68 free IAPP CIPP/US practice questions from the CertStash pack of 272, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 68 free here, all 285 in the pack, and each step includes the one before it.
Get all 285 questions (US$39) · Download the first 10 as a PDF
Question 1
According to the FTC Report of 2012, what is the main goal of Privacy by Design?
Show answer and explanation
Correct answer: C. Incorporating privacy protections throughout the development process
According to the FTC's 2012 report on Privacy by Design, the main goal is to incorporate privacy protections throughout the entire development and operational process of products and services, rather than adding privacy as an afterthought. This proactive approach embeds privacy considerations into every stage of design and deployment.
Why the other options are wrong
- A. While consent is important, it is not the main goal of Privacy by Design; the focus is on building privacy into processes.
- B. Self-regulatory codes for mobile services are not the primary goal of Privacy by Design.
- D. Standardizing privacy notices is a communication tool, not the main goal of the Privacy by Design framework.
Question 2
What is the main reason some supporters of the European approach to privacy are skeptical about self-regulation of privacy practices?
Show answer and explanation
Correct answer: B. Industries may not be strict enough in the creation and enforcement of rules
European privacy advocates are skeptical of industry self-regulation because they believe that industries may not enforce their own rules strictly enough and may prioritize business interests over consumer privacy protection. Without external regulatory oversight and enforcement mechanisms, industries might create rules that are too lenient or fail to apply them consistently.
Why the other options are wrong
- A. Technology and security costs are not the primary concern about self-regulation effectiveness.
- C. New business owner understanding relates to regulatory clarity, not the skepticism about self-regulation's enforcement.
- D. Human rights and privacy are complementary concepts in the European framework, not in conflict.
Question 3
What is the main purpose of the Global Privacy Enforcement Network?
Show answer and explanation
Correct answer: A. To promote universal cooperation among privacy authorities
The Global Privacy Enforcement Network (GPEN) is a cooperative organization of international privacy authorities established to promote coordination, cooperation, and information sharing among privacy regulators across different countries and jurisdictions, enabling them to work together on privacy enforcement issues.
Why the other options are wrong
- B. While GPEN members may investigate violations, international investigation cooperation is not its primary stated purpose.
- C. GPEN represents privacy authorities and governments, not consumer advocacy groups.
- D. GPEN promotes cooperation rather than arbitrating jurisdictional disputes between countries.
Question 4
In 2014, Google was alleged to have violated the Family Educational Rights and Privacy Act (FERPA) through its Apps for Education suite of tools. For what specific practice did students sue the company?
Show answer and explanation
Correct answer: A. Scanning emails sent to and received by students
In the 2014 lawsuit against Google regarding its Apps for Education suite, students alleged that Google violated FERPA by scanning emails sent to and received by students and using that email content for targeted advertising purposes, without proper authorization to access education records for such purposes.
Why the other options are wrong
- B. The issue was not about making records publicly available, but about unauthorized scanning.
- C. The problem was not reliance on verbal consent but rather the unauthorized use of email data.
- D. While technically records were accessed, the specific violation alleged was the scanning practice for advertising purposes.
Question 5
Which venture would be subject to the requirements of Section 5 of the Federal Trade Commission Act?
Show answer and explanation
Correct answer: B. An online merchant’s free shipping offer
Section 5 of the FTC Act applies to unfair or deceptive practices in commerce affecting consumers. An online merchant's free shipping offer, conducted in interstate commerce, would be subject to Section 5 requirements to ensure the offer is truthful and not deceptive. Online merchants engaged in commerce are clearly within FTC jurisdiction.
Why the other options are wrong
- A. A local nonprofit charity's fundraiser may be exempt from FTC jurisdiction due to nonprofit status and limited scope.
- C. National banks are regulated by banking authorities (OCC, Federal Reserve), not primarily by the FTC under Section 5.
- D. A city bus system's frequent rider program involves a government entity with limited interstate commerce implications, likely outside FTC jurisdiction.
Question 6
Which jurisdiction must courts have in order to hear a particular case?
Show answer and explanation
Correct answer: C. Personal jurisdiction and subject matter jurisdiction
For a court to hear a case, it must have both personal jurisdiction (authority over the parties involved) and subject matter jurisdiction (authority over the type of case being heard). Personal jurisdiction ensures the court can bind the parties, while subject matter jurisdiction ensures the court has authority to decide that category of legal dispute. These two forms of jurisdiction are the foundational requirements under U.S. law.
Why the other options are wrong
- A. Regulatory jurisdiction is not a standard requirement for courts to hear cases.
- B. Professional jurisdiction is not a formal jurisdictional requirement in civil procedure.
- D. Neither personal nor professional jurisdiction is a standard pairing of court requirements.
Question 7
Which authority supervises and enforces laws regarding advertising to children via the Internet?
Show answer and explanation
Correct answer: B. The Federal Trade Commission
The Federal Trade Commission (FTC) has primary authority to supervise and enforce laws regarding advertising practices, including advertising directed at children. The FTC enforces the Children's Online Privacy Protection Act (COPPA) and other regulations governing how companies collect and use data from children online, making it the correct federal authority for this jurisdiction.
Why the other options are wrong
- A. The Office for Civil Rights focuses on civil rights compliance in education and health, not consumer advertising.
- C. The Federal Communications Commission regulates broadcast and telecommunications, not consumer protection advertising.
- D. The Department of Homeland Security handles national security and immigration matters, not consumer advertising.
Question 8
According to Section 5 of the FTC Act, self-regulation primarily involves a company’s right to do what?
Show answer and explanation
Correct answer: C. Adhere to its industry’s code of conduct
Section 5 of the FTC Act encourages industry self-regulation, which primarily involves companies adhering to their industry's established codes of conduct. Self-regulation allows industries to set standards and best practices that members follow voluntarily, promoting consumer protection through internal industry standards rather than solely through government enforcement.
Why the other options are wrong
- A. Determining which bodies will be involved in adjudication is a matter of legal procedure, not the primary purpose of self-regulation.
- B. Deciding whether enforcement actions are justified is a governmental function, not a company's right under self-regulation.
- D. Appealing decisions is a legal remedy, not the core principle of self-regulation.
Question 9
Which was NOT one of the five priority areas listed by the Federal Trade Commission in its 2012 report, “Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers”?
Show answer and explanation
Correct answer: A. International data transfers
The FTC's 2012 report identified five priority areas for privacy protection, which included large platform providers, promoting enforceable self-regulatory codes, Do Not Track mechanisms, and others, but international data transfers was not listed as one of the five primary priorities in that specific report.
Why the other options are wrong
- B. Large platform providers was explicitly identified as a priority area in the 2012 FTC report.
- C. Promoting enforceable self-regulatory codes was identified as a priority area in the report.
- D. Do Not Track was identified as one of the priority areas in the FTC's 2012 privacy recommendations.
Question 10
The “Consumer Privacy Bill of Rights” presented in a 2012 Obama administration report is generally based on?
Show answer and explanation
Correct answer: D. Traditional fair information practices
The 2012 Consumer Privacy Bill of Rights presented by the Obama administration was generally based on traditional fair information practices, which are foundational privacy principles developed over decades including notice, choice, access, security, and accountability. These principles form the backbone of privacy frameworks in the United States.
Why the other options are wrong
- A. While the 1974 Privacy Act influenced privacy law, the Bill of Rights was based on broader fair information practices rather than that specific statute.
- B. Common law principles provided some historical foundation, but the Bill of Rights was grounded in established fair information practices.
- C. Although the EU Directive influenced global privacy discussions, the U.S. Bill of Rights was based on American fair information practices, not EU directives.
