Mar 24, 2024 Newest CIPM Exam Dumps – Achieve Success in Actual CIPM Exam
Updated IAPP CIPM Dumps – Check Free CIPM Exam Dumps (2024)
NEW QUESTION # 72
Which is NOT an influence on the privacy environment external to an organization?
- A. Technological advances.
- B. Management team priorities.
- C. Regulations.
- D. Consumer demand.
Answer: B
Explanation:
Explanation
The privacy environment external to an organization refers to the factors that are outside the control of the organization, such as regulations, consumer demand, technological advances, and social norms. These factors can affect the organization's privacy practices and policies, and require the organization to adapt and comply.
Management team priorities are an internal factor that influence the privacy environment within the organization, as they reflect the organization's vision, mission, values, and goals. References: CIPM Study Guide, page 14.
NEW QUESTION # 73
Which of the following is NOT an important factor to consider when developing a data retention policy?
- A. Organizational culture.
- B. Compliance requirement
- C. Business requirement.
- D. Technology resource.
Answer: A
Explanation:
Explanation
Organizational culture is not an important factor to consider when developing a data retention policy. A data retention policy is a document that defines how long an organization retains personal information for various purposes and how it disposes of it securely when it is no longer needed. A data retention policy should be based on factors such as: business requirements, such as operational needs, customer expectations, contractual obligations, or industry standards; compliance requirements, such as legal obligations, regulatory mandates, or audit recommendations; and technology resources, such as storage capacity, backup systems, encryption methods, or disposal tools. Organizational culture, which refers to the values, beliefs, norms, and behaviors that shape how an organization operates and interacts with its stakeholders, is not a relevant factor for determining data retention periods or disposal methods.
References:
* CIPM Body of Knowledge (2021), Domain IV: Privacy Program Operational Life Cycle, Section B:
Protecting Personal Information, Subsection 4: Data Retention
* CIPM Study Guide (2021), Chapter 8: Protecting Personal Information, Section 8.4: Data Retention
* CIPM Textbook (2019), Chapter 8: Protecting Personal Information, Section 8.4: Data Retention
* CIPM Practice Exam (2021), Question 141
NEW QUESTION # 74
SCENARIO
Please use the following to answer the next question:
Paul Daniels, with years of experience as a CEO, is worried about his son Carlton's successful venture, Gadgo.
A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton's direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has hired you, a privacy Consultant, to assess the company and report to both father and son. "Carlton won't listen to me," Paul says, "but he may pay attention to an expert." Gadgo's workplace is a clubhouse for innovation, with games, toys, snacks, espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company's procedures and technologies for data protection. It's a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don't want unnecessary measures that will only slow people down and clutter their thoughts." The meeting lasts until early evening. Upon leaving, you walk through the office. It looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A
"cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night; others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!" What phase in the Privacy Maturity Model (PMM) does Gadgo's privacy program best exhibit?
- A. Ad hoc
- B. Repeatable
- C. Managed
- D. Defined
Answer: A
NEW QUESTION # 75
Which of the following is TRUE about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR)?
- A. The DPIA is required if the processing activity entails risk to the rights and freedoms of an EU individual.
- B. The DPIA must include a description of the proposed processing operation and its purpose.
- C. The DPIA report must be published to demonstrate the transparency of the data processing.
- D. The DPIA result must be reported to the corresponding supervisory authority.
Answer: B
Explanation:
Explanation
The statement that is true about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR) is that the DPIA must include a description of the proposed processing operation and its purpose. According to Article 35(7) of the GDPR, a DPIA shall contain at least:
* "a systematic description of the envisaged processing operations and the purposes of the processing";
* "an assessment of the necessity and proportionality of the processing operations in relation to the purposes";
* "an assessment of the risks to the rights and freedoms of data subjects";
* "the measures envisaged to address the risks";
* "safeguards", "security measures";
* "mechanisms to ensure the protection of personal data";
* "to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned"5 Therefore, a DPIA must include a description of what data processing activities are planned and why they are needed as part of its content. This helps to provide a clear overview of the processing operation and its objectives as well as to assess its necessity and proportionality in relation to its purposes6 References: 5:
[General Data Protection Regulation (GDPR) - Official Legal Text], Article 35(7); 6: Data protection impact assessments | ICO
NEW QUESTION # 76
Data retention and destruction policies should meet all of the following requirements EXCEPT?
