[Mar 04, 2026] Get New CIPP-US Certification Practice Test Questions Exam Dumps

Real CIPP-US Exam Dumps Questions Valid CIPP-US Dumps PDF

The Certified Information Privacy Professional/United States (CIPP/US) exam is a certification offered by the International Association of Privacy Professionals (IAPP). Certified Information Privacy Professional/United States (CIPP/US) certification is designed to recognize professionals who specialize in privacy laws and regulations within the United States. The CIPP/US certification is an essential credential for anyone who works in privacy, including lawyers, consultants, and privacy officers.

The CIPP-US certification is ideal for professionals who work in the field of privacy, including privacy officers, data protection officers, compliance officers, and data security professionals. Certified Information Privacy Professional/United States (CIPP/US) certification is also beneficial for lawyers, consultants, and other professionals who work with privacy laws and regulations.

 

NEW QUESTION # 14
Which entities must comply with the Telemarketing Sales Rule?

• A. For-profit organizations and for-profit telefunders regarding charitable solicitations
• B. Nonprofit organizations calling on their own behalf
• C. For-profit organizations calling businesses when a binding contract exists between them
• D. For-profit and not-for-profit organizations when selling additional services to establish customers

Answer: A

Explanation:
Some types of businesses are not covered by the TSR even though they conduct telemarketing campaigns that may involve some interstate telephone calls to sell goods or services. These three types of entities are not subject to the FTC's jurisdiction, and are not covered by the TSR:
1. banks, federal credit unions, and federal savings and loans.
2. common carriers - such as long-distance telephone companies and airlines - when they are engaging in common carrier activity.
3. NON-PROFIT ORGANIZATIONS - those entities that are not organized to carry on business for their own, or their members', profit.
https://www.ftc.gov/business-guidance/resources/complying-telemarketing-sales-rule#comply

NEW QUESTION # 15
SCENARIO
Please use the following to answer the next question:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S.
Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social media. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
In regard to telemarketing practices, Evan the supervisor has a misconception regarding?

• A. The wishes of recipients who request callbacks
• B. The right to monitor calls for quality assurance
• C. The relationship of state law to federal law
• D. The conditions under which recipients can opt out

Answer: A

NEW QUESTION # 16
Which federal law or regulation preempts state law?

• A. Controlling the Assault of Non-Solicited Pornography and Marketing Act
• B. Health Insurance Portability and Accountability Act
• C. Electronic Communications Privacy Act of 1986
• D. Telemarketing Sales Rule

Answer: B

Explanation:
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a federal law that regulates the privacy and security of health information in the United States. HIPAA preempts state laws that are contrary to its provisions, unless the state laws provide more stringent protections for health information12 HIPAA establishes a floor of federal standards for health information privacy and security, but allows states to enact laws that are more protective of individuals' rights34 For example, some states may require more specific consent from individuals before disclosing their health information, or impose stricter penalties for violations of health information privacy and security. HIPAA also provides exceptions for certain state laws that serve a compelling public interest, such as public health, safety, or welfare.References: https://www.findlaw.com
/litigation/legal-system/the-supremacy-clause-and-the-doctrine-of-preemption.html
https://www.bonalaw.com/insights/legal-resources/when-does-federal-law-preempt-state-law

NEW QUESTION # 17
A company's employee wellness portal offers an app to track exercise activity via users' mobile devices. Which of the following design techniques would most effectively inform users of their data privacy rights and privileges when using the app?

• A. Publish a privacy policy written in clear, concise, and understandable language.
• B. Provide a link to the wellness program privacy policy at the bottom of each screen.
• C. Present a privacy policy to users during the wellness program registration process.
• D. Offer information about data collection and uses at key data entry points.