Question 11
An organization self-certified under Privacy Shield must, upon request by an individual, do what?
Show answer and explanation
Correct answer: B. Provide the identities of third parties with whom the organization shares personal information.
Under Privacy Shield, organizations must provide individuals with the identities of third parties with whom personal information is shared upon request. This transparency requirement ensures individuals can understand how their data is being distributed and to whom. Option A is incorrect because suspending all use would violate the purpose limitation principle in a manner inconsistent with Privacy Shield obligations. Option C incorrectly adds "fourth parties" which is not a standard Privacy Shield requirement. Option D regarding criminal investigations is outside the scope of Privacy Shield individual access rights.
Why the other options are wrong
- A. Privacy Shield does not require complete suspension of data use; it requires transparency about sharing practices.
- C. Privacy Shield requirements address third-party sharing disclosure, not speculative fourth-party recipients.
- D. Criminal investigation disclosures are governed by other legal frameworks, not Privacy Shield individual request obligations.
Question 12
Why was the Privacy Protection Act of 1980 drafted?
Show answer and explanation
Correct answer: A. To respond to police searches of newspaper facilities
The Privacy Protection Act of 1980 was drafted in direct response to police searches of newspaper offices and media facilities. The Act was prompted by concerns about law enforcement conducting searches of newsrooms and journalists' files without proper legal process, which threatened press freedom and journalistic privilege. The Act restricts law enforcement's ability to search for and seize materials held by persons engaged in public communication and limits the government's ability to search newspaper facilities and journalist records without appropriate judicial process.
Why the other options are wrong
- B. The Act does not assist prosecutors in civil litigation against newspapers; it protects against government searches.
- C. The Act was not drafted to address white-collar crime prosecution generally.
- D. While the Act protects privacy, it was specifically motivated by police searches of media facilities, not general personal privacy invasion.
Question 13
What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?
Show answer and explanation
Correct answer: D. Offer an Opt-Out before transferring PI to an unaffiliated third party for the latter’s own use
The Gramm-Leach-Bliley Act requires financial institutions to provide consumers with an opt-out notice before disclosing personal information to unaffiliated third parties for their own use. This opt-out mechanism is a core privacy protection under GLBA, allowing consumers to prevent their information from being shared with external parties engaged in independent business activities.
Why the other options are wrong
- A. Consumer surveys about satisfaction are not a GLBA requirement.
- B. Processing preference changes within a timeframe is not specifically mandated by GLBA.
- C. While telemarketing opt-out requests exist under other rules, this is not the primary GLBA requirement being tested.
Question 14
Under the Fair and Accurate Credit Transactions Act (FACTA), what is the most appropriate action for a car dealer holding a paper folder of customer credit reports?
Show answer and explanation
Correct answer: A. To follow the Disposal Rule by having the reports shredded
The FACTA Disposal Rule requires that organizations holding consumer credit reports and sensitive financial information must dispose of them securely, typically by shredding paper documents. This rule specifically addresses the proper destruction of records containing consumer information to prevent unauthorized access and identity theft.
Why the other options are wrong
- B. The Red Flags Rule addresses identity theft prevention for creditors; mailing reports to customers is not a Red Flags Rule requirement.
- C. The Privacy Rule (associated with HIPAA) applies to healthcare entities, not car dealers with credit reports, and does not specifically govern paper report storage.
- D. The Safeguards Rule addresses overall security practices but the most appropriate action for paper credit reports specifically is destruction under the Disposal Rule, not transfer to electronic files.
Question 15
What is a legal document approved by a judge that formalizes an agreement between a governmental agency and an adverse party called?
Show answer and explanation
Correct answer: A. A consent decree
A consent decree is a legal document approved by a judge that formalizes an agreement between a governmental agency and an adverse party, typically resolving a dispute without requiring the party to admit wrongdoing. It is commonly used in FTC enforcement actions to establish obligations and remedies.
Why the other options are wrong
- B. Stare decisis decree is not a recognized legal term; stare decisis is a principle of precedent.
- C. A judgment rider is an additional order attached to a judgment, not a formalized agreement between an agency and an adverse party.
- D. Common law judgment refers to decisions based on case law precedent, not specifically to formalized agreements with governmental agencies.
Question 16
Which entity within the Department of Health and Human Services (HHS) is the primary enforcer of the Health Insurance Portability and Accountability Act (HIPAA) “Privacy Rule”?
Show answer and explanation
Correct answer: A. Office for Civil Rights.
The Office for Civil Rights (OCR) within HHS is the primary enforcer of the HIPAA Privacy Rule. OCR investigates complaints, conducts audits, and enforces compliance with HIPAA's privacy and security requirements for covered entities and business associates. This is explicitly defined in HIPAA regulations and HHS organizational structure.
Why the other options are wrong
- B. The Office of Social Services does not exist as a formal HHS entity and has no HIPAA enforcement role.
- C. The Office of Inspector General has audit and investigative authority but is not the primary Privacy Rule enforcer; that responsibility belongs to OCR.
- D. The Office of Public Health and Safety is not a recognized HHS enforcement entity for HIPAA compliance.
Question 17
A large online bookseller decides to contract with a vendor to manage Personal Information (PI). What is the least important factor for the company to consider when selecting the vendor?
Show answer and explanation
Correct answer: C. The vendor’s employee retention rates
When selecting a vendor to manage Personal Information, the company must evaluate factors that directly impact data security and compliance. The vendor's reputation, financial health, and employee training programs are all critical, a financially unstable vendor may go out of business and mishandle data, poor training leads to breaches, and reputation reflects track record. Employee retention rates, while relevant to business continuity, are the least direct indicator of the vendor's capability to protect personal information compared to these other factors.
Why the other options are wrong
- A. Vendor reputation directly reflects their history of protecting customer data.
- B. Financial health is critical, a failing vendor may mishandle or abandon data.
- D. Employee training programs are essential for preventing security breaches and privacy violations.
Question 18
What role does the U.S. Constitution play in the area of workplace privacy?
Show answer and explanation
Correct answer: D. It provides significant protections to federal and state governments, but not to private-sector employment
The U.S. Constitution, through the Fourth Amendment and Due Process Clause, provides significant protections against unreasonable searches and seizures primarily for federal and state government employees and actions. However, the Constitution does not directly apply to private-sector employment because it constrains state action, not private conduct. Private employers are not bound by constitutional protections in the same way, though they must comply with statutory privacy laws like ECPA and state privacy statutes.
Why the other options are wrong
- A. The Constitution does not differentiate enforcement resources based on employer size; its applicability depends on whether the employer is a state actor, not business scale.
- B. The Constitution does not provide a framework specifically for physical versus electronic security; this distinction comes from statutory law like ECPA, not constitutional interpretation.
- C. Constitutional protections for employees are not limited to union members; at-will employees also have certain constitutional rights when government employment is involved.
Question 19
California’s SB 1386 was the first law of its type in the United States to do what?
Show answer and explanation
Correct answer: A. Require commercial entities to disclose a security data breach concerning personal information about the state’s residents
California's SB 1386, enacted in 2003, was the first law in the United States to require commercial entities to disclose security breaches involving personal information of California residents. This landmark legislation established the precedent for data breach notification laws that subsequently spread to other states and became a standard requirement in U.S. privacy regulation.
Why the other options are wrong
- B. SB 1386 focused on California residents; notification requirements for non-residents were not the primary innovation.
- C. The law did not specifically mandate encryption of Internet-connected servers as a primary requirement.
- D. The law did not create a mechanism for state attorney general enforcement of federal trade practice regulations.
