Free IAPP CIPP-US Practice Exams - Page 8 of 20

Question #71

What is the main purpose of requiring marketers to use the Wireless Domain Registry?

A . To access a current list of wireless domain names
B . To prevent unauthorized emails to mobile devices
C . To acquire authorization to send emails to mobile devices
D . To ensure their emails are sent to actual wireless subscribers

Question #72

SCENARIO

Please use the following to answer the next question;

Jane is a U.S. citizen and a senior software engineer at California-based Jones Labs, a major software supplier to the U.S. Department of Defense and other U.S. federal agencies Jane’s manager, Patrick, is a French citizen who has been living in California for over a decade. Patrick has recently begun to suspect that Jane is an insider secretly transmitting trade secrets to foreign intelligence.

Unbeknownst to Patrick, the FBI has already received a hint from anonymous whistleblower, and jointly with the National Secunty Agency is investigating Jane’s possible implication in a sophisticated foreign espionage campaign

Ever since the pandemic. Jane has been working from home. To complete her daily tasks she uses her corporate laptop, which after each togin conspicuously provides notice that the equipment belongs to Jones Labs and may be monitored according to the enacted privacy policy and employment handbook Jane also has a corporate mobile phone that she uses strictly for business, the terms of which are defined in her employment contract and elaborated upon in her employee handbook. Both the privacy policy and the employee handbook are revised annually by a reputable California law firm specializing in privacy law. Jane also has a personal iPhone that she uses for private purposes only.

Jones Labs has its primary data center in San Francisco, which is managed internally by Jones Labs engineers The secondary data center, managed by Amazon AWS. is physically located in the UK for disaster recovery purposes. Jones Labs’ mobile devices backup is managed by a mid-sized mobile delense company located in Denver, which physically stores the data in Canada to reduce costs. Jones Labs MS Office documents are securely stored in a Microsoft Office 365 data

When storing Jane’s fingerprint for remote authentication. Jones Labs should consider legality issues under which of the following9

A . The Privacy Rule of the HITECH Act.
B . The California loT Security Law (SB 327).
C . The applicable state law such as Illinois BIPA
D . The federal Genetic Information Nondiscrimination Act (GINA).

Reveal Solution Hide Solution

Question #73

SCENARIO

Please use the following to answer the next question;

Jane is a U.S. citizen and a senior software engineer at California-based Jones Labs, a major software supplier to the U.S. Department of Defense and other U.S. federal agencies Jane’s manager, Patrick, is a French citizen who has been living in California for over a decade. Patrick has recently begun to suspect that Jane is an insider secretly transmitting trade secrets to foreign intelligence.

Unbeknownst to Patrick, the FBI has already received a hint from anonymous whistleblower, and jointly with the National Secunty Agency is investigating Jane’s possible implication in a sophisticated foreign espionage campaign

Ever since the pandemic. Jane has been working from home. To complete her daily tasks she uses her corporate laptop, which after each togin conspicuously provides notice that the equipment belongs to Jones Labs and may be monitored according to the enacted privacy policy and employment handbook Jane also has a corporate mobile phone that she uses strictly for business, the terms of which are defined in her employment contract and elaborated upon in her employee handbook. Both the privacy policy and the employee handbook are revised annually by a reputable California law firm specializing in privacy law. Jane also has a personal iPhone that she uses for private purposes only.

Jones Labs has its primary data center in San Francisco, which is managed internally by Jones Labs engineers The secondary data center, managed by Amazon AWS. is physically located in the UK for disaster recovery purposes. Jones Labs’ mobile devices backup is managed by a mid-sized mobile delense company located in Denver, which physically stores the data in Canada to reduce costs. Jones Labs MS Office documents are securely stored in a Microsoft Office 365 data Under Section 702 of F1SA. the NSA may do which of the following without a Foreign Intelligence Surveillance Court warrant?

A . Compel AWS to disclose Jane’s email communications with a Taiwanese national residing in Taiwan.
B . Compel AWS to disclose email communications between two Chinese nationals residing in the EU.
C . Compel Microsoft to disclose Patnck’s Skype calls with a Brazilian national living in Peru.
D . Compel Jane to disclose the PIN code for her corporate mobile phone.

Reveal Solution Hide Solution

Question #74

What was the original purpose of the Federal Trade Commission Act?

A . To ensure privacy rights of U.S. citizens
B . To protect consumers
C . To enforce antitrust laws
D . To negotiate consent decrees with companies violating personal privacy

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The Federal Trade Commission Act (FTCA) was adopted in 1914 as part of the Progressive Era reforms that aimed to curb the power and influence of monopolies and trusts in the U.S. economy. The FTCA created the Federal Trade Commission (FTC) as an independent agency to investigate and prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce. The FTCA also gave the FTC the authority to issue cease and desist orders, seek injunctions, and impose civil penalties for violations of the law. The FTCA was intended to complement and supplement the existing antitrust laws, such as the Sherman Act and the Clayton Act, that prohibited restraints of trade, price-fixing, mergers, and other anticompetitive conduct.