Answer: D

Explanation:
The design technique that would most effectively inform users of their data privacy rights and privileges when using the app is to offer information about data collection and uses at key data entry points. This technique is also known as "just-in-time" or "layered" notice, and it is recommended by the U.S. Federal Trade Commission (FTC) as a best practice for mobile app developers. The idea behind this technique is to provide users with relevant and timely information about how their data is collected and used by the app, and what choices they have to control their data, at the moment when they are asked to provide or access their data. For example, if the app collects location data from the user's device, it should display a pop-up notice explaining why it needs the location data, how it will use it, and how the user can opt-out or change the settings. This way, the user can make an informed decision about whether to allow or deny the app's access to their data, and understand the consequences of their choice.
The advantage of this technique is that it avoids overwhelming the user with too much information at once, and instead provides concise and contextual information that is easy to understand and act upon. It also increases the user's trust and confidence in the app, as they feel more in control of their data and privacy

NEW QUESTION # 18
A law enforcement subpoenas the ACME telecommunications company for access to text message records of a person suspected of planning a terrorist attack. The company had previously encrypted its text message records so that only the suspect could access this data.
What law did ACME violate by designing the service to prevent access to the information by a law enforcement agency?

• A. USA Freedom Act
• B. SCA
• C. CALEA
• D. ECPA

Answer: C

Explanation:
The law that ACME violated by designing the service to prevent access to the information by a law enforcement agency is the Communications Assistance for Law Enforcement Act (CALEA)1. CALEA is a federal law that requires telecommunications carriers and manufacturers of telecommunications equipment to design their equipment, facilities, and services to ensure that they have the necessary surveillance capabilities to comply with legal requests for interception of communications2. CALEA applies to all commercial messages, including text messages, and gives law enforcement agencies the authority to subpoena the records of such communications from the service providers3. By encrypting its text message records so that only the suspect could access this data, ACME violated CALEA's duty to cooperate in the interception of communications for law enforcement purposes. References: 1: Communications Assistance for Law Enforcement Act - Wikipedia2: Home | CALEA | The Commission on Accreditation for Law Enforcement Agencies, Inc.3: Communications Assistance for Law Enforcement Act : IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 6: Law Enforcement and National Security Access, p.
177

NEW QUESTION # 19
SCENARIO
Please use the following to answer the next QUESTION
Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop.
"Doing your homework?" Matt asked hopefully.
"No," the boy said. "I'm filling out a survey."
Matt looked over his son's shoulder at his computer screen. "What kind of survey?" "It's asking questions about my opinions."
"Let me see," Matt said, and began reading the list of questions that his son had already answered.
"It's asking your opinions about the government and citizenship. That's a little odd. You're only ten." Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids whotook the survey were automatically registered in a contest to win the first book in a series about famous leaders.
To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer questions about his favorite games and toys.
Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.
Depending on where Matt lives, the marketer could be prosecuted for violating which of the following?

• A. Consumer Bill of Rights.
• B. Red Flag Rules.
• C. Investigative Consumer Reporting Agencies Act.
• D. Unfair and Deceptive Acts and Practices laws.

Answer: D

Explanation:
The marketer could be prosecuted for violating the Unfair and Deceptive Acts and Practices (UDAP) laws, which are enforced by the Federal Trade Commission (FTC) and state attorneys general. UDAP laws prohibit businesses from engaging in unfair or deceptive practices that harm consumers, such as false advertising, misleading claims, or hidden fees. In this scenario, the marketer could be accused of deceiving children into providing personal information and preferences under the guise of a survey and a contest, without obtaining verifiable parental consent or disclosing how the information will be used or shared. This could also violate the Children's Online Privacy Protection Act (COPPA), which is a federal law that regulates the online collection and use of personal information from children under 13 years of age. References:
* [IAPP CIPP/US Study Guide], Chapter 5: Enforcement of Privacy and Security, pp. 177-178.
* IAPP CIPP/US Body of Knowledge, Section II: Limits on Private-sector Collection and Use of Data, Subsection A: Government and Court Access to Private-sector Information, Topic 2: Unfair and Deceptive Trade Practices.
* IAPP CIPP/US Practice Questions, Question 27.

