Free IAPP CIPP-US Practice Exams - Page 5 of 20

Question #41

A financial services company install "bossware" software on its employees’ remote computers to monitor performance. The software logs screenshots, mouse movements, and keystrokes to determine whether an employee is being productive. The software can also enable the computer webcams to record video footage.

Which of the following would best support an employee claim for an intrusion upon seclusion tort?

A . The webcam is enabled to record video any time the computer is turned on.
B . The company creates and saves a biometric template for each employee based upon keystroke dynamics.
C . The software automatically sends a notification to a supervisor any time the employee’s mouse is dormant for more than five minutes.
D . The webcam records video of an employee using a company laptop to perform personal business while at a coffee shop during work hours.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

An intrusion upon seclusion tort occurs when someone intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, if the intrusion would be highly offensive to a reasonable person12. The intrusion does not need to involve a physical trespass, but can also be an electronic or optical intrusion, such as using a webcam to record a person who has a reasonable expectation of privacy2. The intrusion must also cause mental anguish or suffering to the plaintiff2.

In this case, option A would best support an employee claim for an intrusion upon seclusion tort, because the webcam is enabled to record video any time the computer is turned on, regardless of whether the employee is working or not, or whether the employee is in a private or public place.

This would be an intentional and highly offensive intrusion into the employee’s seclusion or private affairs, and would likely cause the employee distress or anxiety.

Option B would not support an intrusion upon seclusion tort, because the creation and saving of a biometric template based on keystroke dynamics is not an intrusion into the employee’s seclusion or private affairs, but rather a data collection and processing activity that may implicate other privacy laws or principles, such as notice, consent, and security3.

Option C would not support an intrusion upon seclusion tort, because the software sending a notification to a supervisor when the employee’s mouse is dormant for more than five minutes is not an intrusion into the employee’s seclusion or private affairs, but rather a performance monitoring activity that may be justified by the employer’s legitimate business interests4.

Option D would not support an intrusion upon seclusion tort, because the webcam recording video

of an employee using a company laptop to perform personal business while at a coffee shop during

work hours is not an intrusion into the employee’s seclusion or private affairs, but rather a misuse of

company property and time that may be subject to the employer’s policies and disciplinary

actions5. Moreover, the employee may not have a reasonable expectation of privacy in a public place

like a coffee shop.

Reference: 1: Intrusion on seclusion – Wikipedia 2: Elements of an Intrusion Claim

| Digital Media Law Project 3: Biometrics – IAPP 4: Employee Monitoring – IAPP 5: Employee Privacy – IAPP: Privacy in Public Places – IAPP

Question #42

The CFO of a pharmaceutical company is duped by a phishing email and discloses many of the company’s employee personnel files to an online predator. The files include employee contact information, job applications, performance reviews, discipline records, and job descriptions.

Which of the following state laws would be an affected employee’s best recourse against the employer?

A . The state social security number confidentiality statute.
B . The state personnel record review statute.
C . The state data destruction statute.
D . The state UDAP statute.

Reveal Solution Hide Solution

Question #43

Under the Fair Credit Reporting Act (FCRA), what must a person who is denied employment based upon his credit history receive?

A . A prompt notification from the employer.
B . An opportunity to reapply with the employer.
C . Information from several consumer reporting agencies (CRAs).
D . A list of rights from the Consumer Financial Protection Bureau (CFPB).

Reveal Solution Hide Solution

Question #44

SCENARIO

Please use the following to answer the next QUESTION:

Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals

realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer’s privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.

Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.

After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer’s personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between

their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.

Janice understood Cheryl’s concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company’s day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.

Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.

Based on the scenario, which of the following would have helped Janice to better meet the company’s needs?

A . Creating a more comprehensive plan for implementing a new policy
B . Spending more time understanding the company’s information goals
C . Explaining the importance of transparency in implementing a new policy
D . Removing the financial burden of the company’s employee training program

Reveal Solution Hide Solution

Question #45

Which statement is FALSE regarding the provisions of the Employee Polygraph Protection Act of 1988 (EPPA)?