The other options are not correct, because:

The FTCA did not explicitly address privacy rights of U.S. citizens, although the FTC later used its authority under the FTCA to enforce against unfair or deceptive privacy practices, such as making false or misleading claims, failing to disclose material information, or violating consumers’ choices or expectations regarding their personal data.

The FTCA did not specifically focus on consumer protection, although the FTC later expanded its scope to include consumer protection issues, such as advertising and marketing, credit and finance, privacy and security, and consumer education. The FTC also enforced other consumer protection laws, such as the Truth in Lending Act, the Fair Credit Reporting Act, the Children’s Online Privacy Protection Act, and the CAN-SPAM Act.

The FTCA did not authorize the FTC to negotiate consent decrees with companies violating personal privacy, although the FTC later used consent decrees as a common tool to settle privacy cases and impose remedial measures, such as audits, reports, and compliance programs. Consent decrees are agreements between the FTC and the parties involved in a case that resolve the FTC’s charges without admitting liability or wrongdoing.

Reference: FTC website, Federal Trade Commission Act

Britannica website, Federal Trade Commission Act (FTCA)

IAPP CIPP/US Study Guide, Chapter 1: Introduction to the U.S. Privacy Environment, pp. 11-12 IAPP website, Federal Trade Commission Act, Section 5 of

Question #75

SCENARIO –

Please use the following to answer the next question:

Jane is a U.S. citizen and a senior software engineer at California-based Jones Labs, a major software supplier to the U.S. Department of Defense and other U.S. federal agencies. Jane’s manager, Patrick, is a French citizen who has been living in California for over a decade. Patrick has recently begun to suspect that Jane is an insider secretly transmitting trade secrets to foreign intelligence.

Unbeknownst to Patrick, the FBI has already received a hint from anonymous whistleblower, and jointly with the National Security Agency is investigating Jane’s possible implication in a sophisticated foreign espionage campaign.

Ever since the pandemic, Jane has been working from home. To complete her daily tasks she uses her corporate laptop, which after each login conspicuously provides notice that the equipment belongs to Jones Labs and may be monitored according to the enacted privacy policy and employment handbook. Jane also has a corporate mobile phone that she uses strictly for business, the terms of which are defined in her employment contract and elaborated upon in her employee handbook. Both the privacy policy and the employee handbook are revised annually by a reputable California law firm specializing in privacy law. Jane also has a personal iPhone that she uses for private purposes only.

Jones Labs has its primary data center in San Francisco, which is managed internally by Jones Labs engineers. The secondary data center, managed by Amazon AWS, is physically located in the UK for disaster recovery purposes. Jones Labs’ mobile devices backup is managed by a mid-sized mobile defense company located in Denver, which physically stores the data in Canada to reduce costs. Jones Labs MS Office documents are securely stored in a Microsoft Office 365 data center based in Ireland. Manufacturing data of Jones Labs is stored in Taiwan and managed by a local supplier that has no presence in the U.S.

Before inspecting any GPS geolocation data from Jane’s corporate mobile phone, Patrick should first do what?

A . Obtain prior consent from Jane pursuant to the Telephone Consumer Protection Act
B . Revise emerging workplace privacy best practices with a reputable advocacy organization.
C . Obtain a subpoena from law enforcement, or a court order, directing Jones Labs to collect the GPS geolocation data.
D . Ensure that such activity is permitted under Jane’s employment contract or the company’s employee privacy policy.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Patrick should first ensure that inspecting GPS geolocation data from Jane’s corporate mobile phone is permitted under Jane’s employment contract or the company’s employee privacy policy. This is because Jane has a reasonable expectation of privacy in her location information, even if she uses a corporate-owned device for business purposes. The Fourth Amendment protects individuals from unreasonable searches and seizures by the government, and the Electronic Communications Privacy Act (ECPA) prohibits unauthorized interception or access to electronic communications by private parties. Therefore, Patrick cannot inspect Jane’s GPS data without a valid legal basis, such as consent, contract, or court order. Obtaining prior consent from Jane pursuant to the Telephone Consumer Protection Act (A) is not relevant, as this law regulates unsolicited calls and text messages, not location tracking. Revising emerging workplace privacy best practices with a reputable advocacy organization (B) is not sufficient, as Patrick still needs to comply with the existing legal obligations and contractual terms. Obtaining a subpoena from law enforcement, or a court order, directing Jones Labs to collect the GPS geolocation data © is not necessary, as Patrick is not acting on behalf of the government or in response to a legal request. However, if Patrick does obtain such a legal order, he should also comply with it and notify Jane of the disclosure, unless prohibited by law.

