Exam Questions and Answers for  CIPP-C Study Guide Questions and Answers!

Certified Information Privacy Professional/ Canada (CIPP/C) Certification Sample Questions and Practice Exam

NEW QUESTION 95
When may a financial institution share consumer information with non-affiliated third parties for marketing purposes?

• A. After disclosing information-sharing practices to customers and after giving them an opportunity to opt out.
• B. After disclosing marketing practices to customers and after giving them an opportunity to opt out.
• C. After disclosing marketing practices to customers and after giving them an opportunity to opt in.
• D. After disclosing information-sharing practices to customers and after giving them an opportunity to opt in.

Answer: A

 

NEW QUESTION 96
In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?

• A. A data controller who plans to use a new technology product that has already undergone a DPIA by the product's provider.
• B. A marketing team that wants to collect mailing addresses of customers for whom they already have email addresses.
• C. A medical organization that wants to begin genetic testing to support earlier research for which they have performed a DPIA.
• D. A railway operator who plans to evaluate the same video surveillance in all the train stations of his company.

Answer: D

 

NEW QUESTION 97
SCENARIO
Please use the following to answer the next question:
Zandelay Fashion ('Zandelay') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures. Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay's business plan and associated processing activities.
What must Zandelay provide to the supervisory authority during the prior consultation?

• A. An explanation of the purposes and means of the intended processing.
• B. Certificates that prove Martin's professional qualities and expert knowledge of data protection law.
• C. Records showing that customers have explicitly consented to the intended profiling activities.
• D. An evaluation of the complexity of the intended processing.

Answer: A

 

NEW QUESTION 98
SCENARIO
Please use the following to answer the next QUESTION:
Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family.
This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. "It's going to be great," the developer, Deidre Hoffman, tells you, "if, that is, we actually get it working!" She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. "It's just three young people," she says, "but they do great work." She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. "They do good work, so I chose them." Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, "I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!" You see evidence that company employees routinely circumvent the privacy officer in developing new initiatives. How can you best draw attention to the scope of this problem?

• A. Take your concerns straight to the Chief Executive Officer.
• B. Hold discussions with the department head of anyone who fails to consult with the privacy officer.
• C. Insist upon one-on-one consultation with each person who works around the privacy officer.
• D. Develop a metric showing the number of initiatives launched without consultation and include it in reports, presentations, and consultation.

Answer: B

 

NEW QUESTION 99
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States and Asia. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's Questions: on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well.
The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's QUESTION. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
To ensure GDPR compliance, what should be the company's position on the issue of consent?

• A. Parental consent for a child's use of the action figures would have to be obtained before any data could be collected.
• B. Consent for data collection is implied through the parent's purchase of the action figure for the child.
• C. Written authorization attesting to the responsible use of children's data would need to be obtained from the supervisory authority.
• D. The child, as the user of the action figure, can provide consent himself, as long as no information is shared for marketing purposes.

Answer: A

 

NEW QUESTION 100
SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location.
During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
To comply with the GDPR, what should Building Block have done as a first step before implementing the SecurityScan measure?

• A. Assessed potential privacy risks by conducting a data protection impact assessment.
• B. Consulted with the relevant data protection authority about potential privacy violations.
• C. Distributed a more comprehensive notice to employees and received their express consent.
• D. Consulted with the Information Security team to weigh security measures against possible server impacts.

Answer: C

 

NEW QUESTION 101
SCENARIO
Please use the following to answer the next question:
Joe is the new privacy manager for Who-R-U, a Canadian business that provides DNA analysis. The company is headquartered in Montreal, and all of its employees are located there. The company offers its services to Canadians only: Its website is in English and French, it accepts only Canadian currency, and it blocks internet traffic from outside of Canada (although this solution doesn't prevent all non-Canadian traffic). It also declines to process orders that request the DNA report to be sent outside of Canada, and returns orders that show a non-Canadian return address.
Bob, the President of Who-R-U, thinks there is a lot of interest for the product in the EU, and the company is exploring a number of plans to expand its customer base.
The first plan, collegially called We-Track-U, will use an app to collect information about its current Canadian customer base. The expansion will allow its Canadian customers to use the app while traveling abroad. He suggests that the company use this app to gather location information. If the plan shows promise, Bob proposes to use push notifications and text messages to encourage existing customers to pre-register for an EU version of the service. Bob calls this work plan, We-Text-U. Once the company has gathered enough pre- registrations, it will develop EU-specific content and services.
Another plan is called Customer for Life. The idea is to offer additional services through the company's app, like storage and sharing of DNA information with other applications and medical providers. The company's contract says that it can keep customer DNA indefinitely, and use it to offer new services and market them to customers. It also says that customers agree not to withdraw direct marketing consent. Paul, the marketing director, suggests that the company should fully exploit these provisions, and that it can work around customers' attempts to withdraw consent because the contract invalidates them.
The final plan is to develop a brand presence in the EU. The company has already begun this process. It is in the process of purchasing the naming rights for a building in Germany, which would come with a few offices that Who-R-U executives can use while traveling internationally. The office doesn't include any technology or infrastructure; rather, it's simply a room with a desk and some chairs.
On a recent trip concerning the naming-rights deal, Bob's laptop is stolen. The laptop held unencrypted DNA reports on 5,000 Who-R-U customers, all of whom are residents of Canada. The reports include customer name, birthdate, ethnicity, racial background, names of relatives, gender, and occasionally health information.
Who-R-U is NOT required to notify the local German DPA about the laptop theft because?

