NEW QUESTION 1
What is one reason the European Union has enacted more comprehensive privacy laws than the United States?

• A. To ensure adequate enforcement of existing laws.
• B. To ensure there is adequate funding for enforcement.
• C. To allow separate industries to set privacy standards.
• D. To allow the free movement of data between member countries.

Answer: D

NEW QUESTION 2
SCENARIO
Please use the following to answer the next QUESTION:
You lead the privacy office for a company that handles information from individuals living in several countries throughout Europe and the Americas. You begin that morning’s privacy review when a contracts officer sends you a message asking for a phone call. The message lacks clarity and detail, but you presume that data was lost.
When you contact the contracts officer, he tells you that he received a letter in the mail from a vendor stating that the vendor improperly shared information about your customers. He called the vendor and confirmed that your company recently surveyed exactly 2000 individuals about their most recent healthcare experience and sent those surveys to the vendor to transcribe it into a database, but the vendor forgot to encrypt the database as promised in the contract. As a result, the vendor has lost control of the data.
The vendor is extremely apologetic and offers to take responsibility for sending out the notifications. They tell you they set aside 2000 stamped postcards because that should reduce the time it takes to get the notice in the mail. One side is limited to their logo, but the other side is blank and they will accept whatever you want to write. You put their offer on hold and begin to develop the text around the space constraints. You are content to let the vendor’s logo be associated with the notification.
The notification explains that your company recently hired a vendor to store information about their most recent experience at St. Sebastian Hospital’s Clinic for Infectious Diseases. The vendor did not encrypt the information and no longer has control of it. All 2000 affected individuals are invited to sign-up for email notifications about their information. They simply need to go to your company’s website and watch a quick advertisement, then provide their name, email address, and month and year of birth.
You email the incident-response council for their buy-in before 9 a.m. If anything goes wrong in this situation, you want to diffuse the blame across your colleagues. Over the next eight hours, everyone emails their comments back and forth. The consultant who leads the incident-response team notes that it is his first day with the company, but he has been in other industries for 45 years and will do his best. One of the three lawyers on the council causes the conversation to veer off course, but it eventually gets back on track. At the end of the day, they vote to proceed with the notification you wrote and use the vendor’s postcards.
Shortly after the vendor mails the postcards, you learn the data was on a server that was stolen, and make the decision to have your company offer credit monitoring services. A quick internet search finds a credit monitoring company with a convincing name: Credit Under Lock and Key (CRUDLOK). Your sales rep has never handled a contract for 2000 people, but develops a proposal in about a day which says CRUDLOK will:
* 1.Send an enrollment invitation to everyone the day after the contract is signed.
* 2.Enroll someone with just their first name and the last-4 of their national identifier.
* 3.Monitor each enrollee’s credit for two years from the date of enrollment.
* 4. Send a monthly email with their credit rating and offers for credit-related services at market rates.
* 5.Charge your company 20% of the cost of any credit restoration.
You execute the contract and the enrollment invitations are emailed to the 2000 individuals. Three days later you sit down and document all that went well and all that could have gone better. You put it in a file to reference the next time an incident occurs.
Regarding the notification, which of the following would be the greatest concern?

• A. Informing the affected individuals that data from other individuals may have also been affected.
• B. Collecting more personally identifiable information than necessary to provide updates to the affected individuals.
• C. Using a postcard with the logo of the vendor who make the mistake instead of your company’s logo.
• D. Trusting a vendor to send out a notice when they already failed once by not encrypting the database.

Answer: D

NEW QUESTION 3
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
Which is the best way to ensure that data on personal equipment is protected?

• A. User risk training.
• B. Biometric security.
• C. Encryption of the data.
• D. Frequent data backups.

Answer: A

NEW QUESTION 4
Which is TRUE about the scope and authority of data protection oversight authorities?

