for certain types of entities and data, including a data exemption for any data that is subject to the GLBA. This means that information that is regulated by the GLBA is exempt from the Nevada Privacy Law, regardless of the type or source of data. The Nevada Privacy Law does not exempt financial institutions or other entities that are subject to the GLBA from its scope, unless they only collect or process information that is subject to the GLBA. References:
* VCDPA, Section 59.1-572 (A) (1)
* GLBA, 15 U.S.C. ยง 6801 et seq.
* CCPA, Section 1798.145 (e)
* CPRA, Section 1798.121
* Nevada Privacy Law, Section 603A.340 (1) (a)
NEW QUESTION # 71
Which of the following best describes an employer's privacy-related responsibilities to an employee who has left the workplace?
- A. An employer has a responsibility to permanently delete or expunge all sensitive employment records to minimize privacy risks to both the employer and former employee.
- B. An employer has a responsibility to maintain a former employee's access to computer systems and company data needed to support claims against the company such as discrimination.
- C. An employer has a responsibility to maintain the security and privacy of any sensitive employment records retained for a legitimate business purpose.
- D. An employer may consider any privacy-related responsibilities terminated, as the relationship between employer and employee is considered primarily contractual.
Answer: C
Explanation:
Employers have a duty to protect the personal information of their current and former employees, as well as applicants, from unauthorized access, use, or disclosure. This duty may arise from federal or state laws, such as the Fair Credit Reporting Act (FCRA), the Health Insurance Portability and Accountability Act (HIPAA), or the California Consumer Privacy Act (CCPA), or from contractual obligations, such as non-disclosure agreements or privacy policies. Employers may retain sensitive employment records, such as performance evaluations, disciplinary actions, medical records, or background checks, for a legitimate business purpose, such as complying with legal requirements, defending against lawsuits, or conducting audits. However, employers must ensure that these records are stored securely, accessed only by authorized personnel, and disposed of properly when no longer needed. References: IAPP CIPP/US Study Guide, Chapter 4, Section
4.1.1, IAPP CIPP/US Body of Knowledge, Domain IV, Objective B
NEW QUESTION # 72
Mega Corp. is a U.S.-based business with employees in California, Virginia, and Colorado. Which of the following must Mega Corp. comply with in regard to its human resources data?
- A. California Privacy Rights Act.
- B. California Privacy Rights Act and Virginia Consumer Data Protection Act.
- C. California Privacy Rights Act, Virginia Consumer Data Protection Act, and Colorado Privacy Act.
- D. California Privacy Rights Act and Colorado Privacy Act.
Answer: C
Explanation:
Mega Corp. is a U.S.-based business with employees in California, Virginia, and Colorado. Therefore, it must comply with the privacy laws of these three states in regard to its human resources data, unless it qualifies for an exemption under each law.
The California Privacy Rights Act (CPRA) is an amendment to the California Consumer Privacy Act (CCPA) that was approved by voters in November 2020 and will take effect on January 1, 2023. The CPRA expands the rights and protections of California residents with respect to their personal information and creates a new category of sensitive personal information that includes certain employment-related data, such as Social Security numbers, driver's license numbers, passport numbers, financial account information, biometric information, and geolocation data. The CPRA also establishes a new enforcement agency, the California Privacy Protection Agency, to oversee and enforce the law.
The Virginia Consumer Data Protection Act (VCDPA) is a comprehensive privacy law that was enacted in March 2021 and will take effect on January 1, 2023. The VCDPA grants Virginia residents several rights with respect to their personal data, such as the right to access, correct, delete, port, and opt out of certain processing activities. The VCDPA also imposes various obligations on businesses that control or process personal data of Virginiaresidents, such as conducting data protection assessments, entering into contracts with processors, and providing privacy notices.
The Colorado Privacy Act (CPA) is another comprehensive privacy law that was enacted in July 2021 and will take effect on July 1, 2023. The CPA grants Colorado residents similar rights as the VCDPA, with some variations, such as the right to appeal a business's response to a request and the right to opt out of targeted advertising, the sale of personal data, and certain profiling activities. The CPA also imposes similar obligations as the VCDPA, with some differences, such as requiring opt-in consent for the processing of sensitive data and allowing businesses to join a universal opt-out mechanism.
All three laws apply to businesses that conduct business in or target consumers in the respective states and meet certain thresholds of revenue or data processing volume. However, all three laws also provide exemptions for certain types of data or entities that are subject to other federal or state laws, such as the Gramm-Leach-Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), the Fair Credit Reporting Act (FCRA), and the Family Educational Rights and Privacy Act (FERPA).
