[Mar 28, 2025] 100% Real & Accurate CIPP-US Questions with Free and Fast Updates [Q64-Q85]

NEW QUESTION 64
Which authority supervises and enforces laws regarding advertising to children via the Internet?

The Office for Civil Rights

The Federal Trade Commission

The Federal Communications Commission

The Department of Homeland Security

NEW QUESTION 65
Which of the following practices is NOT a key component of a data ethics framework?

Automated decision-making.

Preferability testing.

Data governance.

Auditing.

NEW QUESTION 66
When designing contact tracing apps in relation to COVID-19 or any other diagnosed virus, all of the following privacy measures should be considered EXCEPT?

Data retention.

Use limitations.

Opt-out choice.

User confidentiality.

NEW QUESTION 67
What practice does the USA FREEDOM Act NOT authorize?

Emergency exceptions that allows the government to target roamers

An increase in the maximum penalty for material support to terrorism

An extension of the expiration for roving wiretaps

The bulk collection of telephone data and internet metadata

NEW QUESTION 68
Which venture would be subject to the requirements of Section 5 of the Federal Trade Commission Act?

A local nonprofit charity’s fundraiser

An online merchant’s free shipping offer

A national bank’s no-fee checking promotion

A city bus system’s frequent rider program

NEW QUESTION 69
A student has left high school and is attending a public postsecondary institution. Under what condition may a school legally disclose educational records to the parents of the student without consent?

If the student has not yet turned 18 years of age

If the student is in danger of academic suspension

If the student is still a dependent for tax purposes

If the student has applied to transfer to another institution

NEW QUESTION 70
Global Manufacturing Co’s Human Resources department recently purchased a new software tool. This tool helps evaluate future candidates for executive roles by scanning emails to see what those candidates say and what is said about them. This provides the HR department with an automated “360 review” that lets them know how the candidate thinks and operates, what their peers and direct reports say about them, and how well they interact with each other.
What is the most important step for the Human Resources Department to take when implementing this new software?

Making sure that the software does not unintentionally discriminate against protected groups.

Ensuring that the software contains a privacy notice explaining that employees have no right to privacy as long as they are running this software on organization systems to scan email systems.

Confirming that employees have read and signed the employee handbook where they have been advised that they have no right to privacy as long as they are using the organization’s systems, regardless of the protected group or laws enforced by EEOC.

Providing notice to employees that their emails will be scanned by the software and creating automated profiles.

NEW QUESTION 71
Under the Fair Credit Reporting Act (FCRA), what must a person who is denied employment based upon his credit history receive?

A prompt notification from the employer.

An opportunity to reapply with the employer.

Information from several consumer reporting agencies (CRAs).

A list of rights from the Consumer Financial Protection Bureau (CFPB).

NEW QUESTION 72
SCENARIO
Please use the following to answer the next QUESTION :
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients’ Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.
He was also curious about the hospital’s use of a billing company. He Questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients’ care.
On his first day Declan became familiar with all areas of the hospital’s large radiology department. As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non-encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.
Despite Declan’s concern about this issue, he was amazed by the hospital’s effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan’s day ended with many QUESTIONS, he was pleased about his new position.
How can the radiology department address Declan’s concern about paper waste and still comply with the Health Insurance Portability and Accountability Act (HIPAA)?

State the privacy policy to the patient verbally

Post the privacy notice in a prominent location instead

Direct patients to the correct area of the hospital website

Confirm that patients are given the privacy notice on their first visit

NEW QUESTION 73
Which of the following is most likely to provide privacy protection to private-sector employees in the United States?

State law, contract law, and tort law

The Federal Trade Commission Act (FTC Act)

Amendments one, four, and five of the U.S. Constitution

The U.S. Department of Health and Human Services (HHS)

NEW QUESTION 74
Which of the following accurately describes the purpose of a particular federal enforcement agency?

The National Institute of Standards and Technology (NIST) has established mandatory privacy standards that can then be enforced against all for-profit organizations by the Department of Justice (DOJ).