Question 20
What practice do courts commonly require in order to protect certain personal information on documents, whether paper or electronic, that is involved in litigation?
Show answer and explanation
Correct answer: A. Redaction
Redaction is the standard court-required practice to protect sensitive personal information in documents involved in litigation. Redaction involves obscuring or removing specific information from documents while keeping the documents themselves available for discovery. This balances the need for transparency in litigation with the protection of sensitive data like Social Security numbers, financial information, or health records. Encryption, deletion, and hashing are not typical court-mandated practices for this purpose because they either prevent access entirely or irreversibly modify documents.
Why the other options are wrong
- B. Encryption is not a standard court requirement as it may prevent authorized access to documents.
- C. Deletion is not permitted in litigation as it destroys evidence and violates discovery obligations.
- D. Hashing irreversibly transforms data and is not used for document protection in litigation contexts.
Question 21
When does the Telemarketing Sales Rule require an entity to share a do-not-call request across its organization?
Show answer and explanation
Correct answer: B. When the goods and services sold by its divisions are very similar
The Telemarketing Sales Rule requires entities to share do-not-call requests across their organization when the divisions sell very similar goods and services. This ensures consumers receive consistent protection against unwanted calls across related business lines, preventing circumvention of do-not-call lists through organizational structures that sell substantially the same offerings.
Why the other options are wrong
- A. Transparency of operational structures is not the determining factor for sharing do-not-call requests.
- C. Whether a call resulted from an error does not determine when sharing must occur; sharing requirements are based on business structure and product similarity.
- D. Multiple platforms for managing preferences do not automatically require sharing; the determination depends on the similarity of goods and services sold.
Question 22
Under state breach notification laws, which is NOT typically included in the definition of personal information?
Show answer and explanation
Correct answer: D. Medical information
Medical information is not typically included in the standard definition of personal information under most state breach notification laws. Personal information definitions typically focus on identifiers and financial information (state ID numbers, names, Social Security numbers) that enable identity theft or fraud. Medical information is often treated separately under HIPAA and other specialized health privacy regulations rather than general breach notification statutes.
Why the other options are wrong
- A. State identification numbers are typically included in definitions of personal information.
- B. First and last names are core components of personal information definitions.
- C. Social Security numbers are universally included in personal information definitions.
Question 23
SCENARIO Please use the following to answer the next question: You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth’s security measures. A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals, ones that exposed the PHI of public figures including celebrities and politicians. During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected. A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual’s ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient’s attorney has submitted a discovery request for the ePHI exposed in the breach. What is the most significant reason that the U.S. Department of Health and Human Services (HHS) might impose a penalty on HealthCo?
Show answer and explanation
Correct answer: B. Because HealthCo did not conduct due diligence to verify or monitor CloudHealth’s security measures
HIPAA requires covered entities to exercise reasonable diligence and oversight of their business associates' security practices. HealthCo's failure to conduct due diligence before contracting with CloudHealth and its failure to audit CloudHealth's ongoing security measures represents a direct breach of this obligation. While CloudHealth's failure to encrypt data is also problematic, HealthCo's primary liability stems from its negligence in not verifying or monitoring whether CloudHealth was meeting its contractual and regulatory obligations.
Why the other options are wrong
- A. Physical and administrative safeguards are important, but HealthCo's main failure was not requiring specific safeguards, it was failing to verify that required safeguards were actually implemented.
- C. HIPAA does not mandate automatic fines based solely on breach magnitude; penalties depend on the level of negligence or willfulness demonstrated by the covered entity.
- D. While CloudHealth's contract violation is relevant, HealthCo as the covered entity bears responsibility for ensuring its business associate complies; HealthCo's due diligence failure is the primary enforcement issue.
Question 24
SCENARIO Please use the following to answer the next question: You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth’s security measures. A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals, ones that exposed the PHI of public figures including celebrities and politicians. During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected. A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual’s ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient’s attorney has submitted a discovery request for the ePHI exposed in the breach. Which of the following would be HealthCo’s best response to the attorney’s discovery request?
Show answer and explanation
Correct answer: B. Respond with a request for satisfactory assurances such as a qualified protective order
When responding to a discovery request for protected health information in litigation, HIPAA permits disclosure but requires the responding party to request satisfactory assurances, typically through a qualified protective order (QPO). This legal mechanism protects patient privacy while allowing the litigation to proceed by limiting use of the disclosed information to the legal proceedings. Rather than blanket rejection or unprotected disclosure, a request for a protective order balances legal obligations with privacy protections.
Why the other options are wrong
- A. While HIPAA does restrict disclosures, it permits disclosure in response to legal process such as discovery requests when appropriate safeguards are established.
- C. Turning over all compromised records without seeking protective measures violates the principle of minimum necessary disclosure and fails to obtain privacy protections.
- D. Responding with only the plaintiff's records contradicts the discovery process, which typically requires production of all responsive materials; a protective order applies to all disclosed information.
Question 25
What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH)?
Show answer and explanation
Correct answer: A. Make electronic health records (EHRs) part of regular care
The HITECH Act provides financial incentives (meaningful use payments) to healthcare providers who adopt certified electronic health records and demonstrate meaningful use. Making EHRs part of regular clinical care is the core requirement for qualifying for HITECH funds, as the legislation was designed to promote EHR adoption and use across the healthcare industry.
Why the other options are wrong
- B. Billing electronically is not the focus of HITECH funding; the act specifically targets clinical adoption and meaningful use of EHRs.
- C. While electronic communication is beneficial, HITECH funding is conditioned on using EHRs in clinical care, not just for patient communications.
- D. Keeping updates about HIPAA is a general compliance matter unrelated to HITECH funding qualification requirements.
Question 26
Which of the following is NOT a principle found in the APEC Privacy Framework?
Show answer and explanation
Correct answer: D. Privacy by Design.
Privacy by Design is not a principle found in the APEC Privacy Framework. The APEC framework includes principles such as Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, Individual Participation, Accountability, and Preventing Harm. Privacy by Design is a more recent concept popularized by privacy scholars and found in frameworks like GDPR and Canadian regulations, but it is not part of the original APEC Privacy Framework.
Why the other options are wrong
- A. Integrity of Personal Information (as part of accuracy and quality) is a recognized APEC principle.
- B. Access and Correction are core APEC Privacy Framework principles.
- C. Preventing Harm is an explicit principle in the APEC Privacy Framework.
Question 27
In which situation is a company operating under the assumption of implied consent?
Show answer and explanation
Correct answer: A. An employer contacts the professional references provided on an applicant’s resume
Implied consent is when consent is reasonably inferred from the action or context without explicit permission being asked. When an applicant lists professional references on a resume, they implicitly consent to the employer contacting those references, the act of providing the references communicates permission. In contrast, automatically subscribing customers (B) requires explicit opt-in, a completed rental application (C) is explicit consent through the form itself, and asking for a zip code (D) seeks express consent before collection.
Why the other options are wrong
- B. Auto-enrollment to email lists violates consent requirements and typically requires explicit opt-in.
- C. Information provided on a completed application represents explicit consent, not implied.
- D. Asking the customer directly is seeking express consent, not operating under implied consent.
Question 28
In what way does the “Red Flags Rule” under the Fair and Accurate Credit Transactions Act (FACTA) relate to the owner of a grocery store who uses a money wire service?
Show answer and explanation
Correct answer: D. It does not apply because the owner is not a creditor
The Red Flags Rule under FACTA applies to creditors and financial institutions that extend credit. A grocery store owner using a money wire service is providing a payment transmission service, not extending credit. Since the grocery store is not a creditor offering credit products or services, the Red Flags Rule does not apply to their operations, even if they use a wire service for transactions.