- A. Documentation related to audit controls (third-party or internal) should be saved in a non-permanent format by default.
- B. Data destruction triggers and methods should be documented.
- C. Personal information should be retained only for as long as necessary to perform its stated purpose.
- D. The organization should be documenting and reviewing policies of its other functions to ensure alignment (e.g. HR, business development, finance, etc.).
Answer: A
Explanation:
Explanation
Documentation related to audit controls (third-party or internal) should be saved in a permanent format by default, not a non-permanent one. This is to ensure that the organization can demonstrate its compliance with the applicable laws and regulations, as well as its own policies and procedures, in case of an audit or a legal challenge. The other options are valid requirements for data retention and destruction policies, as they help to minimize the risks and costs associated with storing personal information beyond its intended purpose. References: CIPM Body of Knowledge, Domain III: Privacy Program Management Activities, Task
3: Manage data retention and disposal.
NEW QUESTION # 77
SCENARIO
Please use the following to answer the next QUESTION:
John is the new privacy officer at the prestigious international law firm - A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe.
During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor - MessageSafe. Being successful as an email hygiene vendor, MessageSafe is expanding its business by leasing cloud infrastructure from Cloud Inc. to host email continuity service for A&M LLP.
John is very concerned about this initiative. He recalled that MessageSafe was in the news six months ago due to a security breach. Immediately, John did a quick research of MessageSafe's previous breach and learned that the breach was caused by an unintentional mistake by an IT administrator. He scheduled a meeting with Derrick to address his concerns.
At the meeting, Derrick emphasized that email is the primary method for the firm's lawyers to communicate with clients, thus it is critical to have the email continuity service to avoid any possible email downtime.
Derrick has been using the anti-spam service provided by MessageSafe for five years and is very happy with the quality of service provided by MessageSafe. In addition to the significant discount offered by MessageSafe, Derrick emphasized that he can also speed up the onboarding process since the firm already has a service contract in place with MessageSafe. The existing on-premises email continuity solution is about to reach its end of life very soon and he doesn't have the time or resource to look for another solution.
Furthermore, the off-premises email continuity service will only be turned on when the email service at A&M LLP's primary and secondary data centers are both down, and the email messages stored at MessageSafe site for continuity service will be automatically deleted after 30 days.
Which of the following is the most effective control to enforce MessageSafe's implementation of appropriate technical countermeasures to protect the personal data received from A&M LLP?
- A. MessageSafe must apply due diligence before trusting Cloud Inc. with the personal data received from A&M LLP.
- B. MessageSafe must notify A&M LLP of a data breach.
- C. MessageSafe must flow-down its data protection contract terms with A&M LLP to Cloud Inc.
- D. MessageSafe must apply appropriate security controls on the cloud infrastructure.
Answer: B
NEW QUESTION # 78
SCENARIO
Please use the following to answer the next QUESTION:
Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society's store had been hacked. The thefts could have been employee-related.
Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a phone call from you to clarify expectations and the "misunderstanding" has not occurred again.
As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society's operating budget is slim, and all sources of revenue are essential.
Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. "The good news," he says, "is that we have found a low-cost provider in Finland, where the data would also be held. So, while there may be a small charge to pass through to you, it won't be exorbitant, especially considering the advantages of a cloud." Lately, you have been hearing about cloud computing and you know it's fast becoming the new paradigm for various applications. However, you have heard mixed reviews about the potential impacts on privacy protection. You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason's Finnish provider is signing on.
What process can best answer your Questions about the vendor's data security safeguards?