NEW QUESTION # 20
SCENARIO
Please use the following to answer the next question:
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients' Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.
He was also curious about the hospital's use of a billing company. He questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients' care.
On his first day Declan became familiar with all areas of the hospital's large radiology department.
As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non- encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.
Despite Declan's concern about this issue, he was amazed by the hospital's effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan's day ended with many Questions, he was pleased about his new position.
How can the radiology department address Declan's concern about paper waste and still comply with the Health Insurance Portability and Accountability Act (HIPAA)?

• A. Confirm that patients are given the privacy notice on their first visit
• B. Post the privacy notice in a prominent location instead
• C. Direct patients to the correct area of the hospital website
• D. State the privacy policy to the patient verbally

Answer: A

Explanation:
HIPAA requires covered entities to provide a notice of privacy practices (NPP) to individuals who receive health care services from the covered entity. The NPP must describe how the covered entity may use and disclose protected health information (PHI), the individual's rights with respect to their PHI, and the covered entity's obligations to protect the privacy of PHI. The NPP must be provided to the individual no later than the date of the first service delivery, either in person or electronically. The covered entity must also make the NPP available on request and post it on its website if it has one. The covered entity must also make a good faith effort to obtain a written acknowledgment from the individual that they received the NPP. If the individual refuses to sign the acknowledgment, the covered entity must document the attempt and the reason for the refusal.

NEW QUESTION # 21
Which of the following federal agencies does NOT have regulatory authority related to privacy?

• A. Federal Reserve
• B. U.S. Department of Commerce.
• C. Consumer Financial Protection Bureau.
• D. U.S. Department of Transportation.

Answer: B

Explanation:
The U.S. Department of Commerce (DOC) is a federal agency that promotes economic growth, trade, and innovation, but does not have regulatory authority related to privacy. The DOC administers several voluntary privacy frameworks, such as the Privacy Shield, the APEC Cross-Border Privacy Rules, and the NIST Privacy Framework, but these are not legally binding or enforceable by the DOC12. The DOC also participates in international privacy negotiations and dialogues, but does not have the power to issue rules or regulations on privacy matters3.
The other three options are examples of federal agencies that do have regulatory authority related to privacy. The Consumer Financial Protection Bureau (CFPB) is an independent agency that enforces consumer protection laws, such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and the Dodd-Frank Act, which contain privacy and data security provisions4. The U.S. Department of Transportation (DOT) is a federal agency that regulates transportation safety, security, and infrastructure, and has issued privacy rules for airlines, motor carriers, and railroads. The FederalReserve (FRB) is an independent agency that oversees the nation's monetary policy, banking system, and financial stability, and has issued privacy rules for financial institutions under its jurisdiction. References: 1: Privacy Shield Program Overview | International Trade Administration 2: NIST Privacy Framework | NIST 3: Privacy and Data Security | U.S. Department of Commerce 4: Consumer Financial Protection Bureau - Wikipedia : [Privacy | US Department of Transportation] : [Privacy - Federal Reserve Board]

NEW QUESTION # 22
A company based in United States receives information about its UK subsidiary's employees in connection with the centralized HR service it provides.
How can the UK company ensure an adequate level of data protection that would allow the restricted data transfer to continue?

• A. By revising the contract with the United States parent company incorporating EU SCCs, as it continues to be valid for restricted transfers under the UK regime.
• B. By submitting to the ICO a new application for the UK BCRs using the UK BCR application forms, as their existing authorized EU BCRs are not recognized.
• C. By allowing each employee the option to opt-out to the restricted transfer, as it is necessary to send their names in order to book the sales bonuses.
• D. By signing up to an approved code of conduct under UK GDPR to demonstrate compliance with its requirements, both for the parent and the subsidiary companies.