The Cybersecurity and Infrastructure Security Agency (CISA) is authorized to bring civil enforcement actions against organizations whose website or other online service fails to adequately secure personal information.

The Federal Communications Commission (FCC) regulates privacy practices on the internet and enforces violations relating to websites’ posted privacy disclosures.

The Federal Trade Commission (FTC) is typically recognized as having the broadest authority under the FTC Act to address unfair or deceptive privacy practices.

NEW QUESTION 75
Which venture would be subject to the requirements of Section 5 of the Federal Trade Commission Act?

A local nonprofit charity’s fundraiser

An online merchant’s free shipping offer

A national bank’s no-fee checking promotion

A city bus system’s frequent rider program

NEW QUESTION 76
A financial services company install “bossware” software on its employees’ remote computers to monitor performance. The software logs screenshots, mouse movements, and keystrokes to determine whether an employee is being productive. The software can also enable the computer webcams to record video footage.
Which of the following would best support an employee claim for an intrusion upon seclusion tort?

The webcam is enabled to record video any time the computer is turned on.

The company creates and saves a biometric template for each employee based upon keystroke dynamics.

The software automatically sends a notification to a supervisor any time the employee’s mouse is dormant for more than five minutes.

The webcam records video of an employee using a company laptop to perform personal business while at a coffee shop during work hours.

An intrusion upon seclusion tort occurs when someone intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, if the intrusion would be highly offensive to a reasonable person12. The intrusion does not need to involve a physical trespass, but can also be an electronic or optical intrusion, such as using a webcam to record a person who has a reasonable expectation of privacy2. The intrusion must also cause mental anguish or suffering to the plaintiff2.
In this case, option A would best support an employee claim for an intrusion upon seclusion tort, because the webcam is enabled to record video any time the computer is turned on, regardless of whether the employee is working or not, or whether the employee is in a private or public place. This would be an intentional and highly offensive intrusion into the employee’s seclusion or private affairs, and would likely cause the employee distress or anxiety.
Option B would not support an intrusion upon seclusion tort, because the creation and saving of a biometric template based on keystroke dynamics is not an intrusion into the employee’s seclusion or private affairs, but rather a data collection and processing activity that may implicate other privacy laws or principles, such as notice, consent, and security3.
Option C would not support an intrusion upon seclusion tort, because the software sending a notification to a supervisor when the employee’s mouse is dormant for more than five minutes is not an intrusion into the employee’s seclusion or private affairs, but rather a performance monitoring activity that may be justified by the employer’s legitimate business interests4.
Option D would not support an intrusion upon seclusion tort, because the webcam recording video of an employee using a company laptop to perform personal business while at a coffee shop during work hours is not an intrusion into the employee’s seclusion or private affairs, but rather a misuse of company property and time that may be subject to the employer’s policies and disciplinary actions5. Moreover, the employee may not have a reasonable expectation of privacy in a public place like a coffee shop. References: 1: Intrusion on seclusion – Wikipedia 2: Elements of an Intrusion Claim | Digital Media Law Project 3: Biometrics – IAPP 4:
Employee Monitoring – IAPP 5: Employee Privacy – IAPP : Privacy in Public Places – IAPP

NEW QUESTION 77
Within what time period must a commercial message sender remove a recipient’s address once they have asked to stop receiving future e-mail?

7 days

10 days

15 days

21 days

NEW QUESTION 78
When may a financial institution share consumer information with non-affiliated third parties for marketing purposes?

After disclosing information-sharing practices to customers and after giving them an opportunity to opt in.

After disclosing marketing practices to customers and after giving them an opportunity to opt in.

After disclosing information-sharing practices to customers and after giving them an opportunity to opt out.

After disclosing marketing practices to customers and after giving them an opportunity to opt out.