A . The EPPA requires that employers post essential information about the Act in a conspicuous location.
B . The EPPA includes an exception that allows polygraph tests in professions in which employee honesty is necessary for public safety.
C . Employers are prohibited from administering psychological testing based on personality traits such as honesty, preferences or habits.
D . Employers involved in the manufacture of controlled substances may terminate employees based on polygraph results if other evidence exists.

Reveal Solution Hide Solution

Question #46

SCENARIO –

Please use the following to answer the next question:

Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app. For this new initiative, Miraculous is considering a product built by MedApps, a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices’ branding. MedApps provides technical support for the app, which it hosts in the cloud. MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service.

Riya is the Privacy Officer at Miraculous, responsible for the practice’s compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices, as well as negotiating the terms of vendor agreements. Riya is currently reviewing the suitability of the MedApps app from a privacy perspective.

Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps’ optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps.

What HIPAA compliance issue would Miraculous have to consider before using the telehealth app?

A . HIPAA does not permit healthcare providers to use cloud hosting services.
B . HIPAA does not permit in-person appointment data to be hosted in the cloud.
C . HIPAA would require Miraculous and MedApps to enter into a Business Associate Agreement.
D . HIPAA would require Miraculous to obtain patient consent before in-person appointment data can be shared with third parties.

Reveal Solution Hide Solution

Question #47

Which of the following does Title VII of the Civil Rights Act prohibit an employer from asking a job applicant?

A . Questions about age
B . Questions about a disability
C . Questions about a national origin
D . Questions about intended pregnancy

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Title VII of the Civil Rights Act of 1964 is a federal law that prohibits employment discrimination based on race, color, religion, sex, and national origin1 It also prohibits retaliation against individuals who assert their rights under the law or participate in an EEOC investigation1 Title VII applies to employers with 15 or more employees, as well as to employment agencies, labor organizations, and joint labor-management committees1

Title VII prohibits employers from making pre-employment inquiries that express a preference, limitation, or specification based on any of the protected characteristics, unless they are bona fide occupational qualifications (BFOQs)2 BFOQs are rare and narrowly construed exceptions that allow employers to consider a protected characteristic when it is reasonably necessary to the normal operation of the business2 For example, a religious organization may require its employees to share its faith, or a women’s shelter may hire only female counselors2

Option A is incorrect because questions about age are not prohibited by Title VII, but by the Age Discrimination in Employment Act of 1967 (ADEA), which protects individuals who are 40 years of age or older from employment discrimination based on age3 The ADEA generally prohibits employers from asking applicants about their age or date of birth, unless age is a BFOQ or the inquiry is part of a lawful affirmative action plan3

Option B is incorrect because questions about a disability are not prohibited by Title VII, but by the Americans with Disabilities Act of 1990 (ADA), which protects qualified individuals with disabilities from employment discrimination based on disability4 The ADA generally prohibits employers from asking applicants about whether they have a disability or the nature or severity of a disability, unless the inquiry is related to the ability to perform the essential functions of the job with or without reasonable accommodation4

Option C is incorrect because questions about a national origin are prohibited by Title VII, but not in all circumstances. Title VII prohibits employers from asking applicants about their national origin, ancestry, birthplace, native language, or accent, unless they are BFOQs or the inquiry is related to a legitimate business purpose, such as verifying eligibility to work in the United States or assessing language proficiency for a job that requires communication skills25

Option D is correct because questions about intended pregnancy are prohibited by Title VII, as amended by the Pregnancy Discrimination Act of 1978 (PDA), which protects women from employment discrimination based on pregnancy, childbirth, or related medical conditions. The PDA prohibits employers from asking applicants about whether they are pregnant or intend to become pregnant, unless they are related to the ability to perform the job. Such questions may indicate an intent to discriminate based on sex or pregnancy, or may deter women from applying for certain jobs.