One of the exemptions that may be relevant for Mega Corp. is the employee data exemption, which excludes personal data that is collected and used by an employer within the context of an employment relationship or for emergency contact or benefits administration purposes. However, this exemption is not permanent or uniform across the three laws. The CPRA's employee data exemption is set to expire on January 1, 2023, unless extended by the legislature. The VCDPA's employee data exemption is set to expire on January 1,
2023, unless repealed by the legislature. The CPA's employee data exemption does not have an expiration date, but it does not apply to the right to opt out of the sale of personal data or the right to appeal a business's response to a request.
Therefore, depending on the type and scope of the human resources data that Mega Corp. collects and processes, it may have to comply with the California Privacy Rights Act, the Virginia Consumer Data Protection Act, and the Colorado Privacy Act, unless it qualifies for another exemption under each law.
References:
* [IAPP CIPP/US Study Guide], Chapter 10: State Data Security Laws, pp. 227-229.
* CIPP/US Practice Questions (Sample Questions), Question 32.
NEW QUESTION # 73
Which of the following would NOT constitute an exception to the authorization requirement under the HIPAA Privacy Rule?
- A. Disclosing health information needed to pay a third party billing administrator.
- B. Disclosing health information needed to treat a medical emergency.
- C. Disclosing health information for public health activities.
- D. Disclosing health information to file a child abuse report.
Answer: A
Explanation:
Among the options provided, disclosing health information needed to pay a third party billing administrator would NOT constitute an exception to the authorization requirement under the HIPAA Privacy Rule. Generally, when disclosing health information for payment and healthcare operations purposes, specific patient authorization is not required. However, this exception applies primarily to disclosures made to healthcare providers, health plans, and other entities directly involved in the payment or healthcare operations process.
NEW QUESTION # 74
The "Consumer Privacy Bill of Rights" presented in a 2012 Obama administration report is generally based on?
- A. European Union Directive
- B. Common law principles
- C. The 1974 Privacy Act
- D. Traditional fair information practices
Answer: D
Explanation:
"he 2012 White House Report contains a preface signed by President Obama and defines the "Consumer Privacy Bill of Rights" based on traditional fair information practices (FIPs)."
NEW QUESTION # 75
A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?
- A. Medical providers
- B. Department of Health and Human Services
- C. The local media
- D. The affected individuals
Answer: A
NEW QUESTION # 76
California's SB 1386 was the first law of its type in the United States to do what?
- A. Require notification of non-California residents of a breach that occurred in California
- B. Require state attorney general enforcement of federal regulations against unfair and deceptive trade practices
- C. Require encryption of sensitive information stored on servers that are Internet connected
- D. Require commercial entities to disclose a security data breach concerning personal information about the state's residents
Answer: D
Explanation:
California's SB 1386, also known as the California Security Breach Information Act, was enacted in 2002 and became effective in 2003. It was the first law of its kind in the United States to require commercial entities that own or license personal information of California residents to notify them in the event of a security breach that compromises their unencrypted data. The law aims to protect the privacy and security of personal information and to enable individuals to take preventive measures against identity theft and fraud. The law applies to any business or person that conducts business in California and that owns or licenses computerized data that includes personal information, as defined by the law. Personal information includes an individual's first name or first initial and last name in combination with any one or more of the following data elements: Social Security number, driver's license number or California identification card number, account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account, or medical information or health insurance information. The law does not apply to encrypted information, publicly available information, or information that is lawfully obtained from federal, state, or local government records. The law requires the disclosure of a breach of the security of the system to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. The disclosure may be made by written notice, electronic notice, or substitute notice, as specified by the law. The law also requires any person or business that maintains computerized data that includes personal information that the person or business does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The law also authorizes a civil action for damages by a customer injured by a violation of the law and provides that the rights and remedies available under the law are cumulative to each other and to any other rights and remedies available under law. References:
* California Senate Bill 1386 (2002)
* California SB 1386: For the Love of Privacy
* What Is the California Security Breach Information Act?
* California Raises the Bar on Data Security and Privacy
NEW QUESTION # 77
How did the Fair and Accurate Credit Transactions Act (FACTA) amend the Fair Credit Reporting Act (FCRA)?
- A. It stipulated the purpose of obtaining a consumer report can only be for a review of the employee's credit worthiness
- B. It expanded the definition of "consumer reports" to include communications relating to employee investigations
- C. It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized access
- D. It required employers to get an employee's consent in advance of requesting a consumer report for internal investigation purposes Section: (none) Explanation
Answer: C
NEW QUESTION # 78
What is the main purpose of the CAN-SPAM Act?
- A. To authorize the states to enforce federal privacy laws for electronic marketing
- B. To diminish the use of electronic messages to send sexually explicit materials
- C. To empower the FTC to create rules for messages containing sexually explicit content
- D. To ensure that organizations respect individual rights when using electronic advertising
Answer: D
NEW QUESTION # 79
Which of the following is most likely to provide privacy protection to private-sector employees in the United States?
