IAPP CIPT Exam Dumps

Which of the following became a foundation for privacy principles and practices of countries and organizations across the globe? 

Which is NOT a suitable action to apply to data when the retention period ends? 

A solutions architect designs a service so that data of high-risk individuals is deidentified. Which privacy engineering objective does this demonstrate?

Which is NOT a drawback to using a biometric recognition system? 

Which of the following entities would most likely be exempt from complying with the General Data Protection Regulation (GDPR)?

SCENARIO Please use the following to answer the next question: Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app. The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app. LBH’s privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process. The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent. What is the best way to ensure that the application only collects personal data that is needed to fulfill its primary purpose of providing potential medical and healthcare recommendations?

What would be an example of an organization transferring the risks associated with a data breach?

Which of the following is NOT a valid basis for data retention? 

What is the name of an alternative technique to counter the reduction in use of third-party cookies, where web publishers may consider utilizing data cached by a browser and returned with a subsequent request from the same resource to track unique users?

Which of the following is the most important action to take prior to collecting personal data directly from a customer?

Which of the following suggests the greatest degree of transparency? 

Which of the following techniques describes the use of encryption where encryption keys are divided into parts that can then be used to recover a full encryption key?

Which of the following statements describes an acceptable disclosure practice? 

Which is NOT a way to validate a person's identity? 

Under the Family Educational Rights and Privacy Act (FERPA), releasing personally identifiable information from a student's educational record requires written permission from the parent or eligible student in order for information to be?

Which activity would best support the principle of data quality? 

What is the main benefit of using dummy data during software testing? 

SCENARIOCarol was a U.S.-based glassmaker who sold her work at art festivals. She kept thingssimple by only accepting cash and personal checks.As business grew, Carol couldn't keep up with demand, and traveling to festivals becameburdensome. Carol opened a small boutique and hired Sam to run it while she worked inthe studio. Sam was a natural salesperson, and business doubled. Carol told Sam, “I don'tknow what you are doing, but keep doing it!"But months later, the gift shop was in chaos. Carol realized that Sam needed help so shehired Jane, who had business expertise and could handle the back-office tasks. Sam wouldcontinue to focus on sales. Carol gave Jane a few weeks to get acquainted with the artisancraft business, and then scheduled a meeting for the three of them to discuss Jane's firstimpressions.At the meeting, Carol could not wait to hear Jane's thoughts, but she was unprepared forwhat Jane had to say. “Carol, I know that he doesn't realize it, but some of Sam’s efforts toincrease sales have put you in a vulnerable position. You are not protecting customers’personal information like you should.”Sam said, “I am protecting our information. I keep it in the safe with our bank deposit. It's only a list of customers’ names, addresses and phone numbers that I get from their checks before I deposit them. I contact them when you finish a piece that I think they would like. That's the only information I have! The only other thing I do is post photos and information about your work on the photo sharing site that I use with family and friends. I provide my email address and people send me their information if they want to see more of your work. Posting online really helps sales, Carol. In fact, the only complaint I hear is about having to come into the shop to make a purchase.” Carol replied, “Jane, that doesn’t sound so bad. Could you just fix things and help us to post even more online?" ‘I can," said Jane. “But it's not quite that simple. I need to set up a new program to make sure that we follow the best practices in data management. And I am concerned for our customers. They should be able to manage how we use their personal information. We also should develop a social media strategy.” Sam and Jane worked hard during the following year. One of the decisions they made was to contract with an outside vendor to manage online sales. At the end of the year, Carol shared some exciting news. “Sam and Jane, you have done such a great job that one of the biggest names in the glass business wants to buy us out! And Jane, they want to talk to you about merging all of our customer and vendor information with theirs beforehand." Which regulator has jurisdiction over the shop's data management practices? 

Which of the following is most important to provide to the data subject before the collection phase of the data lifecycle?

SCENARIO Please use the following to answer the next question: Jordan just joined a fitness-tracker start-up based in California, USA, as its first Information Privacy and Security Officer. The company is quickly growing its business but does not sell any of the fitness trackers itself. Instead, it relies on a distribution network of third-party retailers in all major countries. Despite not having any stores, the company has a 78% market share in the EU. It has a website presenting the company and products, and a member section where customers can access their information. Only the email address and physical address need to be provided as part of the registration process in order to customize the site to the user’s region and country. There is also a newsletter sent every month to all members featuring fitness tips, nutrition advice, product spotlights from partner companies based on user behavior and preferences. Jordan says the General Data Protection Regulation (GDPR) does not apply to the company. He says the company is not established in the EU, nor does it have a processor in the region. Furthermore, it does not do any “offering goods or services” in the EU since it does not do any marketing there, nor sell to consumers directly. Jordan argues that it is the customers who chose to buy the products on their own initiative and there is no “offering” from the company. The fitness trackers incorporate advanced features such as sleep tracking, GPS tracking, heart rate monitoring. wireless syncing, calorie-counting and step-tracking. The watch must be paired with either a smartphone or a computer in order to collect data on sleep levels, heart rates, etc. All information from the device must be sent to the company’s servers in order to be processed, and then the results are sent to the smartphone or computer.Jordan argues that there is no personal information involved since the company does not collect banking or social security information. Based on the current features of the fitness watch, what would you recommend be implemented into each device in order to most effectively ensure privacy?

An organization is concerned that its aging IT infrastructure will lead to Increased security and privacy risks. Which of the following would help mitigate these risks?

Which of the following is NOT a workplace surveillance best practice? 

An organization is using new technologies that will target and process personal data of EU customers. In which of the following circumstances would a privacy technologist need to support a data protection impact assessment (DPIA)?

An organization must terminate their cloud vendor agreement immediately. What is the most secure way to delete the encrypted data stored in the cloud?

Which of the following statements best describes the relationship between privacy and security?