Reference: 1: Title VII of the Civil Rights Act of 1964 | U.S. Equal Employment Opportunity

Commission 2: Questions and Answers about Race and Color Discrimination in Employment | U.S.

Equal Employment Opportunity Commission 3: Age Discrimination | U.S. Equal Employment

Opportunity Commission 4: Disability Discrimination | U.S. Equal Employment Opportunity

Commission 5: National Origin Discrimination | U.S. Equal Employment Opportunity Commission:

Pregnancy Discrimination | U.S. Equal Employment Opportunity Commission

Question #48

If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?

A . The organization will still be in compliance with most sector-specific privacy and security laws.
B . The impact of an organizational data breach will be more severe than if the data had been segregated.
C . Temporary employees will be able to find the data necessary to fulfill their responsibilities.
D . The organization will be able to address legal discovery requests efficiently without producing more information than necessary.

Reveal Solution Hide Solution

Question #49

How did the Fair and Accurate Credit Transactions Act (FACTA) amend the Fair Credit Reporting Act (FCRA)?

A . It expanded the definition of “consumer reports” to include communications relating to employee investigations
B . It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized access
C . It stipulated the purpose of obtaining a consumer report can only be for a review of the employee’s credit worthiness
D . It required employers to get an employee’s consent in advance of requesting a consumer report for internal investigation purposes

Reveal Solution Hide Solution

Question #50

Smith Memorial Healthcare (SMH) is a hospital network headquartered in New York and operating in 7 other states. SMH uses an electronic medical record to enter and track information about its patients. Recently, SMH suffered a data breach where a third-party hacker was able to gain access to the SMH internal network.

Because it is a HIPPA-covered entity, SMH made a notification to the Office of Civil Rights at the U.S.

Department of Health and Human Services about the breach.

Which statement accurately describes SMH’s notification responsibilities?

A . If SMH is compliant with HIPAA, it will not have to make a separate notification to individuals in the state of New York.
B . If SMH has more than 500 patients in the state of New York, it will need to make separate notifications to these patients.
C . If SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York.
D . If SMH makes credit monitoring available to individuals who inquire, it will not have to make a separate notification to individuals in the state of New York.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The correct answer is C. If SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York. Under the Health Insurance Portability and Accountability Act (HIPAA), SMH is required to notify the Office of Civil Rights (OCR) and the affected individuals of a data breach involving unsecured protected health information (PHI) within 60 days of discovery1. However, HIPAA does not preempt state laws that provide greater protection to individuals or impose additional obligations on covered entities2. Therefore, SMH must also comply with the state breach notification laws of the states where it operates, including New York. According to the New York State Information Security Breach and Notification Act, any person or business that owns or licenses computerized data that includes private information of a resident of New York must disclose any breach of the security of the system to such resident in the most expedient time possible and without unreasonable delay, unless the exposure of the private information was inadvertent and unlikely to result in misuse or financial harm3. Private information includes personal information (such as name, number, or other identifier) plus one or more of the following data elements: social security number; driver’s license number or non-driver identification card number; account number, credit or debit card number, in combination with any required security code, access code, password or other information that would permit access to an individual’s financial account; biometric information; or a user name or e-mail address in combination with a password or security question and answer that would permit access to an online account3.

Therefore, if SMH’s data breach involved any of these data elements of New York residents, SMH must notify them of the breach, regardless of whether SMH is compliant with HIPAA, has more than 500 patients in New York, or offers credit monitoring services. SMH must also notify the New York Attorney General, the Department of State, and the Division of State Police within 10 days of notifying the affected individuals3. Additionally, SMH must notify the New York Department of Health if the breach involved electronic health records4.

Reference:

https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Other-Guides/Guide-on-Managing-and-Notifying-Data-Breaches-under-the-PDPA-15-Mar-2021.pdf?la=en

https://www.pcpd.org.hk/english/resources_centre/publications/files/guidance_note_dbn_e.pdf