Why the other options are wrong
- A. While technology updates may be good practice, the Red Flags Rule does not mandate updated technology for this business model.
- B. An identity theft warning system requirement does not apply to businesses that are not creditors under FACTA.
- C. Enforcement status of FACTA rules is not the determining factor for whether a rule applies; applicability depends on the business category.
Question 29
SCENARIO Please use the following to answer the next question: Matt went into his son’s bedroom one evening and found him stretched out on his bed typing on his laptop. “Doing your homework?” Matt asked hopefully. “No,” the boy said. “I’m filling out a survey.” Matt looked over his son’s shoulder at his computer screen. “What kind of survey?” “It’s asking questions about my opinions.” “Let me see,” Matt said, and began reading the list of questions that his son had already answered. “It’s asking your opinions about the government and citizenship. That’s a little odd. You’re only ten.” Matt wondered how the web link to the survey had ended up in his son’s email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders. To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer questions about his favorite games and toys. Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son’s inbox, and he decided it was time to report the incident to the proper authorities. How could the marketer have best changed its privacy management program to meet COPPA “Safe Harbor” requirements?
Show answer and explanation
Correct answer: C. By participating in an approved self-regulatory program
COPPA Safe Harbor requirements allow companies to demonstrate compliance by participating in an approved self-regulatory program that has been vetted by the FTC. These programs establish and enforce standards for protecting children's privacy online. By joining such a program, the marketer would have access to established best practices, regular audits, and certification that their privacy management meets COPPA standards, which is the primary mechanism for achieving Safe Harbor status.
Why the other options are wrong
- A. FTC approval of email content does not constitute Safe Harbor compliance; Safe Harbor is specifically about participating in approved self-regulatory organizations.
- B. Making a privacy notice available is a baseline COPPA requirement, not the Safe Harbor mechanism, which requires third-party verification through self-regulatory programs.
- D. Assessing security risks addresses data protection but does not satisfy Safe Harbor requirements, which specifically mandate participation in approved self-regulatory programs.
Question 30
Which of the following best describes private-sector workplace monitoring in the United States?
Show answer and explanation
Correct answer: A. Employers have broad authority to monitor their employees
Private-sector employers in the United States have broad authority to monitor their employees' workplace communications and activities. Absent specific statutory restrictions (such as the Wiretap Act's ordinary course of business limitations), union protections, or state-law constraints, employers may monitor emails, phone calls, internet usage, and other workplace conduct. This monitoring authority is one of the defining characteristics of private employment, where constitutional protections do not apply and employers retain significant control over workplace activities and communications.
Why the other options are wrong
- B. Federal law does not restrict monitoring only to necessary industries; rather, most monitoring is permitted unless specifically prohibited by statute or contract.
- C. While some private lawsuits have addressed monitoring practices, there has been no widespread judicial restriction comparable to what this option suggests.
- D. The U.S. Constitution does not protect private-sector employees from employer monitoring; constitutional protections apply only to government action.
Question 31
Sarah lives in San Francisco, California. Based on a dramatic increase in unsolicited commercial emails, Sarah believes that a major social media platform with over 50 million users has collected a lot of personal information about her. The company that runs the platform is based in New York and France. Why is Sarah entitled to ask the social media platform to delete the personal information they have collected about her?
Show answer and explanation
Correct answer: C. The California Consumer Privacy Act entitles Sarah to request deletion of her personal information.
The California Consumer Privacy Act explicitly grants California residents the right to request deletion of personal information collected from them, and businesses must comply with such requests subject to specified exceptions. Sarah, a California resident, is entitled to request deletion under CCPA's consumer rights provisions. While option A references GDPR's broader global reach and option B references FTC enforcement authority, CCPA is the most direct and applicable statute for Sarah's situation. Option D incorrectly references the SHIELD Act, which is primarily a cybersecurity law, not a deletion rights statute.
Why the other options are wrong
- A. GDPR applies primarily to EU residents and entities processing their data; CCPA is the applicable law for California residents.
- B. While FTC enforcement exists, CCPA is the specific statute granting Sarah deletion rights.
- D. The New York SHIELD Act focuses on data security and breach notification, not mandatory deletion upon request.
Question 32
Which of the following does Title VII of the Civil Rights Act prohibit an employer from asking a job applicant?
Show answer and explanation
Correct answer: C. Questions about national origin
Title VII of the Civil Rights Act prohibits discrimination based on protected classes including race, color, religion, sex, and national origin. Questions about national origin are therefore prohibited during hiring processes. While age discrimination (covered by ADEA), disability (covered by ADA), and pregnancy discrimination (covered by PDA) are also prohibited, these are addressed by separate federal statutes, not Title VII itself.
Why the other options are wrong
- A. Age discrimination is prohibited under the Age Discrimination in Employment Act (ADEA), not Title VII.
- B. Disability-related questions are restricted under the Americans with Disabilities Act (ADA), not Title VII.
- D. Pregnancy discrimination questions are prohibited under the Pregnancy Discrimination Act (PDA), not Title VII.
Question 33
Which of the following describes the most likely risk for a company developing a privacy policy with standards that are much higher than its competitors?
Show answer and explanation
Correct answer: A. Being more closely scrutinized for any breaches of policy
A company with significantly higher privacy standards than competitors creates an elevated expectation and increased scrutiny. If such a company experiences any breach or policy violation, it will face disproportionate criticism and regulatory attention because it publicly committed to higher standards. This creates reputational and enforcement risk. The other options do not logically follow from having higher standards: discriminatory practices allegations require differential treatment (not applying high standards uniformly), auditor skepticism is unlikely when standards are rigorous, and security failures are independent of policy stringency.
Why the other options are wrong
- B. Higher privacy standards do not inherently lead to accusations of discrimination.
- C. Rigorous privacy standards typically satisfy rather than create skepticism from auditors.
- D. Security system failures are technical issues unrelated to policy stringency.
Question 34
What do the Civil Rights Act, Pregnancy Discrimination Act, Americans with Disabilities Act, Age Discrimination Act, and Equal Pay Act all have in common?
Show answer and explanation
Correct answer: A. They require employers not to discriminate against certain classes when employees use personal information
All five statutes listed share the common purpose of prohibiting employer discrimination against protected classes of employees based on specific personal characteristics (race, color, religion, sex, national origin, pregnancy, disability, age, or equal pay for equal work). Each law requires employers to refrain from discriminatory practices in hiring, promotion, compensation, and termination decisions affecting members of these protected classes. This prohibition against discriminatory use or consideration of personal information related to protected status is the unifying principle across all five statutes.
Why the other options are wrong
- B. While some laws like the ADA do require reasonable accommodations, the Civil Rights Act and Equal Pay Act do not impose this requirement as a universal obligation across all five statutes.
- C. These laws do not primarily function as privacy protections limiting inquiries; rather, they establish substantive anti-discrimination standards, and employers may still inquire about protected characteristics in appropriate contexts.
- D. These laws prohibit use and disclosure of personal information about protected classes, which is the opposite of what option D states.
Question 35
A student has left high school and is attending a public postsecondary institution. Under what condition may a school legally disclose educational records to the parents of the student without consent?
Show answer and explanation
Correct answer: C. If the student is still a dependent for tax purposes
Under FERPA, schools may disclose educational records to parents without student consent if the student is claimed as a dependent on the parents' tax return. This is a specific exception to the general rule that requires student consent for disclosure to parents of adult students. Age alone (option A) does not permit disclosure once a student attends postsecondary education, and neither academic suspension status (B) nor transfer applications (D) create legal exceptions for parental disclosure.