• A. There is no evidence that the thieves have accessed the data on the laptop.
• B. The laptop belonged to a company located in Canada.
• C. The company isn't a controller established in the Union.
• D. The data isn't considered personally identifiable financial information.

Answer: C

 

NEW QUESTION 102
SCENARIO
Please use the following to answer the next question:
Liem, an online retailer known for its environmentally friendly shoes, has recently expanded its presence in Europe. Anxious to achieve market dominance, Liem teamed up with another eco friendly company, EcoMick, which sells accessories like belts and bags. Together the companies drew up a series of marketing campaigns designed to highlight the environmental and economic benefits of their products. After months of planning, Liem and EcoMick entered into a data sharing agreement to use the same marketing database, MarketIQ, to send the campaigns to their respective contacts.
Liem and EcoMick also entered into a data processing agreement with MarketIQ, the terms of which included processing personal data only upon Liem and EcoMick's instructions, and making available to them all information necessary to demonstrate compliance with GDPR obligations.
Liem and EcoMick then procured the services of a company called JaphSoft, a marketing optimization firm that uses machine learning to help companies run successful campaigns. Clients provide JaphSoft with the personal data of individuals they would like to be targeted in each campaign. To ensure protection of its clients' data, JaphSoft implements the technical and organizational measures it deems appropriate. JaphSoft works to continually improve its machine learning models by analyzing the data it receives from its clients to determine the most successful components of a successful campaign. JaphSoft then uses such models in providing services to its client-base. Since the models improve only over a period of time as more information is collected, JaphSoft does not have a deletion process for the data it receives from clients. However, to ensure compliance with data privacy rules, JaphSoft pseudonymizes the personal data by removing identifying information from the contact information. JaphSoft's engineers, however, maintain all contact information in the same database as the identifying information.
Under its agreement with Liem and EcoMick, JaphSoft received access to MarketIQ, which included contact information as well as prior purchase history for such contacts, to create campaigns that would result in the most views of the two companies' websites. A prior Liem customer, Ms. Iman, received a marketing campaign from JaphSoft regarding Liem's as well as EcoMick's latest products. While Ms. Iman recalls checking a box to receive information in the future regarding Liem's products, she has never shopped EcoMick, nor provided her personal data to that company.
JaphSoft's use of pseudonymization is NOT in compliance with the CDPR because?

• A. JaphSoft pseudonymized all the data instead of deleting what it no longer needed.
• B. JaphSoft failed to first anonymize the personal data.
• C. JaphSoft failed to keep personally identifiable information in a separate database.
• D. JaphSoft was in possession of information that could be used to identify data subjects.

Answer: A

 

NEW QUESTION 103
Which GDPR principle would a Spanish employer most likely depend upon to annually send the personal data of its employees to the national tax authority?

• A. The protection of the vital interest of the employees.
• B. The legitimate interest of the public administration.
• C. The consent of the employees.
• D. The legal obligation of the employer.

Answer: D

 

NEW QUESTION 104
SCENARIO
Please use the following to answer the next question:
You have just been hired by a toy manufacturer based in Hong Kong. The company sells a broad range of dolls, action figures and plush toys that can be found internationally in a wide variety of retail stores. Although the manufacturer has no offices outside Hong Kong and in fact does not employ any staff outside Hong Kong, it has entered into a number of local distribution contracts. The toys produced by the company can be found in all popular toy stores throughout Europe, the United States, Canada and Asia. A large portion of the company's revenue is due to international sales.
The company now wishes to launch a new range of connected toys, ones that can talk and interact with children. The CEO of the company is touting these toys as the next big thing, due to the increased possibilities offered: The figures can answer children's Questions: on various subjects, such as mathematical calculations or the weather. Each figure is equipped with a microphone and speaker and can connect to any smartphone or tablet via Bluetooth. Any mobile device within a 10-meter radius can connect to the toys via Bluetooth as well.
The figures can also be associated with other figures (from the same manufacturer) and interact with each other for an enhanced play experience.
When a child asks the toy a question, the request is sent to the cloud for analysis, and the answer is generated on cloud servers and sent back to the figure. The answer is given through the figure's integrated speakers, making it appear as though that the toy is actually responding to the child's question. The packaging of the toy does not provide technical details on how this works, nor does it mention that this feature requires an internet connection. The necessary data processing for this has been outsourced to a data center located in South Africa. However, your company has not yet revised its consumer-facing privacy policy to indicate this.
In parallel, the company is planning to introduce a new range of game systems through which consumers can play the characters they acquire in the course of playing the game. The system will come bundled with a portal that includes a Near-Field Communications (NFC) reader. This device will read an RFID tag in the action figure, making the figure come to life onscreen. Each character has its own stock features and abilities, but it is also possible to earn additional ones by accomplishing game goals. The only information stored in the tag relates to the figures' abilities. It is easy to switch characters during the game, and it is possible to bring the figure to locations outside of the home and have the character's abilities remain intact.
What presents the BIGGEST potential privacy issue with the company's practices?