- A. The U.S. Department of Health and Human Services (HHS)
- B. State law, contract law, and tort law
- C. Amendments one, four, and five of the U.S. Constitution
- D. The Federal Trade Commission Act (FTC Act)
Answer: B
NEW QUESTION # 80
John, a California resident, receives notification that a major corporation with $500 million in annual revenue has experienced a data breach. John's personal information in their possession has been stolen, including his full name and social security numb. John also learns that the corporation did not have reasonable cybersecurity measures in place to safeguard his personal information.
Which of the following answers most accurately reflects John's ability to pursue a legal claim against the corporation under the California Consumer Privacy Act (CCPA)?
- A. John can sue the corporation for the data breach but only to recover monetary damages he actually suffered as a result of the data breach.
- B. John has no right to sue the corporation because the CCPA does not address any data breach rights.
- C. John cannot sue the corporation for the data breach because only the state's Attoney General has authority to file suit under the CCPA.
- D. John can sue the corporation for the data breach to recover monetary damages suffered as a result of the data breach, and in some circumstances seek statutory damages irrespective of whether he suffered any financial harm.
Answer: D
Explanation:
The CCPA provides consumers with a private right of action to pursue statutory damages following data security breaches that impact certain sensitive categories of personal information and are caused by a business's failure to institute reasonable and appropriate security. The CCPA defines personal information for this purpose as an individual's name in combination with any of the following: social security number, driver's license number, account number, credit or debit card number, medical information, or health insurance information. The CCPA allows consumers to seek damages between $100 and $750 per consumer per incident, or actual damages, whichever is greater. The CCPA also requires consumers to provide the business with 30 days' written notice and an opportunity to cure the violation before initiating an action. Additionally, the CCPA requires consumers to notify the Attorney General within 30 days of filing the action and obtain the Attorney General's approval or nonobjection before proceeding with the action. Therefore, John can sue the corporation for the data breach to recover monetary damages suffered as a result of the data breach, and in some circumstances seek statutory damages irrespective of whether he suffered any financial harm, as long as he meets the requirements of the CCPA. References:
* CCPA Provides Private Right of Action for Data Security Breaches
* CCPA Private Right of Action - Data Breach Security Requirement
* CCPA Fines & Penalties for Data Protection Violations | MatrixPoint
NEW QUESTION # 81
When developing a company privacy program, which of the following relationships will most help a privacy professional develop useful guidance for the organization?
- A. Relationships with company leaders responsible for approving, implementing, and periodically reviewing the corporate privacy program.
- B. Relationships with clients, vendors, and customers whose data will be primarily collected and used throughout the organizational program.
- C. Relationships with individuals across company departments and at different levels in the organization's hierarchy.
- D. Relationships with individuals within the privacy professional community who are able to share expertise and leading practices for different industries.
Answer: C
Explanation:
When developing a company privacy program, a privacy professional needs to understand the business objectives, processes, and risks of the organization, as well as the legal and regulatory requirements and best practices for privacy. To achieve this, a privacy professional should establish and maintain relationships with individuals across company departments and at different levels in the organization's hierarchy, such as IT, marketing, human resources, legal, compliance, security, and senior management. These relationships will help the privacy professional to gather relevant information, identify privacy issues and gaps, communicate privacy policies and procedures, provide training and awareness, monitor compliance, and resolve conflicts.
The other relationshipslisted are also important, but not as essential as the internal relationships for developing a company privacy program. References:
* IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 5: Developing a Privacy Program, Section 5.1: Privacy Program Framework, p. 145-146
* IAPP CIPP/US Body of Knowledge, Domain V: Developing a Privacy Program, Objective V.A:
Identify the components of a privacy program framework, Subobjective V.A.1: Identify the roles and responsibilities of individuals within the organization, p. 23
* IAPP CIPP/US Exam Blueprint, Domain V: Developing a Privacy Program, Objective V.A: Identify the components of a privacy program framework, Subobjective V.A.1: Identify the roles and responsibilities of individuals within the organization, p. 7
NEW QUESTION # 82
Under the Fair and Accurate Credit Transactions Act (FACTA), what is the most appropriate action for a car dealer holding a paper folder of customer credit reports?
- A. To follow the Disposal Rule by having the reports shredded
- B. To follow the Safeguards Rule by transferring the reports to a secure electronic file
- C. To follow the Red Flags Rule by mailing the reports to customers
- D. To follow the Privacy Rule by notifying customers that the reports are being stored
Answer: A
Explanation:
The Disposal Rule is a provision of the Fair and Accurate Credit Transactions Act (FACTA) that requires businesses and individuals to take appropriate measures to dispose of sensitive information about consumers, such as credit reports, that are derived from consumer reports. The Disposal Rule is intended to reduce the risk of identity theft and fraud by preventing unauthorized access to or use of the information. According to the Disposal Rule, reasonable steps for disposal include burning, pulverizing, or shredding papers that contain consumer report information so that they cannot be read or reconstructed.