Why the other options are wrong
- A. Once a student attends postsecondary education, turning 18 does not automatically grant parents access to records without consent.
- B. Academic suspension risk is not a legal condition under FERPA that permits disclosure to parents without student consent.
- D. A transfer application does not create a FERPA exception for disclosure to parents without the student's consent.
Question 36
Most states with data breach notification laws indicate that notice to affected individuals must be sent in the “most expeditious time possible without unreasonable delay.” By contrast, which of the following states currently imposes a definite limit for notification to affected individuals?
Show answer and explanation
Correct answer: B. Florida
Florida's breach notification law currently imposes a specific, definite timeframe for notifying affected individuals, departing from the vague "most expeditious time possible without unreasonable delay" standard found in most other states. Florida's law provides a concrete deadline that organizations must meet when notifying consumers of data breaches.
Why the other options are wrong
- A. Maine uses the standard "most expeditious time possible" language without a definite deadline.
- C. New York uses the standard "most expeditious time possible" language without a definite deadline.
- D. California uses the standard "most expeditious time possible" language without a definite deadline.
Question 37
What does the Massachusetts Personal Information Security Regulation require as it relates to encryption of personal information?
Show answer and explanation
Correct answer: D. The encryption of all personal information of Massachusetts residents when stored on portable devices.
201 CMR 17.00 applies to any person that owns or licenses personal information about Massachusetts residents, wherever the business is located. It requires encryption of that personal information when it is stored on laptops or other portable devices, and when transmitted across public networks or wirelessly.
Why the other options are wrong
- A. The rule does not require encryption of all personal information based on where equipment is located.
- B. The rule protects Massachusetts residents regardless of where the company is based and does not require encrypting all stored data.
- C. The rule is not limited to Massachusetts-based companies; it covers anyone holding Massachusetts residents' data.
Question 38
Acme Student Loan Company has developed an artificial intelligence algorithm that determines whether an individual is likely to pay their bill or default. A person who is determined by the algorithm to be more likely to default will receive frequent payment reminder calls, while those who are less likely to default will not receive payment reminders. Which of the following most accurately reflects the privacy concerns with Acme Student Loan Company using artificial intelligence in this manner?
Show answer and explanation
Correct answer: A. If the algorithm uses risk factors that impact the automatic decision engine. Acme must ensure that the algorithm does not have a disparate impact on protected classes in the output.
Under fair lending laws and anti-discrimination statutes, automated decision systems, including AI algorithms, must not produce disparate impact on protected classes, regardless of whether the algorithm explicitly uses protected class information. Acme's algorithm determines treatment (frequent reminders vs. no reminders) based on predicted default risk, and this output must not have a disparate impact on protected classes like race, color, religion, sex, or national origin. The privacy concern focuses on ensuring the algorithm's automated decisions do not discriminate in practice, even if discrimination is unintentional.
Why the other options are wrong
- B. Organizations must affirmatively determine whether algorithms create disparate impact; the use of public information or lack of explicit protected class factors does not eliminate this obligation.
- C. Transparency about methodology does not provide legal justification for disparate impact on protected classes; discrimination concerns remain regardless of disclosure.
- D. The concern applies to all algorithmic decision-making with disparate impact risk, not only when the algorithm explicitly uses protected class information in its inputs.
Question 39
Read this notice: Our website uses cookies. Cookies allow us to identify the computer or device you’re using to access the site, but they don’t identify you personally. For instructions on setting your Web browser to refuse cookies, click here. What type of legal choice does not notice provide?
Show answer and explanation
Correct answer: D. Opt-out
The notice describes an opt-out scenario because it informs users that cookies are being used and provides instructions on how to refuse them if desired. Users can take action to opt out of cookie collection, meaning consent is implied unless the user actively refuses. This is an opt-out model rather than requiring affirmative consent before cookies are placed.
Why the other options are wrong
- A. The notice is not mandatory; users have a choice in whether to accept cookies.
- B. Implied consent would mean the company assumes consent without asking, but this notice explicitly instructs users how to refuse.
- C. Opt-in would require users to affirmatively agree before cookies are used; this notice uses cookies and allows refusal.
Question 40
Which of the following best describes an employer’s privacy-related responsibilities to an employee who has left the workplace?
Show answer and explanation
Correct answer: D. An employer has a responsibility to maintain the security and privacy of any sensitive employment records retained for a legitimate business purpose.
An employer's privacy responsibilities to former employees continue after employment ends. Employers must maintain reasonable security and privacy protections for sensitive employment records that are retained for legitimate business purposes, such as tax compliance, legal defense, or regulatory requirements. This balances the employer's legitimate needs with the former employee's privacy interests. Option A is incorrect because employers should not maintain system access for former employees. Option B is too broad, employers are not required to delete all records, only to protect those they retain. Option C incorrectly suggests all responsibilities terminate with employment.
Why the other options are wrong
- A. Maintaining access to systems and data for former employees creates security risks and is not a standard employer responsibility.
- B. Employers are not required to delete all employment records; they must protect records retained for legitimate purposes.
- C. Privacy responsibilities do not terminate merely because the employment relationship ends; legal duties persist regarding retained data.
Question 41
If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?
Show answer and explanation
Correct answer: B. The impact of an organizational data breach will be more severe than if the data had been segregated.
When high and low sensitivity data are stored together in the same system, a breach compromises all data regardless of classification level. This creates a more severe impact than if sensitive data had been segregated, because attackers gaining access to the low-sensitivity portion automatically gain access to high-sensitivity information as well. The lack of segregation amplifies breach consequences by exposing more critical data than necessary if proper data isolation had been implemented.
Why the other options are wrong
- A. Mixing sensitivity levels typically violates data minimization and segregation requirements in most privacy and security regulations, creating compliance issues.
- C. Storing data together may actually prevent proper access controls, making it harder to restrict temporary employees to only necessary information.
- D. Commingling data makes discovery requests more burdensome, as organizations cannot easily filter and produce only relevant information without also disclosing unnecessary data.
Question 42
How did the Fair and Accurate Credit Transactions Act (FACTA) amend the Fair Credit Reporting Act (FCRA)?
Show answer and explanation
Correct answer: B. It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized access
The Fair and Accurate Credit Transactions Act (FACTA) amended the Fair Credit Reporting Act by strengthening disposal requirements for consumer information. FACTA specifically increased obligations on organizations to implement reasonable measures to dispose of consumer data in ways that prevent unauthorized access and identity theft. This represented a significant enhancement to data protection standards beyond the original FCRA framework.
Why the other options are wrong
- A. FACTA did not primarily expand the definition of consumer reports to include employee investigation communications; this falls outside its core amendments.
- C. FACTA did not stipulate that consumer reports could only be obtained for credit worthiness reviews; legitimate purposes remain broader than this.
- D. FACTA did not introduce a requirement for advance consent specifically for internal investigation purposes; employers had flexibility in this area.
Question 43
A law enforcement agency subpoenas the ACME telecommunications company for access to text message records of a person suspected of planning a terrorist attack. The company had previously encrypted its text message records so that only the suspect could access this data. What law did ACME violate by designing the service to prevent access to the information by a law enforcement agency?
Show answer and explanation
Correct answer: C. CALEA
The Communications Assistance for Law Enforcement Act (CALEA) requires telecommunications carriers to design their systems to enable lawful wiretapping and to provide law enforcement with the ability to access communications pursuant to court orders or other legal authority. By encrypting text message records so that only the suspect could access them, ACME violated CALEA's requirement to maintain the capability for law enforcement intercept. The SCA and ECPA govern privacy protections and stored communications but do not impose positive obligations to maintain intercept capability, while the USA FREEDOM Act addresses bulk data collection restrictions.