According to the Gramm-Leach-Bliley Act (GLBA) and its implementing Regulation P, a financial institution may share consumer information with non-affiliated third parties for marketing purposes only after disclosing its information-sharing practices to customers and after giving them an opportunity to opt out of such sharing.
The GLBA defines a customer as a consumer who has a continuing relationship with a financial institution that provides one or more financial products or services to be used primarily for personal, family, or household purposes. A consumer is an individual who obtains or has obtained a financial product or service from a financial institution that is to be used primarily for personal, family, or household purposes, or that individual’s legal representative. A non-affiliated third party is any person except a financial institution’s affiliate or a person employed jointly by a financial institution and a company that is not the financial institution’s affiliate. An affiliate is any company that controls, is controlled by, or is under common control with another company.
The GLBA requires that a financial institution provide a privacy notice to customers: (i) at the time of establishing the customer relationship; (ii) annually during the continuation of the customer relationship; and (iii) before disclosing any nonpublic personal information (NPI) about the customer to any non-affiliated third party, unless an exception applies. The privacy notice must describe the categories of NPI that the financial institution collects and discloses; the categories of affiliates and non-affiliated third parties to whom the financial institution discloses NPI; the categories of NPI disclosed to service providers and joint marketers; the policies and practices with respect to protecting the confidentiality and security of NPI; and the disclosures of NPI to which the customer has a right to opt out. The financial institution must also provide a reasonable means for the customer to opt out of the disclosure of NPI to non-affiliated third parties, such as a check-off box, a reply form, or a toll-free telephone number. The opt-out notice must be clear and conspicuous, and must state that the customer can opt out at any time. The opt-out notice must also explain how the customer can opt out, and the effect of opting out. The financial institution must honor the customer’s opt-out direction as soon as reasonably practicable after receiving it, and must not disclose any NPI to which the opt-out applies, unless an exception applies.
The GLBA provides several exceptions to the opt-out requirement, such as when the disclosure of NPI is necessary to effect, administer, or enforce a transaction requested or authorized by the customer; when the disclosure of NPI is required or permitted by law; when the disclosure of NPI is to a consumer reporting agency in accordance with the Fair Credit Reporting Act; or when the disclosure of NPI is to a person that performs marketing services on behalf of the financial institution or on behalf of the financial institution and another financial institution under a joint marketing agreement. A joint marketing agreement is a formal written contract between a financial institution and any other person under which the parties agree to offer, endorse, or sponsor a financial product or service. The joint marketing agreement must prohibit the other person from using or disclosing the NPI for any purpose other than offering, endorsing, or sponsoring the financial product or service covered by the agreement.
The GLBA also requires that a financial institution provide a privacy notice to consumers who are not customers before disclosing any NPI about the consumer to any non-affiliated third party, unless an exception applies. The financial institution does not need to provide an opt-out notice to consumers who are not customers, unless it has a customer relationship with them. However, if the financial institution establishes a customer relationship with a consumer who was previously not a customer, it must provide a privacy notice and an opt-out notice to the customer as described above.
References:
* Guide to the Gramm-Leach-Bliley Act
* GLBA or FCRA? Data Sharing Between Affiliates and Non-Affiliates
* Existing Privacy Laws Already Regulate Information Sharing
* Why Do Banks Share Your Financial Information and Are They Allowed To?
* [IAPP CIPP/US Certified Information Privacy Professional Study Guide], Chapter 5, pages 161-165.

NEW QUESTION 79
Most states with data breach notification laws indicate that notice to affected individuals must be sent in the
“most expeditious time possible without unreasonable delay.” By contrast, which of the following states currently imposes a definite limit for notification to affected individuals?

Maine

Florida

New York

California

NEW QUESTION 80
Why was the Privacy Protection Act of 1980 drafted?

To respond to police searches of newspaper facilities

To assist prosecutors in civil litigation against newspaper companies

To assist in the prosecution of white-collar crimes

To protect individuals from personal privacy invasion by the police

NEW QUESTION 81
In which situation is a company operating under the assumption of implied consent?