Answer: A

Explanation:
The UK company can ensure an adequate level of data protection for the restricted data transfer to the US parent company by using the EU Standard Contractual Clauses (SCCs), which are contractual terms that provide safeguards for personal data transferred from the UK to third countries. The UK GDPR recognizes the validity of the EU SCCs adopted before the end of the Brexit transition period, and allows the UK Information Commissioner's Office (ICO) to issue new SCCs in the future. The other options are not correct because:
* A. Signing up to an approved code of conduct under the UK GDPR is not sufficient to ensure an adequate level of data protection for restricted transfers, as it is not a transfer mechanism on its own.
The UK company would still need to use another appropriate safeguard, such as SCCs or Binding Corporate Rules (BCRs), to transfer personal data to the US parent company.
* C. Submitting a new application for the UK BCRs is not necessary, as the UK GDPR recognizes the existing authorized EU BCRs as valid for restricted transfers from the UK. The UK company can continue to rely on its EU BCRs, as long as they are updated to reflect the UK GDPR requirements and the role of the ICO as the competent supervisory authority.
* D. Allowing each employee the option to opt-out to the restricted transfer is not a valid transfer mechanism under the UK GDPR, as it does not provide adequate safeguards for the personal data of the employees. The UK company would need to obtain the explicit consent of each employee for the restricted transfer, which must be freely given, specific, informed, and unambiguous. References:
* UK GDPR, Chapter V, Article 46
* UK GDPR, Chapter V, Article 47
* UK GDPR, Chapter V, Article 49
* ICO guidance on international transfers
* IAPP CIPP/US Study Guide, Chapter 10, Section 10.3.2

NEW QUESTION # 23
What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?

• A. The truncation of account numbers on credit card receipts
• B. The ability for the consumer to correct inaccurate credit report information
• C. Consumer notice when third-party data is used to make an adverse decision
• D. The right to request removal from e-mail lists

Answer: A

NEW QUESTION # 24
SCENARIO
Please use the following to answer the next question:
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients' Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.
He was also curious about the hospital's use of a billing company. He questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients' care.
On his first day Declan became familiar with all areas of the hospital's large radiology department.
As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non- encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.
Despite Declan's concern about this issue, he was amazed by the hospital's effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan's day ended with many Questions, he was pleased about his new position.
What is the most likely way that Declan might directly violate the Health Insurance Portability and Accountability Act (HIPAA)?

• A. By speaking to a patient without prior authorization
• B. By being present when patients are checking in
• C. By ignoring the conversation about a potential breach
• D. By following through with his plans for his upcoming paper

Answer: D

Explanation:
Declan might directly violate the HIPAA Privacy Rule by using John's name and personal health information (PHI) in his paper without his written authorization. The Privacy Rule protects the confidentiality of PHI that is created, received, maintained, or transmitted by a covered entity or its business associate. PHI includes any information that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual. Declan, as a nursing assistant, is part of the covered entity's workforce and must comply with the Privacy Rule. He cannot disclose John's PHI to anyone, including his classmates or instructors, without John's authorization or a valid exception under the Privacy Rule. Even if he does not use John's full name, he may still reveal enough information to make John identifiable, such as his diagnosis, his father's condition, or his location. This would be an impermissible use and disclosure of PHI, and a potential HIPAA violation. Declan should either obtain John's written authorization to use his PHI in his paper, or de-identify the information according to the Privacy Rule's standards.

NEW QUESTION # 25
If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?

• A. Notifies the organization if it can no longer meet its requirements for proper data handling
• B. Provides the same level of privacy protection as the organization
• C. Uses the transferred data for limited purposes
• D. Enters a contract with the organization that states the third party will process data according to the consent agreement

Answer: D

Explanation:
Explanation/Reference: https://www.privacyshield.gov/Key-New-Requirements

NEW QUESTION # 26
What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?