Why the other options are wrong
- A. The SCA protects stored communications but does not mandate carrier intercept capability.
- B. The ECPA restricts interception but does not impose design requirements for law enforcement access.
- D. The USA FREEDOM Act addresses bulk collection limits, not carrier design requirements for intercept capability.
Question 44
SCENARIO Please use the following to answer the next question: A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices. The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.” This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup’s rapid market penetration. As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer. At this stage of the investigation, what should the data privacy leader review first?
Show answer and explanation
Correct answer: D. Prevailing regulation on this subject
When facing a GDPR supervisory authority investigation, the data privacy leader must first review the prevailing regulation on the subject to understand the legal obligations, rights, and procedures that govern the situation. Understanding GDPR requirements for data subject rights, international transfers, and supervisory authority cooperation is foundational to any proper response. While data flow diagrams, complaints, and internal policies are useful investigative tools, they are secondary to understanding the legal framework that defines what the organization must do. Regulatory knowledge provides the context for evaluating all other information.
Why the other options are wrong
- A. Data flow diagrams are useful but secondary; understanding legal obligations under GDPR must come first.
- B. Reviewing the complaint details is important but should follow understanding the legal framework governing the investigation.
- C. Internal policies are useful for reference but should be evaluated in light of applicable GDPR requirements.
Question 45
Which act violates the Family Educational Rights and Privacy Act of 1974 (FERPA)?
Show answer and explanation
Correct answer: A. A K-12 assessment vendor obtains a student’s signed essay about her hometown from her school to use as an exemplar for public release
A student's signed essay is part of her educational record, and using it for public release without consent violates FERPA. Options B, C, and D represent permitted disclosures under FERPA: public directory information (B), honor roll announcements (C), and law enforcement records access (D) are all allowable under FERPA's exceptions. The unauthorized use of a specific student's educational work product for external purposes without consent is a direct violation.
Why the other options are wrong
- B. Public directory information that includes names, hometowns, e-mail addresses, and majors can be disclosed if the school has provided proper notice and the student has not opted out.
- C. Honor roll information is typically considered directory information and may be released under FERPA without consent.
- D. FERPA permits disclosure of records to law enforcement agencies conducting legitimate investigations.
Question 46
SCENARIO Please use the following to answer the next question: Matt went into his son’s bedroom one evening and found him stretched out on his bed typing on his laptop. “Doing your homework?” Matt asked hopefully. “No,” the boy said. “I’m filling out a survey.” Matt looked over his son’s shoulder at his computer screen. “What kind of survey?” “It’s asking questions about my opinions.” “Let me see,” Matt said, and began reading the list of questions that his son had already answered. “It’s asking your opinions about the government and citizenship. That’s a little odd. You’re only ten.” Matt wondered how the web link to the survey had ended up in his son’s email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders. To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer questions about his favorite games and toys. Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son’s inbox, and he decided it was time to report the incident to the proper authorities. Based on the incident, the FTC’s enforcement actions against the marketer would most likely include what violation?
Show answer and explanation
Correct answer: B. Collecting information from a child under the age of thirteen.
The scenario describes the Leadership Project collecting personal information (name, address, phone, date of birth, and preferences) from a ten-year-old child without parental consent. This violates the Children's Online Privacy Protection Act (COPPA), which prohibits collection of personal information from children under 13 without verifiable parental consent. The core violation is collecting information from a child under thirteen, making B the most direct and actionable FTC enforcement basis. The other options are either too vague or describe secondary concerns rather than the primary statutory violation.
Why the other options are wrong
- A. Family privacy intrusion is not the legal standard; COPPA focuses on children's data collection.
- C. No breach is described in the scenario; the violation is in initial collection without consent.
- D. The violation is of COPPA law itself, not industry policy guidelines.
Question 47
Which entities must comply with the Telemarketing Sales Rule?
Show answer and explanation
Correct answer: A. For-profit organizations and for-profit telefunders regarding charitable solicitations
The FTC's Telemarketing Sales Rule applies to for-profit entities, and it specifically covers for-profit telefunders that make charitable solicitation calls on behalf of nonprofits. Nonprofit organizations calling on their own behalf fall outside the FTC's jurisdiction and are not covered.
Why the other options are wrong
- B. Nonprofits calling on their own behalf are outside the FTC's jurisdiction and are not subject to the rule.
- C. Business-to-business calls are generally exempt from the rule.
- D. Nonprofit organizations are not covered by the rule when they sell on their own behalf, so this statement is inaccurate.
Question 48
SCENARIO Please use the following to answer the next question: A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices. The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.” This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup’s rapid market penetration. As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer. Upon review, the data privacy leader discovers that the Company’s documented data inventory is obsolete. What is the data privacy leader’s next best source of information to aid the investigation?
Show answer and explanation
Correct answer: D. Interviews with key marketing personnel
When documented data inventory is obsolete, interviews with key marketing personnel represent the best alternative source for identifying what personal data was received from the retailer. Marketing personnel typically have direct knowledge of data flows, customer segmentation, campaign targeting, and business processes that involved EU customer data. Their institutional knowledge can help reconstruct data collection and usage patterns. Database schemas from the retailer would show their structure but not necessarily what data the startup company received. Customer lists sorted by country could be helpful but don't provide the contextual understanding of data flows. Purchase histories show transactions but not the scope of personal data received.
Why the other options are wrong
- A. Purchase histories document transactions but do not necessarily identify all personal data received from the retailer.
- B. Retailer database schemas describe data structure but do not reveal what personal data the startup company actually received.
- C. Customer lists sorted by country show geography but lack the contextual information about what personal data was transferred.
Question 49
The Cable Communications Policy Act of 1984 requires which activity?
Show answer and explanation
Correct answer: A. Delivery of an annual notice detailing how subscriber information is to be used
The Cable Communications Policy Act of 1984 requires cable operators to provide subscribers with an annual notice explaining how their personal information is collected, used, and disclosed. This transparency requirement ensures subscribers understand the operator's information practices. Option B regarding maximum destruction timelines, C regarding investigation notices, and D regarding consent for service-related disclosures are not the primary requirements of the act.
Why the other options are wrong
- B. The Cable Communications Policy Act does not mandate destruction of information within six months.
- C. While the act addresses unauthorized reception, mandated notice to subscribers about investigations is not the primary requirement.
- D. The act requires notice and privacy protections, but not explicit subscriber consent for all information necessary to render services.
Question 50
Which of the following would NOT constitute an exception to the authorization requirement under the HIPAA Privacy Rule?
Show answer and explanation
Correct answer: D. Disclosing health information needed to pay a third party billing administrator.
The HIPAA Privacy Rule permits disclosure of protected health information without authorization for specific public health and law enforcement purposes, including public health activities, child abuse reporting, and medical emergencies. However, disclosing health information to a third-party billing administrator for payment purposes is a routine business operation that requires patient authorization. While payment is a permitted use of health information when authorized, it does not constitute an automatic exception to the authorization requirement, the authorization typically occurs through the initial treatment relationship and consent forms.
Why the other options are wrong
- A. Public health activities are established exceptions to the authorization requirement under HIPAA.
- B. Reporting child abuse is an established exception to the authorization requirement under HIPAA.
- C. Treating medical emergencies is an established exception to the authorization requirement under HIPAA.
Question 51
Which of the following best describes the ASIA-Pacific Economic Cooperation (APEC) principles?
Show answer and explanation
Correct answer: A. A bill of rights for individuals seeking access to their personal information.