In this scenario, the most appropriate action for a car dealer holding a paper folder of customer credit reports is to follow the Disposal Rule by having the reports shredded. This would ensure that the car dealer complies with the FACTA and protects the privacy and security of the customers' personal data. The other options are not correct, because:
* The Red Flags Rule is another provision of the FACTA that requires financial institutions and creditors to implement a written identity theft prevention program that identifies and responds to the warning signs or red flags of identity theft in their operations. The Red Flags Rule does not apply to the disposal of consumer report information, nor does it require mailing the reports to customers, which could expose the information to interception or theft.
* The Privacy Rule is a provision of the Gramm-Leach-Bliley Act (GLBA) that requires financial institutions to provide notice to customers about their privacy policies and practices, and to allow customers to opt out of sharing their personal information with certain third parties. The Privacy Rule does not apply to the disposal of consumer report information, nor does it require notifying customers that the reports are being stored, which could alert potential identity thieves to the existence of the information.
* The Safeguards Rule is another provision of the GLBA that requires financial institutions to develop, implement, and maintain a comprehensive information security program that protects the security, confidentiality, and integrity of customer information. The Safeguards Rule does not apply to the disposal of consumer report information, nor does it require transferring the reports to a secure electronic file, which could still be vulnerable to hacking or unauthorized access.
References:
* FTC website, FACTA Disposal Rule Goes into Effect June 1
* Shred Nations website, What Is the FACTA Disposal Rule?
* Seam Services website, The FACTA Disposal Rule: What Does It Mean for Your Business?
* IAPP CIPP/US Study Guide, Chapter 2: Limits on Private-sector Collection and Use of Data, pp. 49-50
* IAPP website, Red Flags Rule
* IAPP website, Fair and Accurate Credit Transactions Act (FACTA)
NEW QUESTION # 83
In 2011, the FTC announced a settlement with Google regarding its social networking service Google Buzz.
The FTC alleged that in the process of launching the service, the company did all of the following EXCEPT?
- A. Failed to employ sufficient security safeguards.
- B. Violated its own privacy policies.
- C. Failed to comply with Safe Harbor principles.
- D. Engaged in deceptive trade practices.
Answer: A
Explanation:
The FTC alleged that Google violated its own privacy policies, engaged in deceptive trade practices, and failed to comply with Safe Harbor principles when it launched Google Buzz, a social networking service that automatically enrolled Gmail users and exposed their email contacts and other personal information without their consent or control. The FTC did not allege that Google failed to employ sufficient security safeguards, although it did require Google to implement a comprehensive privacy program and submit to regular privacy audits as part of the settlement. The other statements are incorrect because:
* A. Violated its own privacy policies: The FTC alleged that Google violated its own privacy policies by using information collected from Gmail users for a purpose that wasincompatible with the purpose for which the information was collected, without obtaining their affirmative consent. Google's privacy policy stated that "When you sign up for a particular service that requires registration, we ask you to provide personal information. If we use this information in a manner different than the purpose for which it was collected, then we will ask for your consent prior to such use."1
* B. Engaged in deceptive trade practices: The FTC alleged that Google engaged in deceptive trade practices by misrepresenting the extent to which consumers could exercise control over the collection, use, and sharing of their personal information through Google Buzz. For example, Google offered consumers the option to decline or turn off Google Buzz, but the option was ineffective and did not fully remove the consumer from the social network. Google also misled consumers about how their email contacts would be treated on Google Buzz, and failed to disclose that certain information, such as the user's frequent email contacts, would be made public by default.1
* C. Failed to comply with Safe Harbor principles: The FTC alleged that Google failed to comply with the
U.S.-EU Safe Harbor Framework, which provides a method for U.S. companies to transfer personal data from the European Union to the United States in a way that meets EU data protection requirements.
Google had self-certified to the Department of Commerce that it adhered to the Safe Harbor Privacy Principles, which include notice, choice, access, and enforcement. The FTC alleged that Google's conduct violated the notice and choice principles, as well as the requirement to adhere to the Safe Harbor FAQs.1 References: FTC Charges Deceptive Privacy Practices in Google's Rollout of Its Buzz Social Network, Google, Inc., In the Matter of, Google settles with FTC over Buzz; Privacy policies to be audited for two decades, Google Settles FTC Complaint over Google Buzz Privacy
NEW QUESTION # 84
......
Free CIPP-US Exam Files Verified & Correct Answers Downloaded Instantly: https://www.passcollection.com/CIPP-US_real-exams.html
Fast Exam Updates CIPP-US dumps with PDF Test Engine Practice: https://drive.google.com/open?id=1Vgtvzpl-a6SplFUX6WU4He8qLFPWpAIe