- A. A second-party of supplier audit
- B. A table top demonstration of a potential threat
- C. A reference check with other clients
- D. A public records search for earlier legal violations
Answer: A
Explanation:
Explanation
This answer is the best process to answer Albert's questions about the vendor's data security safeguards, as it can provide a direct and comprehensive way to assess and verify the vendor's compliance with the applicable laws, regulations, standards and best practices for data protection. A second-party or supplier audit is conducted by the organization that hires or contracts the vendor to evaluate their performance and alignment with the organization's standards and expectations. A second-party or supplier audit can also help to identify any gaps, weaknesses or risks in the vendor's data security safeguards, and to recommend or require any improvements or corrective actions.
NEW QUESTION # 79
SCENARIO
Please use the following to answer the next QUESTION:
John is the new privacy officer at the prestigious international law firm - A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe.
During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor - MessageSafe. Being successful as an email hygiene vendor, MessageSafe is expanding its business by leasing cloud infrastructure from Cloud Inc. to host email continuity service for A&M LLP.
John is very concerned about this initiative. He recalled that MessageSafe was in the news six months ago due to a security breach. Immediately, John did a quick research of MessageSafe's previous breach and learned that the breach was caused by an unintentional mistake by an IT administrator. He scheduled a meeting with Derrick to address his concerns.
At the meeting, Derrick emphasized that email is the primary method for the firm's lawyers to communicate with clients, thus it is critical to have the email continuity service to avoid any possible email downtime. Derrick has been using the anti-spam service provided by MessageSafe for five years and is very happy with the quality of service provided by MessageSafe. In addition to the significant discount offered by MessageSafe, Derrick emphasized that he can also speed up the onboarding process since the firm already has a service contract in place with MessageSafe. The existing on-premises email continuity solution is about to reach its end of life very soon and he doesn't have the time or resource to look for another solution. Furthermore, the off- premises email continuity service will only be turned on when the email service at A&M LLP's primary and secondary data centers are both down, and the email messages stored at MessageSafe site for continuity service will be automatically deleted after 30 days.
Which of the following is a TRUE statement about the relationship among the organizations?
- A. Cloud Inc. must notify A&M LLP of a data breach immediately.
- B. A&M LLP's service contract must be amended to list Cloud Inc. as a sub-processor.
- C. MessageSafe is liable if Cloud Inc. fails to protect data from A&M LLP.
- D. Cloud Inc. should enter into a data processor agreement with A&M LLP.
Answer: A
NEW QUESTION # 80
Which of the following is the optimum first step to take when creating a Privacy Officer governance model?
- A. Involve senior leadership.
- B. Leverage communications and collaboration with public affairs teams.
- C. Develop internal partnerships with IT and information security.
- D. Provide flexibility to the General Counsel Office.
Answer: C
NEW QUESTION # 81
Your company provides a SaaS tool for B2B services and does not interact with individual consumers. A client's current employee reaches out with a right to delete request. what is the most appropriate response?
- A. Explain you are unable to process the request because business contact information and associated data is not covered under privacy rights laws.
- B. Forward the request to the contact on file for the client asking them how they would like you to proceed.
- C. Redirect the individual back to their employer to understand their rights and how this might impact access to company tools.
- D. Process the request assuming that the individual understands the implications to their organization if their information is deleted.
Answer: C
Explanation:
Explanation
If your organization provides a SaaS tool for B2B services and does not interact with individual consumers, and a client's current employee reaches out with a right to delete request, the most appropriate response is to redirect the individual back to their employer to understand their rights and how this might impact access to company tools. This is because your organization is acting as a processor for the client, who is the controller of the employee's personal data. The controller is responsible for determining the purposes and means of processing personal data, as well as responding to data subject requests. The processor should only process personal data on behalf of and in accordance with the instructions of the controller. Therefore, you should not forward the request to the client, process the request without consulting the client, or deny the request based on business contact information being exempt from privacy rights laws1, 2. References: CIPM - International Association of Privacy Professionals, Free CIPM Study Guide - International Association of Privacy Professionals
NEW QUESTION # 82
In regards to the collection of personal data conducted by an organization, what must the data subject be allowed to do?