• A. The Office of the Privacy Commissioner (OPC) of Canada has the right to impose financial sanctions on violators.
• B. All authority in the European Union rests with the Data Protection Commission (DPC).
• C. No one agency officially oversees the enforcement of privacy regulations in the United States.
• D. The Asia-Pacific Economic Cooperation (APEC) Privacy Frameworks require all member nations to designate a national data protection authority.

Answer: A

NEW QUESTION 5
All of the following changes will likely trigger a data inventory update EXCEPT?

• A. Outsourcing the Customer Relationship Management (CRM) function.
• B. Acquisition of a new subsidiary.
• C. Onboarding of a new vendor.
• D. Passage of a new privacy regulation.

Answer: A

NEW QUESTION 6
What is the name for the privacy strategy model that describes delegated decision making?

• A. De-centralized.
• B. De-functionalized.
• C. Hybrid.
• D. Matrix.

Answer: A

NEW QUESTION 7
SCENARIO
Please use the following to answer the next QUESTION:
Natalia, CFO of the Nationwide Grill restaurant chain, had never seen her fellow executives so anxious. Last week, a data processing firm used by the company reported that its system may have been hacked, and customer data such as names, addresses, and birthdays may have been compromised. Although the attempt was proven unsuccessful, the scare has prompted several Nationwide Grill executives to Question the company's privacy program at today's meeting.
Alice, a vice president, said that the incident could have opened the door to lawsuits, potentially damaging Nationwide Grill's market position. The Chief Information Officer (CIO), Brendan, tried to assure her that even if there had been an actual breach, the chances of a successful suit against the company were slim. But Alice remained unconvinced.
Spencer – a former CEO and currently a senior advisor – said that he had always warned against the use of contractors for data processing. At the very least, he argued, they should be held contractually liable for telling customers about any security incidents. In his view, Nationwide Grill should not be forced to soil the company name for a problem it did not cause.
One of the business development (BD) executives, Haley, then spoke, imploring everyone to see reason. "Breaches can happen, despite organizations' best efforts," she remarked. "Reasonable preparedness is key." She reminded everyone of the incident seven years ago when the large grocery chain Tinkerton's had its financial information compromised after a large order of Nationwide Grill frozen dinners. As a long-time BD executive with a solid understanding of Tinkerton's's corporate culture, built up through many years of cultivating relationships, Haley was able to successfully manage the company's incident response.
Spencer replied that acting with reason means allowing security to be handled by the security functions within the company – not BD staff. In a similar way, he said, Human Resources (HR) needs to do a better job training employees to prevent incidents. He pointed out that Nationwide Grill employees are overwhelmed with posters, emails, and memos from both HR and the ethics department related to the company's privacy program. Both the volume and the duplication of information means that it is often ignored altogether.
Spencer said, "The company needs to dedicate itself to its privacy program and set regular in-person trainings for all staff once a month."
Alice responded that the suggestion, while well-meaning, is not practical. With many locations, local HR departments need to have flexibility with their training schedules. Silently, Natalia agreed.
Based on the scenario, Nationwide Grill needs to create better employee awareness of the company's privacy program by doing what?

• A. Varying the modes of communication.
• B. Communicating to the staff more often.
• C. Improving inter-departmental cooperation.
• D. Requiring acknowledgment of company memos.

Answer: D

NEW QUESTION 8
Under which circumstances would people who work in human resources be considered a secondary audience for privacy metrics?

• A. They do not receive training on privacy issues
• B. They do not interface with the financial office
• C. They do not have privacy policy as their main task
• D. They do not have frequent interactions with the public

Answer: C

NEW QUESTION 9
What United States federal law requires financial institutions to declare their personal data collection practices?

• A. The Kennedy-Hatch Disclosure Act of 1997.
• B. The Gramm-Leach-Bliley Act of 1999.
• C. SUPCLA, or the federal Superprivacy Act of 2001.
• D. The Financial Portability and Accountability Act of 2006.

