Questions for the CIPM were updated on : Jul 20 ,2024
What is the best way to understand the location, use and importance of personal data within an
organization?
C
What are you doing if you succumb to "overgeneralization" when analyzing data from metrics?
A
In addition to regulatory requirements and business practices, what important factors must a global
privacy strategy consider?
B
What have experts identified as an important trend in privacy program development?
C
SCENARIO
Please use the following to answer the next QUESTION:
Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the
development of the company's flagship product, the Handy Helper. The Handy Helper is an
application that can be used in the home to manage family calendars, do online shopping, and
schedule doctor appointments. After having had a successful launch in the United States, the Handy
Helper is about to be made available for purchase worldwide.
The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product
suitable for the whole family, including children, but does not provide any further detail or privacy
notice. In order to use the application, a family creates a single account, and the primary user has
access to all information about the other users. Upon start up, the primary user must check a box
consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing
partners in order to be able to use the application.
Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a
European distributor of Handy Helper when he fielded many Questions about the product from the
distributor. Sanjay needed to look more closely at the product in order to be able to answer the
Questions as he was not involved in the product development process.
In speaking with the product team, he learned that the Handy Helper collected and stored all of a
user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's
information is stored by Handy Helper for the additional purpose of creating additional products and
to analyze usage of the product. This data is all stored in the cloud and is encrypted both during
transmission and at rest.
Consistent with the CEO's philosophy that great new product ideas can come from anyone, all
Omnipresent Omnimedia employees have access to user data under a program called Eurek
a. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights
that could be used to create a fully automated application that runs on artificial intelligence, but as
of yet, Eureka is not well-defined and is considered a long-term goal.
What step in the system development process did Manasa skip?
C
SCENARIO
Please use the following to answer the next QUESTION:
Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the
development of the company's flagship product, the Handy Helper. The Handy Helper is an
application that can be used in the home to manage family calendars, do online shopping, and
schedule doctor appointments. After having had a successful launch in the United States, the Handy
Helper is about to be made available for purchase worldwide.
The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product
suitable for the whole family, including children, but does not provide any further detail or privacy
notice. In order to use the application, a family creates a single account, and the primary user has
access to all information about the other users. Upon start up, the primary user must check a box
consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing
partners in order to be able to use the application.
Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a
European distributor of Handy Helper when he fielded many Questions about the product from the
distributor. Sanjay needed to look more closely at the product in order to be able to answer the
Questions as he was not involved in the product development process.
In speaking with the product team, he learned that the Handy Helper collected and stored all of a
user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's
information is stored by Handy Helper for the additional purpose of creating additional products and
to analyze usage of the product. This data is all stored in the cloud and is encrypted both during
transmission and at rest.
Consistent with the CEO's philosophy that great new product ideas can come from anyone, all
Omnipresent Omnimedia employees have access to user data under a program called Eurek
a. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights
that could be used to create a fully automated application that runs on artificial intelligence, but as
of yet, Eureka is not well-defined and is considered a long-term goal.
What administrative safeguards should be implemented to protect the collected data while in use by
Manasa and her product management team?
A
SCENARIO
Please use the following to answer the next QUESTION:
Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the
development of the company's flagship product, the Handy Helper. The Handy Helper is an
application that can be used in the home to manage family calendars, do online shopping, and
schedule doctor appointments. After having had a successful launch in the United States, the Handy
Helper is about to be made available for purchase worldwide.
The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product
suitable for the whole family, including children, but does not provide any further detail or privacy
notice. In order to use the application, a family creates a single account, and the primary user has
access to all information about the
other users. Upon start up, the primary user must check a box consenting to receive marketing
emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the
application.
Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a
European distributor of Handy Helper when he fielded many Questions about the product from the
distributor. Sanjay needed to look more closely at the product in order to be able to answer the
Questions as he was not involved in the product development process.
In speaking with the product team, he learned that the Handy Helper collected and stored all of a
user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's
information is stored by Handy Helper for the additional purpose of creating additional products and
to analyze usage of the product. This data is all stored in the cloud and is encrypted both during
transmission and at rest.
Consistent with the CEO's philosophy that great new product ideas can come from anyone, all
Omnipresent Omnimedia employees have access to user data under a program called Eurek
a. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights
that could be used to create a fully automated application that runs on artificial intelligence, but as
of yet, Eureka is not well-defined and is considered a long-term goal.
What element of the Privacy by Design (PbD) framework might the Handy Helper violate?
B
SCENARIO
Please use the following to answer the next QUESTION:
Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the
development of the company's flagship product, the Handy Helper. The Handy Helper is an
application that can be used in the home to manage family calendars, do online shopping, and
schedule doctor appointments. After having had a successful launch in the United States, the Handy
Helper is about to be made available for purchase worldwide.