- A. Obtain a guarantee of prompt notification in instances involving unauthorized access of the data
- B. Set a time-limit as to how long the personal data may be stored by the organization
- C. Evaluate the qualifications of a third-party processor before any data is transferred to that processor
- D. Challenge the authenticity of the personal data and have it corrected if needed
Answer: B
NEW QUESTION # 83
What is one obligation that the General Data Protection Regulation (GDPR) imposes on data processors?
- A. To inform data subjects about the identity and contact details of the controller.
- B. To implement appropriate technical and organizational measures that ensure an appropriate level of security.
- C. To honor all data access requests from data subjects.
- D. To carry out data protection impact assessments in cases where processing is likely to result in high risk to the rights and freedoms of individuals.
Answer: B
Explanation:
Explanation
The GDPR imposes several obligations on data processors, such as maintaining records of processing activities, cooperating with supervisory authorities, and notifying data controllers of personal data breaches.
One of these obligations is to implement appropriate technical and organizational measures that ensure an appropriate level of security for the personal data processed on behalf of the data controller. This is stated in Article 28(1) and Article 32 of the GDPR1. The other options are not obligations of data processors under the GDPR, but rather of data controllers or joint responsibilities of both parties. References: GDPR
NEW QUESTION # 84
SCENARIO
Please use the following to answer the next QUESTION:
You lead the privacy office for a company that handles information from individuals living in several countries throughout Europe and the Americas. You begin that morning's privacy review when a contracts officer sends you a message asking for a phone call. The message lacks clarity and detail, but you presume that data was lost.
When you contact the contracts officer, he tells you that he received a letter in the mail from a vendor stating that the vendor improperly shared information about your customers. He called the vendor and confirmed that your company recently surveyed exactly 2000 individuals about their most recent healthcare experience and sent those surveys to the vendor to transcribe it into a database, but the vendor forgot to encrypt the database as promised in the contract. As a result, the vendor has lost control of the data.
The vendor is extremely apologetic and offers to take responsibility for sending out the notifications. They tell you they set aside 2000 stamped postcards because that should reduce the time it takes to get the notice in the mail. One side is limited to their logo, but the other side is blank and they will accept whatever you want to write. You put their offer on hold and begin to develop the text around the space constraints. You are content to let the vendor's logo be associated with the notification.
The notification explains that your company recently hired a vendor to store information about their most recent experience at St. Sebastian Hospital's Clinic for Infectious Diseases. The vendor did not encrypt the information and no longer has control of it. All 2000 affected individuals are invited to sign-up for email notifications about their information. They simply need to go to your company's website and watch a quick advertisement, then provide their name, email address, and month and year of birth.
You email the incident-response council for their buy-in before 9 a.m. If anything goes wrong in this situation, you want to diffuse the blame across your colleagues. Over the next eight hours, everyone emails their comments back and forth. The consultant who leads the incident-response team notes that it is his first day with the company, but he has been in other industries for 45 years and will do his best. One of the three lawyers on the council causes the conversation to veer off course, but it eventually gets back on track. At the end of the day, they vote to proceed with the notification you wrote and use the vendor's postcards.
Shortly after the vendor mails the postcards, you learn the data was on a server that was stolen, and make the decision to have your company offer credit monitoring services. A quick internet search finds a credit monitoring company with a convincing name: Credit Under Lock and Key (CRUDLOK). Your sales rep has never handled a contract for 2000 people, but develops a proposal in about a day which says CRUDLOK will:
1.Send an enrollment invitation to everyone the day after the contract is signed.
2.Enroll someone with just their first name and the last-4 of their national identifier.
3.Monitor each enrollee's credit for two years from the date of enrollment.
4.Send a monthly email with their credit rating and offers for credit-related services at market rates.
5.Charge your company 20% of the cost of any credit restoration.
You execute the contract and the enrollment invitations are emailed to the 2000 individuals. Three days later you sit down and document all that went well and all that could have gone better. You put it in a file to reference the next time an incident occurs.
Regarding the notification, which of the following would be the greatest concern?
- A. Trusting a vendor to send out a notice when they already failed once by not encrypting the database.