Answer: B

NEW QUESTION 10
Which is NOT an influence on the privacy environment external to an organization?

• A. Management team priorities.
• B. Regulations.
• C. Consumer demand.
• D. Technological advances.

Answer: C

NEW QUESTION 11
SCENARIO
Please use the following to answer the next QUESTION:
You lead the privacy office for a company that handles information from individuals living in several countries throughout Europe and the Americas. You begin that morning’s privacy review when a contracts officer sends you a message asking for a phone call. The message lacks clarity and detail, but you presume that data was lost.
When you contact the contracts officer, he tells you that he received a letter in the mail from a vendor stating that the vendor improperly shared information about your customers. He called the vendor and confirmed that your company recently surveyed exactly 2000 individuals about their most recent healthcare experience and sent those surveys to the vendor to transcribe it into a database, but the vendor forgot to encrypt the database as promised in the contract. As a result, the vendor has lost control of the data.
The vendor is extremely apologetic and offers to take responsibility for sending out the notifications. They tell you they set aside 2000 stamped postcards because that should reduce the time it takes to get the notice in the mail. One side is limited to their logo, but the other side is blank and they will accept whatever you want to write. You put their offer on hold and begin to develop the text around the space constraints. You are content to let the vendor’s logo be associated with the notification.
The notification explains that your company recently hired a vendor to store information about their most recent experience at St. Sebastian Hospital’s Clinic for Infectious Diseases. The vendor did not encrypt the information and no longer has control of it. All 2000 affected individuals are invited to sign-up for email notifications about their information. They simply need to go to your company’s website and watch a quick advertisement, then provide their name, email address, and month and year of birth.
You email the incident-response council for their buy-in before 9 a.m. If anything goes wrong in this situation, you want to diffuse the blame across your colleagues. Over the next eight hours, everyone emails their comments back and forth. The consultant who leads the incident-response team notes that it is his first day with the company, but he has been in other industries for 45 years and will do his best. One of the three lawyers on the council causes the conversation to veer off course, but it eventually gets back on track. At the end of the day, they vote to proceed with the notification you wrote and use the vendor’s postcards.
Shortly after the vendor mails the postcards, you learn the data was on a server that was stolen, and make the decision to have your company offer credit monitoring services. A quick internet search finds a credit monitoring company with a convincing name: Credit Under Lock and Key (CRUDLOK). Your sales rep has never handled a contract for 2000 people, but develops a proposal in about a day which says CRUDLOK will:
* 1. Send an enrollment invitation to everyone the day after the contract is signed.
* 2. Enroll someone with just their first name and the last-4 of their national identifier.
* 3.Monitor each enrollee’s credit for two years from the date of enrollment.
* 4. Send a monthly email with their credit rating and offers for credit-related services at market rates.
* 5.Charge your company 20% of the cost of any credit restoration.
You execute the contract and the enrollment invitations are emailed to the 2000 individuals. Three days later you sit down and document all that went well and all that could have gone better. You put it in a file to reference the next time an incident occurs.
What is the most concerning limitation of the incident-response council?

• A. You convened it to diffuse blame
• B. The council has an overabundance of attorneys
• C. It takes eight hours of emails to come to a decision
• D. The leader just joined the company as a consultant

Answer: A

NEW QUESTION 12
SCENARIO
Please use the following to answer the next QUESTION:
As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others in the data storage industry may note in their own program development.
You started the program at Consolidated from a jumbled mix of policies and procedures and worked toward coherence across departments and throughout operations. You were aided along the way by the program's sponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understanding of the need for change.
Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among both the executive team and frontline personnel working with data and interfacing with clients. Through the use of metrics that showed the costs not only of the breaches that had occurred, but also projections of the costs that easily could occur given the current state of operations, you soon had the leaders and key decision-makers largely on your side. Many of the other employees were more resistant, but face-to-face meetings with each department and the development of a baseline privacy training program achieved sufficient "buy-in" to begin putting the proper procedures into place.
Now, privacy protection is an accepted component of all current operations involving personal or protected data and must be part of the end product of any process of technological development. While your approach is not systematic, it is fairly effective.
You are left contemplating:
What must be done to maintain the program and develop it beyond just a data breach prevention program? How can you build on your success?
What are the next action steps?
What practice would afford the Director the most rigorous way to check on the program's compliance with laws, regulations and industry best practices?