• A. Offer an Opt-Out before transferring PI to an unaffiliated third party for the latter's own use
• B. Process requests for changes to user preferences within a designated time frame
• C. Conduct annual consumer surveys regarding satisfaction with user preferences
• D. Provide consumers with the opportunity to opt out of receiving telemarketing phone calls

Answer: A

Explanation:
The Gramm-Leach-Bliley Act (GLBA) is a federal law that regulates the privacy and security of consumer financial information collected, used, and disclosed by financial institutions, such as banks, credit unions, securities firms, insurance companies, and others. Under the GLBA, financial institutions must comply with two main rules: the Privacy Rule and the Safeguards Rule.
The Privacy Rule requires financial institutions to provide notice to their customers about their information-sharing practices and to obtain verifiable parental consent before collecting, using, or disclosing personal information from children. The Privacy Rule also gives customers the right to opt out of having their personal information shared with certain nonaffiliated third parties, unless an exception applies. The Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive information security program that protects the confidentiality, security, and integrity of customer information.
Therefore, banks and other financial institutions are required to offer an opt-out before transferring personal information (PI) to an unaffiliated third party for the latter's own use, unless an exception applies, such as when the disclosure is necessary to complete a transaction requested or authorized by the customer, or when the disclosure is to a service provider or joint marketer that agrees to protect the information and use it only for the purposes for which it was disclosed. This requirement is intended to give customers more control over how their personal information is used and shared by financial institutions and to protect their privacy rights.

NEW QUESTION # 27
According to Section 5 of the FTC Act, self-regulation primarily involves a company's right to do what?

• A. Decide if any enforcement actions are justified
• B. Appeal decisions made against it
• C. Determine which bodies will be involved in adjudication
• D. Adhere to its industry's code of conduct

Answer: D

Explanation:
According to Section 5 of the FTC Act, self-regulation primarily involves a company's right to adhere to its industry's code of conduct. Self-regulation is a process by which an industry or a group of companies voluntarily adopts and enforces standards or guidelines to protect consumers and promote fair competition.
The FTC encourages self-regulation as a way to complement its enforcement efforts and address emerging issues in the marketplace. The FTC also monitors self-regulatory programs and may take action against companies that fail to comply with their own codes of conduct or misrepresent their participation in such programs. References:
* Federal Trade Commission Act, Section 5 of
* Self-Regulation | Federal Trade Commission
* [IAPP CIPP/US Certified Information Privacy Professional Study Guide], Chapter 3, page 79

NEW QUESTION # 28
Don understands that some location-based services simply enhance the user experience. Others, such as daily fantasy sports applications that allow sports betting, require that location-based services be activated to function at all. Given Don's concern over his children's safety, which of the following best practices would you recommend to Don?

• A. Allow the children to turn on location-based services on all their devices.
• B. Allow the children to turn on location-based services on their smart phones, but not their gaming consoles.
• C. Allow the children to turn on location-based services on their gaming consoles, but not their smart phones.
• D. Do not allow the children to use location-based services at all.

Answer: C

Explanation:
Location-based services often just need to know the general area someone is in such as the state they are in now, and not their specific address. However, most mobile devices, like smart phones, are only used by a single individual. This complicates things because when that individual carries their mobile device everywhere with the location-based services turn on the identity of the person can be inferred based on their location, such as Sarah going to her middle school each day.
Since she is the only person in the family that attends the school each day, one could infer that she owns the device. Don should not allow location-based services on the smart phone, or only allow location-based services to be activated when the children are home from school, or on the weekends.

NEW QUESTION # 29
A software company wants to use web scraping to collect personal data from professional networking websites in order to train an artificial intelligence program to evaluate Job applications. The company has identified several actions for limiting their potential legal liability regarding affected data subjects and professional networking websites. Which of the following would be the least effective action for helping them do this?