- B. Informing the affected individuals that data from other individuals may have also been affected.
- C. Using a postcard with the logo of the vendor who make the mistake instead of your company's logo.
- D. Collecting more personally identifiable information than necessary to provide updates to the affected individuals.
Answer: D
Explanation:
Explanation
This answer is the greatest concern regarding the notification, as it violates the data minimization principle and exposes the affected individuals to further privacy and security risks. Collecting more personally identifiable information than necessary to provide updates to the affected individuals means that the company is asking for their name, email address, and month and year of birth, which may not be relevant or proportionate for the purpose of sending email notifications. Collecting more information than necessary can also increase the likelihood of data breaches, identity theft, fraud, or misuse of the data by unauthorized or malicious parties.
NEW QUESTION # 85
What should a privacy professional keep in mind when selecting which metrics to collect?
- A. Metrics should reveal strategies for increasing company earnings.
- B. Metrics should be reported to the public.
- C. A variety of metrics should be collected before determining their specific functions.
- D. The number of metrics should be limited at first.
Answer: D
Explanation:
Explanation
A privacy professional should keep in mind that the number of metrics should be limited at first when selecting which metrics to collect. Metrics are quantitative measures that help evaluate the performance and effectiveness of a privacy program. However, collecting too many metrics can be overwhelming, confusing, and costly. Therefore, a privacy professional should start with a few key metrics that are relevant, meaningful, actionable, and aligned with the organization's privacy goals and priorities. These metrics can be refined and expanded over time as the privacy program matures and evolves. References: [Privacy Metrics], [Measuring Privacy Program Effectiveness]
NEW QUESTION # 86
SCENARIO
Please use the following to answer the next question:
You lead the privacy office for a company that handles information from individuals living in several countries throughout Europe and the Americas. You begin that morning's privacy review when a contracts officer sends you a message asking for a phone call. The message lacks clarity and detail, but you presume that data was lost.
When you contact the contracts officer, he tells you that he received a letter in the mail from a vendor stating that the vendor improperly shared information about your customers. He called the vendor and confirmed that your company recently surveyed exactly 2000 individuals about their most recent healthcare experience and sent those surveys to the vendor to transcribe it into a database, but the vendor forgot to encrypt the database as promised in the contract. As a result, the vendor has lost control of the data.
The vendor is extremely apologetic and offers to take responsibility for sending out the notifications. They tell you they set aside 2000 stamped postcards because that should reduce the time it takes to get the notice in the mail. One side is limited to their logo, but the other side is blank and they will accept whatever you want to write. You put their offer on hold and begin to develop the text around the space constraints. You are content to let the vendor's logo be associated with the notification.
The notification explains that your company recently hired a vendor to store information about their most recent experience at St. Sebastian Hospital's Clinic for Infectious Diseases. The vendor did not encrypt the information and no longer has control of it. All 2000 affected individuals are invited to sign-up for email notifications about their information. They simply need to go to your company's website and watch a quick advertisement, then provide their name, email address, and month and year of birth.
You email the incident-response council for their buy-in before 9 a.m. If anything goes wrong in this situation, you want to diffuse the blame across your colleagues. Over the next eight hours, everyone emails their comments back and forth. The consultant who leads the incident-response team notes that it is his first day with the company, but he has been in other industries for 45 years and will do his best. One of the three lawyers on the council causes the conversation to veer off course, but it eventually gets back on track. At the end of the day, they vote to proceed with the notification you wrote and use the vendor's postcards.
Shortly after the vendor mails the postcards, you learn the data was on a server that was stolen, and make the decision to have your company offer credit monitoring services. A quick internet search finds a credit monitoring company with a convincing name: Credit Under Lock and Key (CRUDLOK). Your sales rep has never handled a contract for 2000 people, but develops a proposal in about a day which says CRUDLOK will:
1.Send an enrollment invitation to everyone the day after the contract is signed.
2.Enroll someone with just their first name and the last-4 of their national identifier.
3.Monitor each enrollee's credit for two years from the date of enrollment.
4.Send a monthly email with their credit rating and offers for credit-related services at market rates.
