Free IAPP CIPP-US Practice Exams - Page 9 of 20

Question #81

Within what time period must a commercial message sender remove a recipient’s address once they have asked to stop receiving future e-mail?

A . 7 days
B . 10 days
C . 15 days
D . 21 days

Reveal Solution Hide Solution

Question #82

In 2012, the White House and the FTC both issued reports advocating a new approach to privacy enforcement that can best be described as what?

A . Harm-based.
B . Self-regulatory.
C . Comprehensive.
D . Notice and choice.

Reveal Solution Hide Solution

Question #83

All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?

A . Healthcare information clearinghouses
B . Pharmaceutical companies
C . Healthcare providers
D . Health plans

Reveal Solution Hide Solution

Question #84

SCENARIO

Please use the following to answer the next QUESTION:

Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state’s Do Not Call list, as well as the people on it. “If they were really serious about not being bothered,” Evan said, “They’d be on the national DNC list. That’s the only one we’re required to follow. At SunriseLynx, we call until they ask us not to.”

Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call “another time.” This, to Larry, is a clear indication that they don’t want to be called at all. Evan doesn’t see it that way.

Larry believes that Evan’s arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi

a. However, following Evan’s political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.

Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan’s leadership.

Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker’s belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.

Larry wants to take action, but is uncertain how to proceed.

In what area does Larry have a misconception about private-sector employee rights?

A . The applicability of federal law
B . The enforceability of local law
C . The strict nature of state law
D . The definition of tort law

Reveal Solution Hide Solution

Question #85

What is the most important action an organization can take to comply with the FTC position on retroactive changes to a privacy policy?

A . Describing the policy changes on its website.
B . Obtaining affirmative consent from its customers.
C . Publicizing the policy changes through social media.
D . Reassuring customers of the security of their information.

Reveal Solution Hide Solution

Question #86

According to Section 5 of the FTC Act, self-regulation primarily involves a company’s right to do what?

A . Determine which bodies will be involved in adjudication
B . Decide if any enforcement actions are justified
C . Adhere to its industry’s code of conduct
D . Appeal decisions made against it

Reveal Solution Hide Solution

Question #87

According to FERPA, when can a school disclose records without a student’s consent?

A . If the disclosure is not to be conducted through email to the third party
B . If the disclosure would not reveal a student’s student identification number
C . If the disclosure is to practitioners who are involved in a student’s health care
D . If the disclosure is to provide transcripts to a school where a student intends to enroll

Reveal Solution Hide Solution

Question #88

If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?

A . Uses the transferred data for limited purposes
B . Provides the same level of privacy protection as the organization
C . Notifies the organization if it can no longer meet its requirements for proper data handling
D . Enters a contract with the organization that states the third party will process data according to the consent agreement

Reveal Solution Hide Solution

Question #89

A large online bookseller decides to contract with a vendor to manage Personal Information (PI).

What is the least important factor for the company to consider when selecting the vendor?

A . The vendor’s reputation
B . The vendor’s financial health
C . The vendor’s employee retention rates
D . The vendor’s employee training program

Reveal Solution Hide Solution

Question #90

Which act violates the Family Educational Rights and Privacy Act of 1974 (FERPA)?

A . A K-12 assessment vendor obtains a student’s signed essay about her hometown from her school to use as an exemplar for public release
B . A university posts a public student directory that includes names, hometowns, e-mail addresses,
and majors
C . A newspaper prints the names, grade levels, and hometowns of students who made the quarterly honor roll
D . University police provide an arrest report to a student’s hometown police, who suspect him of a similar crime

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

The Family Educational Rights and Privacy Act of 1974 (FERPA) is a federal law that protects the privacy of student education records. FERPA grants parents or eligible students the right to access, amend, and control the disclosure of their education records, with some exceptions. Schools must obtain written consent from the parent or eligible student before disclosing any personally identifiable information from the education records, unless an exception applies123

Option A violates FERPA because it involves the disclosure of a student’s personally identifiable information (PII) from the education records without consent. A student’s signed essay about her hometown is considered an education record under FERPA, as it is directly related to the student and maintained by the school12 A K-12 assessment vendor is not a school official with a legitimate educational interest, nor does it fall under any of the exceptions that allow disclosure without consent12 Therefore, the school must obtain the student’s (or the parent’s, if the student is a minor) written consent before providing the essay to the vendor for public release.

Option B does not violate FERPA because it involves the disclosure of directory information, which is not considered PII under FERPA. Directory information is information that would not generally be considered harmful or an invasion of privacy if disclosed, such as name, address, phone number, e-mail address, major, etc12 Schools may disclose directory information without consent, unless the parent or eligible student has opted out of such disclosure12 However, schools must notify parents and eligible students of the types of directory information they designate and their right to opt out annually12

Option C does not violate FERPA because it involves the disclosure of information that is not part of the education records. FERPA only applies to education records that are directly related to a student and maintained by the school or a party acting for the school12 A newspaper’s publication of the names, grade levels, and hometowns of students who made the quarterly honor roll is not based on the education records, but on the newspaper’s own sources and reporting. Therefore, FERPA does not prohibit such disclosure.

Option D does not violate FERPA because it involves the disclosure of information under an exception that allows disclosure without consent. FERPA permits schools to disclose education records, or PII from education records, without consent to comply with a judicial order or lawfully issued subpoena, or to appropriate officials in connection with a health or safety emergency123 If the university police provide an arrest report to the student’s hometown police in response to a subpoena or to prevent a serious threat to the student or others, they are not violating FERPA.

Reference: 1: Family Educational Rights and Privacy Act – Wikipedia 2: Family Educational Rights and

Privacy Act (FERPA) | CDC 3: What is FERPA? | Protecting Student Privacy – ed