The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product
suitable for the whole family, including children, but does not provide any further detail or privacy
notice. In order to use the application, a family creates a single account, and the primary user has
access to all information about the other users. Upon start up, the primary user must check a box
consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing
partners in order to be able to use the application.
Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a
European distributor of Handy Helper when he fielded many Questions about the product from the
distributor. Sanjay needed to look more closely at the product in order to be able to answer the
Questions as he was not involved in the product development process.
In speaking with the product team, he learned that the Handy Helper collected and stored all of a
user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's
information is stored by Handy Helper for the additional purpose of creating additional products and
to analyze usage of the
product. This data is all stored in the cloud and is encrypted both during transmission and at rest.
Consistent with the CEO's philosophy that great new product ideas can come from anyone, all
Omnipresent Omnimedia employees have access to user data under a program called Eurek
a. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights
that could be used to create a fully automated application that runs on artificial intelligence, but as
of yet, Eureka is not well-defined and is considered a long-term goal.
What can Sanjay do to minimize the risks of offering the product in Europe?
C
Which statement is FALSE regarding the use of technical security controls?
B
An organization's privacy officer was just notified by the benefits manager that she accidentally sent
out the retirement enrollment report of all employees to a wrong vendor.
Which of the following actions should the privacy officer take first?
A
SCENARIO
Please use the following to answer the next QUESTION:
Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner,
Anton, has found some degree of disorganization after touring the company headquarters. His uncle
Henry had always focused on production not data processing and Anton is concerned. In several
storage rooms, he has found paper files, disks, and old computers that appear to contain the
personal data of current and former employees and customers. Anton knows that a single break-in
could irrevocably damage the company's relationship with its loyal customers. He intends to set a
goal of guaranteed zero loss of personal information.
To this end, Anton originally planned to place restrictions on who was admitted to the physical
premises of the company. However, Kenneth his uncle's vice president and longtime confidante
wants to hold off on Anton's idea in favor of converting any paper records held at the company to
electronic storage. Kenneth believes this process would only take one or two years. Anton likes this
idea; he envisions a password- protected system that only he and Kenneth can access.
Anton also plans to divest the company of most of its subsidiaries. Not only will this make his job
easier, but it will simplify the management of the stored dat
a. The heads of subsidiaries like the art gallery and kitchenware store down the street will be
responsible for their own information management. Then, any unneeded subsidiary data still in
Anton's possession can be destroyed within the next few years.
After learning of a recent security incident, Anton realizes that another crucial step will be notifying
customers. Kenneth insists that two lost hard drives in Question are not cause for concern; all of the
data was encrypted and not sensitive in nature. Anton does not want to take any chances, however.
He intends on sending notice letters to all employees and customers to be safe.
Anton must also check for compliance with all legislative, regulatory, and market requirements
related to privacy protection. Kenneth oversaw the development of the company's online presence
about ten years ago, but Anton is not confident about his understanding of recent online marketing
laws. Anton is assigning another trusted employee with a law background the task of the compliance
assessment. After a thorough analysis, Anton knows the company should be safe for another five
years, at which time he can order another check.
Documentation of this analysis will show auditors due diligence.
Anton has started down a long road toward improved management of the company, but he knows
the effort is worth it. Anton wants his uncle's legacy to continue for many years to come.
To improve the facility's system of data security, Anton should consider following through with the
plan for which of the following?
D
SCENARIO
Please use the following to answer the next QUESTION:
Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner,
Anton, has found some degree of disorganization after touring the company headquarters. His uncle
Henry had always focused on production not data processing and Anton is concerned. In several
storage rooms, he has found paper files, disks, and old computers that appear to contain the
personal data of current and former employees and customers. Anton knows that a single break-in
could irrevocably damage the company's relationship with its loyal customers. He intends to set a
goal of guaranteed zero loss of personal information.
To this end, Anton originally planned to place restrictions on who was admitted to the physical
premises of the company. However, Kenneth his uncle's vice president and longtime confidante
wants to hold off on Anton's idea in favor of converting any paper records held at the company to
electronic storage. Kenneth believes this process would only take one or two years. Anton likes this
idea; he envisions a password- protected system that only he and Kenneth can access.
Anton also plans to divest the company of most of its subsidiaries. Not only will this make his job
easier, but it will simplify the management of the stored dat
a. The heads of subsidiaries like the art gallery and kitchenware store down the street will be
responsible for their own information management. Then, any unneeded subsidiary data still in
Anton's possession can be destroyed within the next few years.
After learning of a recent security incident, Anton realizes that another crucial step will be notifying
customers. Kenneth insists that two lost hard drives in Question are not cause for concern; all of the
data was encrypted and not sensitive in nature. Anton does not want to take any chances, however.
He intends on sending notice letters to all employees and customers to be safe.