The APEC Cross-Border Privacy Rules Framework establishes a baseline of privacy principles for organizations in the Asia-Pacific region that handle personal information. These principles include providing individuals with notice, choice, access, and security protections regarding their personal data. The framework functions as a set of rights for individuals, including the right to access and understand how their personal information is collected and used, rather than focusing on medical establishments, court rulings, or marketing-specific obligations.
Why the other options are wrong
- B. APEC principles apply broadly to organizations handling personal information across sectors, not specifically to medical establishments.
- C. APEC is a framework of principles and best practices agreed upon by participating economies, not an international court ruling.
- D. APEC establishes principles for data handlers generally, not specifically a code of marketing responsibilities for opt-out mechanisms.
Question 52
What is the main purpose of the CAN-SPAM Act?
Show answer and explanation
Correct answer: D. To ensure that organizations respect individual rights when using electronic advertising
The CAN-SPAM Act's main purpose is to establish rules requiring organizations to respect individual rights when sending commercial electronic messages, including requirements for accurate header information, opt-out mechanisms, and truthful subject lines. The act is designed to regulate commercial email practices broadly and protect consumer rights. Options A and C incorrectly focus on sexually explicit content, which is not the primary purpose. Option B regarding state enforcement is not the central purpose of the act.
Why the other options are wrong
- A. While CAN-SPAM addresses sexually explicit content, this is not its main purpose; the act primarily regulates all commercial electronic messages.
- B. CAN-SPAM does not primarily authorize states to enforce federal privacy laws; it establishes federal rules for email marketing.
- C. The FTC's rule-creation for sexually explicit content is not the main purpose of CAN-SPAM.
Question 53
John, a California resident, receives notification that a major corporation with $500 million in annual revenue has experienced a data breach. John’s personal information in their possession has been stolen, including his full name and social security numb. John also learns that the corporation did not have reasonable cybersecurity measures in place to safeguard his personal information. Which of the following answers most accurately reflects John’s ability to pursue a legal claim against the corporation under the California Consumer Privacy Act (CCPA)?
Show answer and explanation
Correct answer: D. John can sue the corporation for the data breach to recover monetary damages suffered as a result of the data breach, and in some circumstances seek statutory damages irrespective of whether he suffered any financial harm.
The California Consumer Privacy Act includes a private right of action specifically for data breaches involving certain categories of unencrypted or unredacted personal information, such as Social Security numbers combined with other identifiers. Importantly, under CCPA's data breach provision, consumers can recover statutory damages of $100 to $750 per consumer per incident regardless of whether they suffered actual financial harm. This is a significant expansion beyond requiring proof of concrete damages. John qualifies for statutory damages under these provisions, making option D the most accurate answer.
Why the other options are wrong
- A. The CCPA explicitly addresses data breach rights through its private right of action.
- B. While the California Attorney General can sue, the CCPA also provides a private right of action for consumers.
- C. John can recover statutory damages without proving actual financial harm, not just damages he actually suffered.
Question 54
What practice does the USA FREEDOM Act NOT authorize?
Show answer and explanation
Correct answer: D. The bulk collection of telephone data and internet metadata
The USA FREEDOM Act explicitly prohibits bulk collection of telephone data and internet metadata. The Act reformed surveillance programs by ending the NSA's bulk collection of telephone metadata and requiring more targeted, individualized approaches to surveillance. In contrast, the Act does authorize emergency exceptions for targeting roamers, increased penalties for material support to terrorism, and extensions of roving wiretaps. The question asks what the Act does NOT authorize, making the prohibition on bulk collection the correct answer.
Why the other options are wrong
- A. The USA FREEDOM Act does authorize emergency exceptions for targeting roamers.
- B. The Act includes increased penalties for material support to terrorism offenses.
- C. The Act extends and modifies roving wiretap provisions under specified conditions.
Question 55
Which of the following became the first state to pass a law specifically regulating the practices of data brokers?
Show answer and explanation
Correct answer: D. Vermont.
Vermont became the first state in the United States to pass legislation specifically regulating data brokers when it enacted the Data Broker Law in 2018. This law requires data brokers to register with the Vermont Attorney General, maintain security practices, and comply with specific disclosure and notification requirements. Vermont's pioneering legislation established a model that other states have since followed in creating their own data broker regulations.
Why the other options are wrong
- A. Washington has privacy legislation but was not the first state to specifically regulate data broker practices.
- B. California passed the Consumer Privacy Act and other privacy laws, but Vermont preceded California in specific data broker regulation.
- C. New York has passed privacy legislation but was not the first state to enact specific data broker regulatory requirements.
Question 56
If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?
Show answer and explanation
Correct answer: D. Enters a contract with the organization that states the third party will process data according to the consent agreement
Under Privacy Shield, when transferring personal data to a third-party agent, the organization must ensure the agent uses data only for limited purposes (A), maintains the same privacy protection level (B), and provides notice if it can no longer meet requirements (C). However, a contract stating the third party will process data according to the consent agreement is not necessary, Privacy Shield requires an agreement, but it must be based on the organization's own obligations and the agent's accountability to the organization, not on re-stating the original consent agreement's terms. The third party acts as an agent of the organization, not under separate consent.
Why the other options are wrong
- A. Limited purpose usage is a requirement for agent data processing.
- B. Equivalent privacy protection levels must be maintained by the third party.
- C. The third party must notify the organization if it cannot comply with data handling requirements.
Question 57
What type of material is exempt from an individual’s right to disclosure under the Privacy Act?
Show answer and explanation
Correct answer: D. Material reporting investigative efforts pertaining to the enforcement of criminal law.
The Privacy Act establishes exemptions from an individual's right to disclosure for records maintained by law enforcement agencies that relate to criminal law enforcement investigations and prosecutions. Material reporting investigative efforts pertaining to criminal law enforcement may be withheld from disclosure to protect ongoing investigations and law enforcement purposes. This exemption is specifically designed to protect the integrity of criminal investigations and law enforcement operations.
Why the other options are wrong
- A. Material maintained solely for research purposes is not automatically exempt from disclosure under the Privacy Act.
- B. The Privacy Act does not provide a blanket exemption for material about investigative efforts to prevent persecution; this is not a recognized exemption category.
- C. Material regarding foreign government collaboration in trade negotiations would not qualify as a standard Privacy Act exemption for disclosure rights.
Question 58
Which of the following best describes what a “private right of action” is?
Show answer and explanation
Correct answer: D. The right of individuals harmed by a violation of a law to file a lawsuit against the violation.
A private right of action is the legal right of individuals harmed by a violation of law to file a lawsuit against the entity responsible for that violation. This concept enables private parties to seek remedies through civil litigation when laws protecting them are breached, rather than relying solely on government enforcement.
Why the other options are wrong
- A. This describes privacy rights generally, not the specific legal concept of a private right of action.
- B. This describes a data access right, which is distinct from the legal mechanism of a private right of action.
- C. This describes a data deletion right, which is not the definition of a private right of action.
Question 59
According to FERPA, when can a school disclose records without a student’s consent?
Show answer and explanation
Correct answer: D. If the disclosure is to provide transcripts to a school where a student intends to enroll
FERPA permits schools to disclose records without student consent to institutions where a student intends to enroll, facilitating the transfer of educational records between schools. This is a standard exception to allow seamless education transitions. Options A and B are not valid FERPA exceptions, the method of delivery and presence of student ID numbers do not determine disclosure legality. Option C, while healthcare professionals may need access, is not the broadest or most clearly applicable exception.
Why the other options are wrong
- A. The method of transmission (email versus other means) does not determine whether disclosure requires consent under FERPA.