5.Charge your company 20% of the cost of any credit restoration.
You execute the contract and the enrollment invitations are emailed to the 2000 individuals. Three days later you sit down and document all that went well and all that could have gone better. You put it in a file to reference the next time an incident occurs.
Regarding the notification, which of the following would be the greatest concern?
- A. Collecting more personally identifiable information than necessary to provide updates to the affected individuals.
- B. Informing the affected individuals that data from other individuals may have also been affected.
- C. Using a postcard with the logo of the vendor who make the mistake instead of your company's logo.
- D. Trusting a vendor to send out a notice when they already failed once by not encrypting the database.
Answer: D
NEW QUESTION # 87
Which of the following is NOT a type of privacy program metric?
- A. Commercial metrics.
- B. Value creation metrics.
- C. Data enhancement metrics.
- D. Business enablement metrics.
Answer: B
Explanation:
Types of privacy program metrics include business enablement metrics, data enhancement metrics, and commercial metrics. Business enablement metrics measure the effectiveness of the privacy program in enabling the business to function without compromising privacy. Data enhancement metrics measure the effectiveness of the privacy program in enhancing data protection, such as through data minimization, access controls, and data security. Commercial metrics measure the effectiveness of the privacy program in creating value, such as through the development of new products, services, and customer experiences.
Privacy program metrics are used to assess the effectiveness of a privacy program and measure its progress. These metrics can include business enablement metrics, data enhancement metrics, and commercial metrics. Value creation metrics, however, are not typically used as privacy program metrics.
NEW QUESTION # 88
Under the General Data Protection Regulation (GDPR), what are the obligations of a processor that engages a sub-processor?
- A. The processor must give the controller prior written notice and perform a preliminary audit of the sub-processor.
- B. The processor must obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor.
- C. The processor must receive a written agreement that the sub-processor will be fully liable to the controller for the performance of its obligations in relation to the personal data concerned.
- D. The processor must Obtain the controllers specifiC written authorization and provide annual reports on the sub-processor'S performance.
Answer: B
Explanation:
Explanation
Under the General Data Protection Regulation (GDPR), the obligations of a processor that engages a sub-processor are to obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor. The GDPR defines a processor as a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. A sub-processor is a third party that is engaged by the processor to carry out specific processing activities on behalf of the controller. The GDPR requires that the processor does not engage another processor without prior specific or general written authorization of the controller. In the case of general written authorization, the processor must inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. The processor must also ensure that the same data protection obligations as set out in the contract or other legal act between the controller and the processor are imposed on that other processor by way of a contract or other legal act under Union or Member State law, . References: [GDPR Article 28], [CIPM - International Association of Privacy Professionals]
NEW QUESTION # 89
How do privacy audits differ from privacy assessments?
- A. They are evidence-based.
- B. They are based on standards.
- C. They are conducted by external parties.
- D. They are non-binding.
Answer: A
Explanation:
Explanation
Privacy audits differ from privacy assessments in that they are evidence-based, meaning that they rely on objective and verifiable data to evaluate the compliance and effectiveness of the privacy program. Privacy assessments, on the other hand, are based on standards, meaning that they use a set of criteria or best practices to measure the performance and maturity of the privacy program. Privacy audits are usually conducted by external parties, while privacy assessments can be done internally or externally. References: CIPM Body of Knowledge, Domain III: Privacy Program Operational Life Cycle, Section A: Assess, Subsection 1: Privacy Assessments and Audits.
NEW QUESTION # 90
SCENARIO
Please use the following to answer the next QUESTION:
John is the new privacy officer at the prestigious international law firm - A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe.
During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor - MessageSafe. Being successful as an email hygiene vendor, MessageSafe is expanding its business by leasing cloud infrastructure from Cloud Inc. to host email continuity service for A&M LLP.
John is very concerned about this initiative. He recalled that MessageSafe was in the news six months ago due to a security breach. Immediately, John did a quick research of MessageSafe's previous breach and learned that the breach was caused by an unintentional mistake by an IT administrator. He scheduled a meeting with Derrick to address his concerns.