• A. Limiting the amount of the personally identifiable information they collect
• B. Decertifying the scraped data before selling it to any third parties.
• C. Following the terms of use posted on professional networking websites that are scraped.
• D. Adding a notice to the company website's terms of use disclosing the use of web scraping

Answer: D

Explanation:
Web scraping to collect personal data can pose significant legal and ethical risks, particularly when it involves professional networking sites or other platforms where terms of service (ToS) explicitly prohibit such activity. To limit liability, the software company must take proactive measures to comply with applicable laws (such as privacy laws) and contractual obligations (e.g., terms of use on the scraped websites).
Adding a notice to the company website's terms of use would be the least effective action, as it does not address the legal and ethical issues associated with scraping data from third-party websites. Simply adding a notice about the company's use of scraping does not mitigate liability for violating the ToS of professional networking websites or violating privacy rights under laws like the GDPR or CCPA.

NEW QUESTION # 30
SCENARIO
Please use the following to answer the next QUESTION
Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend Celeste open a jewelry store in Californi a. Felicia, despite being excited at the prospect, has a number of security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission, Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She intends to read applicants' postings on social media, ask Question:s about drug addiction, and solicit character references. Felicia believes that if potential employees are serious about becoming part of a dynamic new business, they will readily agree to these requirements.
Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check the company vehicle's GPS for locations visited by employees. She also believes that employees who use their own devices for work-related purposes should agree to a certain amount of supervision.
Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that many types of background checks are not allowed under California law. Her friend Celeste thinks these worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results. Nor does Celeste share Felicia's concern about state breach notification laws, which, she claims, would be costly to implement even on a minor scale. Celeste believes that even if the business grows a customer database of a few thousand, it's unlikely that a state agency would hassle an honest business if an accidental security incident were to occur.
In any case, Celeste feels that all they need is common sense - like remembering to tear up sensitive documents before throwing them in the recycling bin. Felicia hopes that she's right, and that all of her concerns will be put to rest next month when their new business consultant (who is also a privacy professional) arrives from North Carolina.
Regarding credit checks of potential employees, Celeste has a misconception regarding what?

• A. Employment-at-will rules.
• B. Disclosure requirements.
• C. Records retention policies
• D. Consent requirements.

Answer: D

NEW QUESTION # 31
What practice does the USA FREEDOM Act NOT authorize?

• A. An extension of the expiration for roving wiretaps
• B. Emergency exceptions that allows the government to target roamers
• C. The bulk collection of telephone data and internet metadata
• D. An increase in the maximum penalty for material support to terrorism

Answer: B

Explanation:
Explanation/Reference: https://www.rand.org/blog/2015/05/the-usa-freedom-act-the-definition-of-a-compromise.html

NEW QUESTION # 32
What information did the Red Flag Program Clarification Act of 2010 add to the original Red Flags rule?

• A. The most common methods of identity theft.
• B. The components of an identity theft detection program.
• C. The definition of what constitutes a creditor.
• D. The process for proper disposal of sensitive data.

Answer: C

Explanation:
The Red Flag Program Clarification Act of 2010 amended the original Red Flags rule, which required certain financial institutions and creditors to develop and implement a written identity theft prevention program. The Clarification Act narrowed the definition of creditor to include only those who regularly and in the ordinary course of business advance funds to or on behalf of a person, based on an obligation of the person to repay the funds or repayable from specific property pledged by or on behalf of the person. This excludes creditors who advance funds for expenses incidental to a service provided by the creditor to that person.

NEW QUESTION # 33
What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH)?

• A. Bill the majority of patients electronically for their health care
• B. Send health information and appointment reminders to patients electronically
• C. Make electronic health records (EHRs) part of regular care
• D. Keep electronic updates about the Health Insurance Portability and Accountability Act

Answer: C

NEW QUESTION # 34
Which of the following best describes what a "private right of action" is?

• A. The right of individuals to submit a request to access their information.
• B. The right of individuals to keep their information private.
• C. The right of individuals harmed by a violation of a law to file a lawsuit against the violation.
• D. The right of individuals harmed by data processing to have their information deleted.