- B. Whether a student identification number is included does not determine whether disclosure is permitted without consent.
- C. While healthcare practitioners may sometimes access records, this is not the primary consent exception covered by FERPA.
Question 60
All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?
Show answer and explanation
Correct answer: B. Pharmaceutical companies
Under HIPAA, covered entities include healthcare providers, health plans, and healthcare clearinghouses. Pharmaceutical companies are not designated as covered entities under HIPAA unless they also function as healthcare providers or health plans. Pharmaceutical manufacturers and distributors fall outside the regulatory scope of HIPAA's coverage requirements.
Why the other options are wrong
- A. Healthcare information clearinghouses are explicitly designated as covered entities under HIPAA.
- C. Healthcare providers (doctors, hospitals, clinics) are core covered entities under HIPAA.
- D. Health plans (insurance companies, HMOs) are expressly defined as covered entities under HIPAA.
Question 61
What is the most important action an organization can take to comply with the FTC position on retroactive changes to a privacy policy?
Show answer and explanation
Correct answer: B. Obtaining affirmative consent from its customers.
The FTC position on retroactive privacy policy changes requires organizations to obtain affirmative consent from customers before implementing changes that are materially adverse to the original privacy commitments. Affirmative consent ensures that customers actively agree to new terms rather than having changes imposed upon them unilaterally, protecting against unfair and deceptive practices.
Why the other options are wrong
- A. Merely describing policy changes on a website does not constitute obtaining consent and does not comply with FTC requirements.
- C. Social media publicity is insufficient; the FTC requires affirmative opt-in consent from affected customers.
- D. Reassurance about security does not address the core FTC requirement of obtaining customer consent for material policy changes.
Question 62
More than half of U.S. states require telemarketers to?
Show answer and explanation
Correct answer: C. Register with the state before conducting business
More than half of U.S. states require telemarketers to register with the state, and often to post a bond, before they can call residents. Registration lets states track telemarketers and enforce their consumer protection rules.
Why the other options are wrong
- A. Identifying the caller at the start of a call is a federal Telemarketing Sales Rule requirement, not the state-level requirement described here.
- B. Most states do not require written consent from potential customers before a telemarketing call.
- D. Written contracts are required only in some states for certain sales, not in more than half of states.
Question 63
What was the original purpose of the Federal Trade Commission Act?
Show answer and explanation
Correct answer: C. To enforce antitrust laws
The Federal Trade Commission Act of 1914 was originally enacted to prevent unfair methods of competition and to enforce antitrust laws, establishing the FTC as an antitrust enforcement body. While the FTC's authority has been expanded over decades to include consumer protection and privacy enforcement (which may lead to answers A, B, or D appearing correct), the original legislative purpose was antitrust enforcement. The act predates modern privacy concerns and was not initially designed for privacy protection.
Why the other options are wrong
- A. Privacy rights protection became an FTC responsibility through later statutory amendments, not the original act.
- B. Consumer protection evolved as an FTC function through expansion of the original act, not its original purpose.
- D. Consent decrees are an enforcement mechanism developed later, not the original purpose of the act.
Question 64
Under the Telemarketing Sales Rule, what characteristics of consent must be in place for an organization to acquire an exception to the Do-NotCall rules for a particular consumer?
Show answer and explanation
Correct answer: C. The consent must be in writing, must contain the number to which calls can be made and must be signed
Under the Telemarketing Sales Rule, to obtain an exception to Do-Not-Call rules, consent must be in writing, must contain the specific phone number to which calls can be made, and must be signed by the consumer. These three elements ensure that the consumer has provided clear, documented authorization for calls to a specific line, creating an enforceable exception.
Why the other options are wrong
- A. While consent must be written and signed, the rule does not require specification of call times.
- B. While the phone number is required, an end date is not a mandatory element of valid consent.
- D. An end date and call times are not required elements; the rule requires the number and signature.
Question 65
Global Manufacturing Co’s Human Resources department recently purchased a new software tool. This tool helps evaluate future candidates for executive roles by scanning emails to see what those candidates say and what is said about them. This provides the HR department with an automated “360 review” that lets them know how the candidate thinks and operates, what their peers and direct reports say about them, and how well they interact with each other. What is the most important step for the Human Resources Department to take when implementing this new software?
Show answer and explanation
Correct answer: A. Making sure that the software does not unintentionally discriminate against protected groups.
When implementing automated decision-making systems for employment screening, the most critical step is ensuring the software does not unintentionally discriminate against protected groups. Employment decisions, including executive candidate evaluation, are subject to EEOC enforcement and anti-discrimination laws. Automated systems that produce disparate impact on protected classes based on race, color, religion, sex, national origin, age, disability, or other protected characteristics create legal liability. This assessment must occur before deployment and remains the primary obligation regardless of privacy notices or employee handbook acknowledgments.
Why the other options are wrong
- B. Privacy notices cannot legally eliminate employee privacy rights; employees retain privacy expectations in communications even on organizational systems.
- C. Employee handbook acknowledgments do not override legal rights under EEOC and employment discrimination laws; this approach is legally insufficient and unenforceable.
- D. While notice and consent are important, they are secondary to the fundamental requirement of ensuring the system does not discriminate against protected groups.
Question 66
The Video Privacy Protection Act of 1988 restricted which of the following?
Show answer and explanation
Correct answer: A. Which purchase records of audio visual materials may be disclosed
The Video Privacy Protection Act of 1988 restricted the disclosure of purchase and rental records of audiovisual materials without customer consent. This act was enacted to protect consumer privacy regarding video rental and purchase history. The act does not directly restrict downloading (B), online monitoring (C), or advertising targeting (D), though it establishes privacy protections for rental and purchase records specifically.
Why the other options are wrong
- B. The Video Privacy Protection Act does not regulate when downloading of copyrighted materials is allowed.
- C. Monitoring of online viewing is not the primary focus of this act, which addresses historical purchase and rental records.
- D. The act does not restrict which audiences video advertisements may target.
Question 67
A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?
Show answer and explanation
Correct answer: D. Medical providers
Under HIPAA breach notification requirements, a covered entity must report breaches affecting more than 500 individuals to the affected individuals, the Department of Health and Human Services, and prominent media outlets. However, HIPAA does not require notification to medical providers; the covered entity's notification obligations are limited to affected individuals, HHS, and the media.
Why the other options are wrong
- A. The Department of Health and Human Services must be notified of breaches involving more than 500 individuals.
- B. Affected individuals must be notified without unreasonable delay when a breach affects their PHI.
- C. Prominent media in the affected area must be notified when a breach impacts more than 500 individuals in that jurisdiction.
Question 68
All of the following common law torts are relevant to employee privacy under US law EXCEPT?
Show answer and explanation
Correct answer: D. Conversion.
Conversion is not a common law tort specifically related to employee privacy. Conversion addresses the wrongful taking or possession of personal property. In contrast, infliction of emotional distress, intrusion upon seclusion, and defamation are all recognized common law torts relevant to employee privacy under US law. Intrusion upon seclusion directly protects privacy rights, infliction of emotional distress can apply to privacy violations causing severe emotional harm, and defamation involves private information, while conversion addresses property rights rather than privacy.
Why the other options are wrong
- A. Infliction of emotional distress is a recognized privacy-related tort when employers engage in extreme and outrageous conduct affecting employee privacy.
- B. Intrusion upon seclusion is a foundational privacy tort protecting against unauthorized intrusions into private affairs.
- C. Defamation is relevant to employee privacy as it involves the dissemination of false information about an employee.
That was 68 of 285.
The full IAPP CIPP/US pack has all 285 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 111 free as one PDF by email. Get the Half Pack →