At the meeting, Derrick emphasized that email is the primary method for the firm's lawyers to communicate with clients, thus it is critical to have the email continuity service to avoid any possible email downtime. Derrick has been using the anti-spam service provided by MessageSafe for five years and is very happy with the quality of service provided by MessageSafe. In addition to the significant discount offered by MessageSafe, Derrick emphasized that he can also speed up the onboarding process since the firm already has a service contract in place with MessageSafe. The existing on-premises email continuity solution is about to reach its end of life very soon and he doesn't have the time or resource to look for another solution. Furthermore, the off-premises email continuity service will only be turned on when the email service at A&M LLP's primary and secondary data centers are both down, and the email messages stored at MessageSafe site for continuity service will be automatically deleted after 30 days.
Which of the following is the most effective control to enforce MessageSafe's implementation of appropriate technical countermeasures to protect the personal data received from A&M LLP?
- A. MessageSafe must apply due diligence before trusting Cloud Inc. with the personal data received from A&M LLP.
- B. MessageSafe must notify A&M LLP of a data breach.
- C. MessageSafe must flow-down its data protection contract terms with A&M LLP to Cloud Inc.
- D. MessageSafe must apply appropriate security controls on the cloud infrastructure.
Answer: B
NEW QUESTION # 91
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
Which is the best way to ensure that data on personal equipment is protected?
- A. Encryption of the data.
- B. Biometric security.
- C. User risk training.
- D. Frequent data backups.
Answer: A
Explanation:
Explanation
Encryption of the data is the best way to ensure that data on personal equipment is protected, as it prevents unauthorized access to the data even if the equipment is lost or stolen. Encryption is the process of transforming data into an unreadable format that can only be decrypted with a valid key or password.
Encryption can be applied to the entire device, a specific folder or file, or a removable storage media. Encryption is one of the most effective technical safeguards for data protection and is recommended by many privacy laws and standards. References: IAPP CIPM Study Guide, page 831; ISO/IEC 27002:2013, section 10.1.1
NEW QUESTION # 92
What is one obligation that the General Data Protection Regulation (GDPR) imposes on data processors?
- A. To carry out data protection impact assessments in cases where processing is likely to result in high risk to the rights and freedoms of individuals
- B. To honor all data access requests from data subjects
- C. To implement appropriate technical and organizational measures that ensure an appropriate level of security
- D. To inform data subjects about the identity and contact details of the controller
Answer: A
Explanation:
Explanation/Reference: https://www.whitecase.com/publications/article/chapter-12-impact-assessments-dpos-and-codes- conduct-unlocking-eu-general-data
NEW QUESTION # 93
SCENARIO
Please use the following to answer the next QUESTION:
Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society's store had been hacked. The thefts could have been employee-related.
Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a phone call from you to clarify expectations and the "misunderstanding" has not occurred again.
As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society's operating budget is slim, and all sources of revenue are essential.
Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. "The good news," he says, "is that we have found a low-cost provider in Finland, where the data would also be held. So, while there may be a small charge to pass through to you, it won't be exorbitant, especially considering the advantages of a cloud." Lately, you have been hearing about cloud computing and you know it's fast becoming the new paradigm for various applications. However, you have heard mixed reviews about the potential impacts on privacy protection. You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason's Finnish provider is signing on.
What is the best way for your vendor to be clear about the Society's breach notification expectations?
- A. Arrange regular telephone check-ins reviewing expectations
- B. Send a memorandum of understanding on breach notification
- C. Include notification provisions in the vendor contract
- D. Email the regulations that require breach notifications
Answer: C
Explanation:
Explanation
This answer is the best way for Albert's vendor to be clear about the Society's breach notification expectations, as it can establish clear and binding terms and conditions for both parties regarding their roles and responsibilities for handling any data security incidents or breaches. Including notification provisions in the vendor contract can help to define what constitutes a breach, how it should be detected, reported and investigated, what information should be provided to the organization and within what time frame, what actions should be taken to mitigate or resolve the breach, and what consequences or liabilities may arise from the breach. The contract can also specify that the vendor must cooperate and coordinate with the organization in any breach notification activities to the relevant authorities, customers, partners or stakeholders.