• A. The RFID tag in the action figures has the potential for misuse because of the toy's evolving capabilities
• B. The cloud service provider is in a country that has not been deemed adequate
• C. The information about the data processing involved has not been specified
• D. The NFC portal can read any data stored in the action figures

Answer: C

 

NEW QUESTION 105
When does the GDPR provide more latitude for a company to process data beyond its original collection purpose?

• A. When the data subject has failed to use a provided opt-out mechanism.
• B. When the data has been pseudonymized.
• C. When the data serves legitimate interest of third parties.
• D. When the data is protected by technological safeguards.

Answer: C

 

NEW QUESTION 106
Read the following steps:
* Discover which employees are accessing cloud services and from which devices and apps Lock down the data in those apps and devices
* Monitor and analyze the apps and devices for compliance
* Manage application life cycles
* Monitor data sharing
An organization should perform these steps to do which of the following?

• A. Pursue a GDPR-compliant Privacy by Design process.
• B. Maintain a secure Bring Your Own Device (BYOD) program.
• C. Institute a GDPR-compliant employee monitoring process.
• D. Ensure cloud vendors are complying with internal data use policies.

Answer: B

 

NEW QUESTION 107
SCENARIO
Please use the following to answer the next question:
TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business.
During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations.
TripBliss Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services.
Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered.
With regard to TripBliss Inc.'s use of website cookies, which of the following statements is correct?

• A. Because Techiva will receive only aggregate statistics of data collected from the cookies, no additional consent is necessary.
• B. Because the use of cookies involves the potential for location tracking, explicit consent must be obtained from customers.
• C. Because not all of the cookies are strictly necessary to enable the use of a service requested from TripBliss Inc., consent requirements apply to their use of cookies.
• D. Because of the categories of data involved, explicit consent for the use of cookies must be obtained separately from customers.

Answer: D

 

NEW QUESTION 108
In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?

• A. Where the DPIA identifies that the processing being proposed collects the sensitive data of EU citizens.
• B. Where the DPIA identifies high risks to individuals' rights and freedoms that the controller can take steps to reduce.
• C. Where the DPIA identifies risks that will require insurance for protecting its business interests.
• D. Where the DPIA identifies that personal data needs to be transferred to other countries outside of the EEA.

Answer: B

 

NEW QUESTION 109
Which was NOT one of the five priority areas listed by the Federal Trade Commission in its 2012 report,
''Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers"?

• A. Do Not Track
• B. International data transfers
• C. Promoting enforceable self-regulatory codes
• D. Large platform providers

Answer: B

 

NEW QUESTION 110
What is true if an employee makes an access request to his employer for any personal data held about him?

• A. The employer must supply any information held about an employee unless an exemption applies.
• B. The employer can automatically decline the request if it contains personal data about a third person.
• C. The employer must supply all the information held about the employee.
• D. The employer can decline the request if the information is only held electronically.

Answer: A

 

NEW QUESTION 111
In which scenario is a Controller most likely required to undertake a Data Protection Impact Assessment?

• A. When personal data is being transferred outside of the EEA.
• B. When personal data is being collected and combined with other personal data to profile the creditworthiness of individuals.
• C. When the controller is collecting email addresses from individuals via an online registration form for marketing purposes.
• D. When the controller is required to have a Data Protection Officer.

Answer: D

 

NEW QUESTION 112
Which of the following entities would most likely be exempt from complying with the GDPR?

• A. A Chinese company that has opened a satellite office in a European Union (EU) member state to service European customers.
• B. A South American company that regularly collects European customers' personal data.
• C. A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.
• D. A company that stores all customer data in Australia and is headquartered in a European Union (EU) member state.

Answer: A

 

NEW QUESTION 113
A U.S.-based online shop uses sophisticated software to track the browsing behavior of its European customers and predict future purchases. It also shares this information with third parties. Under the GDPR, what is the online shop's PRIMARY obligation while engaging in this kind of profiling?

