CIPP-US Practice Test practice questions, page 4 of 11, with answer review and explanations.
Question 16
Which venture would be subject to the requirements of Section 5 of the Federal Trade Commission Act?
A local nonprofit charity’s fundraiser
An online merchant’s free shipping offer
A national bank’s no-fee checking promotion
A city bus system’s frequent rider program
Question 17
An organization self-certified under Privacy Shield must, upon request by an individual, do what?
Suspend the use of all personal information collected by the organization to fulfill its original purpose.
Provide the identities of third parties with whom the organization shares personal information.
Provide the identities of third and fourth parties that may potentially receive personal information.
Identify all personal information disclosed during a criminal investigation.
Question 18
Which of the following federal agencies does NOT enforce the Disposal Rule under the Fair and Accurate Credit Transactions Act (FACTA)?
The Office of the Comptroller of the Currency
The Consumer Financial Protection Bureau
The Department of Health and Human Services
The Federal Trade Commission
Question 19
SCENARIO - Please use the following to answer the next question: A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices. The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.” This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup’s rapid market penetration. As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer. At this stage of the investigation, what should the data privacy leader review first?
Available data flow diagrams
The text of the original complaint
The company’s data privacy policies
Prevailing regulation on this subject
Question 20
SCENARIO - Please use the following to answer the next question: A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices. The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.” This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup’s rapid market penetration. As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer. Upon review, the data privacy leader discovers that the Company’s documented data inventory is obsolete. What is the data privacy leader’s next best source of information to aid the investigation?