NEW QUESTION # 94
SCENARIO
Please use the following to answer the next QUESTION:
Amira is thrilled about the sudden expansion of NatGen. As the joint Chief Executive Officer (CEO) with her long-time business partner Sadie, Amira has watched the company grow into a major competitor in the green energy market. The current line of products includes wind turbines, solar energy panels, and equipment for geothermal systems. A talented team of developers means that NatGen's line of products will only continue to grow.
With the expansion, Amira and Sadie have received advice from new senior staff members brought on to help manage the company's growth. One recent suggestion has been to combine the legal and security functions of the company to ensure observance of privacy laws and the company's own privacy policy. This sounds overly complicated to Amira, who wants departments to be able to use, collect, store, and dispose of customer data in ways that will best suit their needs. She does not want administrative oversight and complex structuring to get in the way of people doing innovative work.
Sadie has a similar outlook. The new Chief Information Officer (CIO) has proposed what Sadie believes is an unnecessarily long timetable for designing a new privacy program. She has assured him that NatGen will use the best possible equipment for electronic storage of customer and employee data. She simply needs a list of equipment and an estimate of its cost. But the CIO insists that many issues are necessary to consider before the company gets to that stage.
Regardless, Sadie and Amira insist on giving employees space to do their jobs. Both CEOs want to entrust the monitoring of employee policy compliance to low-level managers. Amira and Sadie believe these managers can adjust the company privacy policy according to what works best for their particular departments. NatGen's CEOs know that flexible interpretations of the privacy policy in the name of promoting green energy would be highly unlikely to raise any concerns with their customer base, as long as the data is always used in course of normal business activities.
Perhaps what has been most perplexing to Sadie and Amira has been the CIO's recommendation to institute a privacy compliance hotline. Sadie and Amira have relented on this point, but they hope to compromise by allowing employees to take turns handling reports of privacy policy violations. The implementation will be easy because the employees need no special preparation. They will simply have to document any concerns they hear.
Sadie and Amira are aware that it will be challenging to stay true to their principles and guard against corporate culture strangling creativity and employee morale. They hope that all senior staff will see the benefit of trying a unique approach.
What Data Lifecycle Management (DLM) principle should the company follow if they end up allowing departments to interpret the privacy policy differently?
- A. Adequately document reasons for inconsistencies.
- B. Create categories to reflect degrees of data importance.
- C. Arrange for official credentials for staff members.
- D. Prove the authenticity of the company's records.
Answer: A
Explanation:
Explanation
If the company ends up allowing departments to interpret the privacy policy differently, they should follow the Data Lifecycle Management (DLM) principle of adequately documenting reasons for inconsistencies. This principle requires that data should be accurate, complete, and consistent throughout its lifecycle and that any deviations or discrepancies should be justified and recorded1 This would help the company to maintain data quality and integrity, as well as to demonstrate accountability and compliance with data protection regulations2 The other options are not DLM principles that the company should follow if they allow departments to interpret the privacy policy differently. Proving the authenticity of the company's records is a principle related to data preservation and archiving, not data interpretation3 Arranging for official credentials for staff members is a principle related to data access and security, not data interpretation4 Creating categories to reflect degrees of data importance is a principle related to data classification and retention, not data interpretation5 References: 1: Data Lifecycle Management: A Complete Guide | Splunk; 2: Data Lifecycle Management | IBM; 3: Data Preservation | Digital Preservation Handbook; 4: Data Access Management Best Practices | Smartsheet; 5: Data Classification: What It Is And How To Do It | Varonis
NEW QUESTION # 95
......
Actual CIPM Exam Recently Updated Questions with Free Demo: https://www.testsdumps.com/CIPM_real-exam-dumps.html
Valid CIPM exam with IAPP Real Exam Questions: https://drive.google.com/open?id=1eFk69v2zUNfM8NDsc9KeVp72NjBjguue