• A. It must prove that it uses sufficient security safeguards to protect customer data
• B. It must seek authorization from the European supervisory authorities
• C. It must solicit informed consent through a notice on its website
• D. It must be able to demonstrate a prior business relationship with the customers

Answer: C

 

NEW QUESTION 114
SCENARIO
Please use the following to answer the next question:
TripBliss Inc. is a travel service company which has lost substantial revenue over the last few years. Their new manager, Oliver, suspects that this is partly due to the company's outdated website. After doing some research, he meets with a sales representative from the up-and-coming IT company Techiva, hoping that they can design a new, cutting-edge website for TripBliss Inc.'s foundering business.
During negotiations, a Techiva representative describes a plan for gathering more customer information through detailed Questionaires, which could be used to tailor their preferences to specific travel destinations.
TripBliss Inc. can choose any number of data categories - age, income, ethnicity - that would help them best accomplish their goals. Oliver loves this idea, but would also like to have some way of gauging how successful this approach is, especially since the Questionaires will require customers to provide explicit consent to having their data collected. The Techiva representative suggests that they also run a program to analyze the new website's traffic, in order to get a better understanding of how customers are using it. He explains his plan to place a number of cookies on customer devices. The cookies will allow the company to collect IP addresses and other information, such as the sites from which the customers came, how much time they spend on the TripBliss Inc. website, and which pages on the site they visit. All of this information will be compiled in log files, which Techiva will analyze by means of a special program. TripBliss Inc. would receive aggregate statistics to help them evaluate the website's effectiveness. Oliver enthusiastically engages Techiva for these services.
Techiva assigns the analytics portion of the project to longtime account manager Leon Santos. As is standard practice, Leon is given administrator rights to TripBliss Inc.'s website, and can authorize access to the log files gathered from it. Unfortunately for TripBliss Inc., however, Leon is taking on this new project at a time when his dissatisfaction with Techiva is at a high point. In order to take revenge for what he feels has been unfair treatment at the hands of the company, Leon asks his friend Fred, a hobby hacker, for help. Together they come up with the following plan: Fred will hack into Techiva's system and copy their log files onto a USB stick. Despite his initial intention to send the USB to the press and to the data protection authority in order to denounce Techiva, Leon experiences a crisis of conscience and ends up reconsidering his plan. He decides instead to securely wipe all the data from the USB stick and inform his manager that the company's system of access control must be reconsidered.
After Leon has informed his manager, what is Techiva's legal responsibility as a processor?

• A. They must report it to TripBliss Inc.
• B. They must conduct a full systems audit.
• C. They must inform customers who have used the website.
• D. They must report it to the supervisory authority.

Answer: B

 

NEW QUESTION 115
A German data subject was the victim of an embarrassing prank 20 years ago. A newspaper website published an article about the prank at the time, and the article is still available on the newspaper's website.
Unfortunately, the prank is the top search result when a user searches on the victim's name. The data subject requests that SearchCo delist this result. SearchCo agrees, and instructs its technology team to avoid scanning or indexing the article. What else must SearchCo do?

• A. Fully erase the URL to the content, as opposed to delist which is mainly based on data subject's name.
• B. Prevent the article from being listed in search results no matter what search terms are entered into the search engine.
• C. Notify the newspaper that its article it is delisting the article.
• D. Identify other controllers who are processing the same information and inform them of the delisting request.

Answer: C

 

NEW QUESTION 116
In what way does the "Red Flags Rule" under the Fair and Accurate Credit Transactions Act (FACTA) relate to the owner of a grocery store who uses a money wire service?

• A. it mandates the use of updated technology for securing credit records
• B. it is not usually enforced in the case of a small financial institution
• C. it requires the owner to implement an identity theft warning system
• D. it does not apply because the owner is not a creditor

Answer: A

 

NEW QUESTION 117
How is the retention of communications traffic data for law enforcement purposes addressed by Canadian data protection law?

• A. The Data Retention Directive's annulment makes such data retention now permissible.
• B. The ePrivacy Directive allows individual to engage in such data retention.
• C. The GDPR allows the retention of such data for the prevention, investigation, detection or prosecution of criminal offences only.
• D. The ePrivacy Directive harmonizes rules concerning such data retention.

Answer: C

 

NEW QUESTION 118
......

CIPP-C certification dumps - Certified Information Privacy Professional CIPP-C guides - 100% valid: https://www.examstorrent.com/CIPP-C-exam-dumps-torrent.html

100% Pass Your CIPP-C at First Attempt with ExamsTorrent: https://drive.google.com/open?id=1TBvlxDcR-lg2tfZnk3b4QSKEeo4Qp3QV