An employer contacts the professional references provided on an applicant’s resume

An online retailer subscribes new customers to an e-mail list by default

A landlord uses the information on a completed rental application to run a credit report

A retail clerk asks a customer to provide a zip code at the check-out counter

* Implied consent is a form of consent that is inferred from the actions or inactions of the data subject, rather than explicitly expressed by the data subject1.
* Implied consent is generally considered a valid basis for processing personal data under certain circumstances, such as when the processing is necessary for the performance of a contract, the legitimate interests of the data controller, or the reasonable expectations of the data subject2.
* However, implied consent may not be sufficient for processing sensitive personal data, such as health, biometric, or genetic data, or for sending marketing communications, depending on the applicable laws and regulations2.
* In the U.S., there is no comprehensive federal privacy law that regulates the use of implied consent for data processing, but there are sector-specific laws and state laws that may impose different requirements and limitations3.
* Based on the scenarios given in the question, the situation that is most likely to involve a company operating under the assumption of implied consent is A. An employer contacts the professional references provided on an applicant’s resume.
* This is because the employer may reasonably infer that the applicant has consented to the contact of the references by voluntarily providing their information on the resume, and that the contact is necessary for the legitimate interest of the employer to verify the applicant’s qualifications and suitability for the job4.
* The other situations may not involve implied consent, but rather require explicit consent or provide opt-out options for the data subjects, depending on the type and purpose of the data processing and the relevant laws and regulations5 . For example:
* B. An online retailer subscribes new customers to an e-mail list by default. This may violate the CAN-SPAM Act, which requires online marketers to obtain affirmative consent from the recipients before sending commercial e-mail messages, and to provide a clear and conspicuous opt-out mechanism in every message5.
* C. A landlord uses the information on a completed rental application to run a credit report. This may violate the Fair Credit Reporting Act, which requires landlords to obtain written authorization from the applicants before obtaining their consumer reports, and to provide them
* with a copy of the report and a summary of their rights if they take any adverse action based on the report.
* D. A retail clerk asks a customer to provide a zip code at the check-out counter. This may violate the California Song-Beverly Credit Card Act, which prohibits retailers fromrequesting and recording personal identification information from customers who pay with a credit card, unless the information is necessary for a special purpose, such as shipping or fraud prevention.
References: 1: Implied Consent 2: Consent 3: U.S. Private-Sector Privacy (CIPP/US) 4: [Reference Checks:
Tips for Job Applicants and Employers] 5: [CAN-SPAM Act: A Compliance Guide for Business] : [Using Consumer Reports: What Landlords Need to Know] : [California Song-Beverly Credit Card Act] : [Reference Checks: Tips for Job Applicants and Employers] : [CAN-SPAM Act: A Compliance Guide for Business] :
[Using Consumer Reports: What Landlords Need to Know] : [California Song-Beverly Credit Card Act]

NEW QUESTION 82
California’s SB 1386 was the first law of its type in the United States to do what?

Require commercial entities to disclose a security data breach concerning personal information about the state’s residents

Require notification of non-California residents of a breach that occurred in California

Require encryption of sensitive information stored on servers that are Internet connected

Require state attorney general enforcement of federal regulations against unfair and deceptive trade practices

NEW QUESTION 83
Your company, an online store selling digital keys to video games, has received a data access request from an individual. Specifically, the individual wants access to her recent purchase history, as she has misplaced the emails containing the digital keys to multiple game purchases she made last month.
From a security standpoint, what would the user have to do under CCPA in order to acceptably verify her identity?

Take a photo of herself with her driver license

Provide a notarized affidavit signed by two witnesses.

Log in to her password-protected account with the company

Phone the company and provide her contact details and credit card number

NEW QUESTION 84
In a case of civil litigation, what might a defendant who is being sued for distributing an employee’s private information face?

Probation.

Criminal fines.

An injunction.

A jail sentence.

NEW QUESTION 85
Which of the following federal agencies does NOT have regulatory authority related to privacy?

Consumer Financial Protection Bureau.

U.S. Department of Transportation.

U.S. Department of Commerce.

Federal Reserve

[Mar 28, 2025] 100% Real & Accurate CIPP-US Questions with Free and Fast Updates [Q64-Q85]

admin

Leave a Reply Cancel reply