• A. Auditing.
• B. Monitoring.
• C. Assessment.
• D. Forensics.

Answer: B

NEW QUESTION 13
Which of the following is TRUE about a PIA (Privacy Impact Analysis)?

• A. Any project that involves the use of personal data requires a PIA
• B. A Data Protection Impact Analysis (DPIA) process includes a PIA
• C. The PIA must be conducted at the early stages of the project lifecycle
• D. The results from a previous information audit can be leveraged in a PIA process

Answer: A

NEW QUESTION 14
What is one obligation that the General Data Protection Regulation (GDPR) imposes on data processors?

• A. To honor all data access requests from data subjects.
• B. To inform data subjects about the identity and contact details of the controller.
• C. To implement appropriate technical and organizational measures that ensure an appropriate level of security.
• D. To carry out data protection impact assessments in cases where processing is likely to result in high risk to the rights and freedoms of individuals.

Answer: D

NEW QUESTION 15
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
What should you do first to ascertain additional information about the loss of data?

• A. Interview the person reporting the incident following a standard protocol.
• B. Call the police to investigate even if you are unsure a crime occurred.
• C. Investigate the background of the person reporting the incident.
• D. Check company records of the latest backups to see what data may be recoverable.

Answer: A

NEW QUESTION 16
SCENARIO
Please use the following to answer the next QUESTION:
As they company’s new chief executive officer, Thomas Goddard wants to be known as a leader in data protection. Goddard recently served as the chief financial officer of Hoopy.com, a pioneer in online video viewing with millions of users around the world. Unfortunately, Hoopy is infamous within privacy protection
circles for its ethically Questionable practices, including unauthorized sales of personal data to marketers. Hoopy also was the target of credit card data theft that made headlines around the world, as at least two million credit card numbers were thought to have been pilfered despite the company’s claims that “appropriate” data protection safeguards were in place. The scandal affected the company’s business as competitors were quick to market an increased level of protection while offering similar entertainment and media content. Within three weeks after the scandal broke, Hoopy founder and CEO Maxwell Martin, Goddard’s mentor, was forced to step down.
Goddard, however, seems to have landed on his feet, securing the CEO position at your company, Medialite, which is just emerging from its start-up phase. He sold the company’s board and investors on his vision of Medialite building its brand partly on the basis of industry-leading data protection standards and procedures. He may have been a key part of a lapsed or even rogue organization in matters of privacy but now he claims to be reformed and a true believer in privacy protection. In his first week on the job, he calls you into his office and explains that your primary work responsibility is to bring his vision for privacy to life. But you also detect some reservations. “We want Medialite to have absolutely the highest standards,” he says. “In fact, I want us to be able to say that we are the clear industry leader in privacy and data protection. However, I also need to be a responsible steward of the company’s finances. So, while I want the best solutions across the board, they also need to be cost effective.”
You are told to report back in a week’s time with your recommendations. Charged with this ambiguous mission, you depart the executive suite, already considering your next steps.
The company has achieved a level of privacy protection that established new best practices for the industry. What is a logical next step to help ensure a high level of protection?

• A. Brainstorm methods for developing an enhanced privacy framework
• B. Develop a strong marketing strategy to communicate the company’s privacy practices
• C. Focus on improving the incident response plan in preparation for any breaks in protection
• D. Shift attention to privacy for emerging technologies as the company begins to use them

Answer: C

NEW QUESTION 17
......