Reference: IAPP CIPP/US Study Guide, Chapter 4, Section 4.1.2, p. 115-116 IAPP CIPP/US Study Guide, Chapter 4, Section 4.2.1, p. 118-119

IAPP CIPP/US Study Guide, Chapter 4, Section 4.2.2, p. 120-121

IAPP CIPP/US Study Guide, Chapter 4, Section 4.2.3, p. 122-123

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.1, p. 124-125

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.2, p. 126-127

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.3, p. 128-129

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.4, p. 130-131

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.5, p. 132-133

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.6, p. 134-135

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.7, p. 136-137

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.8, p. 138-139

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.9, p. 140-141

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.10, p. 142-143

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.11, p. 144-145

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.12, p. 146-147

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.13, p. 148-149

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.14, p. 150-151

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.15, p. 152-153

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.16, p. 154-155

IAPP CIPP/US Study Guide, Chapter 4, Section 4.3.17, p. 156-157

Question #76

Which law provides employee benefits, but often mandates the collection of medical information?

A . The Occupational Safety and Health Act.
B . The Americans with Disabilities Act.
C . The Employee Medical Security Act.
D . The Family and Medical Leave Act.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

The Family and Medical Leave Act (FMLA) is a federal law that provides eligible employees with up to 12 weeks of unpaid, job-protected leave per year for certain family and medical reasons, such as the birth or adoption of a child, the serious health condition of the employee or a family member, or a qualifying exigency arising from the employee’s spouse, child, or parent being on covered active duty or call to covered active duty status in the Armed Forces. The FMLA also provides eligible employees with up to 26 weeks of unpaid, job-protected leave per year to care for a covered service member with a serious injury or illness if the employee is the spouse, child, parent, or next of kin of the service member. The FMLA applies to all public agencies, including state, local, and federal employers, and local education agencies (schools), and to private sector employers who employ 50 or more employees for at least 20 workweeks in the current or preceding calendar year.

The FMLA often requires employers to collect medical information from employees who request FMLA leave or from their health care providers to certify the need for leave, the duration of leave, and the employee’s ability to return to work. The FMLA regulations specify the type and amount of information that employers may request and require for different types of FMLA leave, such as: Basic medical facts, such as the diagnosis, symptoms, hospitalization, doctor visits, whether medication has been prescribed, and any referrals for evaluation or treatment, for the employee’s own serious health condition or that of a family member.

Information on the medical necessity of intermittent leave or reduced schedule leave and the expected frequency and duration of such leave, for the employee’s own serious health condition or that of a family member, or for planned medical treatment.

A statement of the facts regarding the qualifying exigency, such as the type of military duty, the dates

of the covered active duty, and the contact information of the military member, for leave due to a qualifying exigency arising from the employee’s spouse, child, or parent being on covered active duty or call to covered active duty status in the Armed Forces.

Information on the medical condition, treatment, and recovery of the covered service member, such as the date of injury or onset of illness, the current medical status, the prognosis, and the estimated time of treatment, for leave to care for a covered service member with a serious injury or illness.

The FMLA also imposes certain obligations on employers to protect the privacy and security of the medical information they collect from employees or their health care providers. For example, employers must:

Maintain records and documents relating to medical certifications, recertifications, or medical histories of employees or employees’ family members as confidential medical records in separate files/records from the usual personnel files, and if the Americans with Disabilities Act (ADA) applies, such records must be maintained in conformance with ADA confidentiality requirements.

Ensure that any electronic systems used to maintain such records meet the confidentiality requirements of the FMLA and the ADA, and that only authorized persons have access to such records.

Limit the disclosure of such records to supervisors and managers who need to know about an employee’s FMLA leave, first aid and safety personnel when an employee’s medical condition might require emergency treatment, and government officials investigating compliance with the FMLA. Comply with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule when requesting medical information from an employee’s health care provider, such as obtaining a valid authorization from the employee or using a HIPAA-compliant certification form.

Refrain from requesting more information than allowed by the FMLA regulations, such as asking for an employee’s complete medical records or information unrelated to the FMLA leave request. Respect the employee’s right to revoke a medical authorization or challenge a medical certification, and follow the procedures for resolving disputes over the validity or sufficiency of such documents.

Reference: The Family and Medical Leave Act (FMLA)

FMLA Employee Guide

FMLA Employer Guide

FMLA Regulations

FMLA Forms

Question #77

More than half of U S. states require telemarketers to do which of the following?

A . Identify themselves at the beginning of a call
B . Obtain written consent from potential customers
C . Register with the state before conducting business.
D . Provide written contracts for customer transactions

Reveal Solution Hide Solution

Question #78

What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?

A . The ability for the consumer to correct inaccurate credit report information
B . The truncation of account numbers on credit card receipts
C . The right to request removal from e-mail lists
D . Consumer notice when third-party data is used to make an adverse decision

Reveal Solution Hide Solution

Question #79

Which statute is considered part of U.S. federal privacy law?

A . The Fair Credit Reporting Act.
B . SB 1386.
C . The Personal Information Protection and Electronic Documents Act.
D . The e-Privacy Directive.

Reveal Solution Hide Solution

Question #80

Under the EU-US Data Privacy Framework, what must participating organizations provide to individuals in regard to complaints and disputes?

A . An independent recourse mechanism.
B . A copy 01 the individual’s personal data
C . A description of the organization’s data processing policies
D . A means of communicating with the organization’s privacy team.

Reveal Solution Hide Solution