Answer: C

Explanation:
A private right of action is a legal provision that grants individuals the ability to bring a lawsuit against a party that has wronged them and to seek redress for the harm that they have suffered. A private right of action is a fundamental component of the U.S. judicial system and an essential element of enforcingprivacy rights.
Privacy advocates argue that a private right of action is necessary to hold perpetrators of privacy violations accountable and to address the limitations of the FTC's enforcement authority. However, businesses are concerned that a private right of action would lead to a proliferation of frivolous lawsuits that would burden responsible data processors and impede innovation. References:
* U.S. Private-Sector Privacy, Third Edition by Peter P. Swire, DeBrae Kennedy-Mayo, Chapter 2, Section 2.3.3, pp. 35-36.
* How to end the deadlock on the private right of action by Paula Bruening, IAPP Privacy Perspectives, Jan 20, 2022.
* Private Right of Action (Legal Definition & Examples) by Lawrina, accessed on Jan 25, 2022.

NEW QUESTION # 35
Which of the following became the first state to pass a law specifically regulating the collection of biometric data?

• A. Illinois.
• B. Washington.
• C. Texas.
• D. California.

Answer: A

Explanation:
Illinois became the first state to pass a law specifically regulating the collection of biometric data in 2008, when it enacted the Biometric Information Privacy Act (BIPA). BIPA defines biometric identifiers as retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry, and biometric information as any information based on biometric identifiers used to identify an individual. BIPA requires entities that collect, store, or use biometric identifiers or information to obtain informed consent from individuals, provide written policies on data retention and destruction, limit disclosure and sale of biometric data, and protect biometric data using reasonable security measures. BIPA also provides a private right of action for individuals whose biometric data is collected, stored, or used in violation of the law, and allows them to recover statutory damages of $1,000 or actual damages, whichever is greater, for each negligent violation, and $5,000 or actual damages, whichever is greater, for each intentional or reckless violation, as well as attorneys' fees and costs, and injunctive relief. References: U.S. Biometrics Laws Part I: An Overview of 2020, Is Biometric Information Protected by Privacy Laws?, Biometric Data Privacy Laws

NEW QUESTION # 36
Which of the following conditions would NOT be sufficient to excuse an entity from providing breach notification under state law?

• A. If the entity followed internal notification procedures compatible with state law.
• B. If the data involved was accessed but not exported.
• C. If the entity was subject to the GLBA Safeguards Rule.
• D. If the data involved was encrypted.

Answer: B

Explanation:
Most state breach notification laws require entities to notify affected individuals and/or regulators when there is unauthorized access to or acquisition of personal information that compromises its security, confidentiality, or integrity. However, some states provide exceptions to this requirement under certain conditions, such as:
If the data involved was encrypted or otherwise rendered unreadable or unusable, and the encryption key or other means of access was not compromised. This is based on the assumption that encrypted data is not accessible to unauthorized parties, even if they obtain the data. If the entity was subject to and complied with another federal or state law that provides similar or greater protection and notification requirements, such as the GLBA Safeguards Rule or the HIPAA Breach Notification Rule. This is to avoid duplication or inconsistency of obligations for entities that are already regulated by other laws.
If the entity conducted a risk assessment and determined that there is no reasonable likelihood of harm to the affected individuals, based on factors such as the nature and extent of the data, the circumstances of the breach, the evidence of misuse, and the ability to mitigate the risk. This is to allow entities to exercise some discretion and judgment in evaluating the potential impact of the breach.
However, none of the state laws provide an exception for the mere access of data without exportation. Access alone is considered a breach that triggers the notification requirement, unless one of the other conditions applies. Therefore, option B is not a sufficient excuse for not providing breach notification under state law.

NEW QUESTION # 37
......

CIPP-US Exam Dumps - PDF Questions and Testing Engine: https://prep4sure.vce4dumps.com/CIPP-US-latest-dumps.html