Anton must also check for compliance with all legislative, regulatory, and market requirements
related to privacy protection. Kenneth oversaw the development of the company's online presence
about ten years ago, but Anton is not confident about his understanding of recent online marketing
laws. Anton is assigning another trusted employee with a law background the task of the compliance
assessment. After a thorough analysis, Anton knows the company should be safe for another five
years, at which time he can order another check.
Documentation of this analysis will show auditors due diligence.
Anton has started down a long road toward improved management of the company, but he knows
the effort is worth it. Anton wants his uncle's legacy to continue for many years to come.
Which of Anton's plans for improving the data management of the company is most unachievable?
A
SCENARIO
Please use the following to answer the next QUESTION:
Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner,
Anton, has found some degree of disorganization after touring the company headquarters. His uncle
Henry had always focused on production not data processing and Anton is concerned. In several
storage rooms, he has found paper files, disks, and old computers that appear to contain the
personal data of current and former employees and customers. Anton knows that a single break-in
could irrevocably damage the company's
relationship with its loyal customers. He intends to set a goal of guaranteed zero loss of personal
information.
To this end, Anton originally planned to place restrictions on who was admitted to the physical
premises of the company. However, Kenneth his uncle's vice president and longtime confidante
wants to hold off on Anton's idea in favor of converting any paper records held at the company to
electronic storage. Kenneth believes this process would only take one or two years. Anton likes this
idea; he envisions a password- protected system that only he and Kenneth can access.
Anton also plans to divest the company of most of its subsidiaries. Not only will this make his job
easier, but it will simplify the management of the stored dat
a. The heads of subsidiaries like the art gallery and kitchenware store down the street will be
responsible for their own information management. Then, any unneeded subsidiary data still in
Anton's possession can be destroyed within the next few years.
After learning of a recent security incident, Anton realizes that another crucial step will be notifying
customers. Kenneth insists that two lost hard drives in Question are not cause for concern; all of the
data was encrypted and not sensitive in nature. Anton does not want to take any chances, however.
He intends on sending notice letters to all employees and customers to be safe.
Anton must also check for compliance with all legislative, regulatory, and market requirements
related to privacy protection. Kenneth oversaw the development of the company's online presence
about ten years ago, but Anton is not confident about his understanding of recent online marketing
laws. Anton is assigning another trusted employee with a law background the task of the compliance
assessment. After a thorough analysis, Anton knows the company should be safe for another five
years, at which time he can order another check.
Documentation of this analysis will show auditors due diligence.
Anton has started down a long road toward improved management of the company, but he knows
the effort is worth it. Anton wants his uncle's legacy to continue for many years to come.
Which important principle of Data Lifecycle Management (DLM) will most likely be compromised if
Anton executes his plan to limit data access to himself and Kenneth?
A
SCENARIO
Please use the following to answer the next QUESTION:
Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner,
Anton, has found some degree of disorganization after touring the company headquarters. His uncle
Henry had always focused on production not data processing and Anton is concerned. In several
storage rooms, he has found paper files, disks, and old computers that appear to contain the
personal data of current and former employees and customers. Anton knows that a single break-in
could irrevocably damage the company's relationship with its loyal customers. He intends to set a
goal of guaranteed zero loss of personal information.
To this end, Anton originally planned to place restrictions on who was admitted to the physical
premises of the company. However, Kenneth his uncle's vice president and longtime confidante
wants to hold off on Anton's idea in favor of converting any paper records held at the company to
electronic storage. Kenneth
believes this process would only take one or two years. Anton likes this idea; he envisions a
password- protected system that only he and Kenneth can access.
Anton also plans to divest the company of most of its subsidiaries. Not only will this make his job
easier, but it will simplify the management of the stored dat
a. The heads of subsidiaries like the art gallery and kitchenware store down the street will be
responsible for their own information management. Then, any unneeded subsidiary data still in
Anton's possession can be destroyed within the next few years.
After learning of a recent security incident, Anton realizes that another crucial step will be notifying
customers. Kenneth insists that two lost hard drives in Question are not cause for concern; all of the
data was encrypted and not sensitive in nature. Anton does not want to take any chances, however.
He intends on sending notice letters to all employees and customers to be safe.
Anton must also check for compliance with all legislative, regulatory, and market requirements
related to privacy protection. Kenneth oversaw the development of the company's online presence
about ten years ago, but Anton is not confident about his understanding of recent online marketing
laws. Anton is assigning another trusted employee with a law background the task of the compliance
assessment. After a thorough analysis, Anton knows the company should be safe for another five
years, at which time he can order another check.
Documentation of this analysis will show auditors due diligence.
Anton has started down a long road toward improved management of the company, but he knows
the effort is worth it. Anton wants his uncle's legacy to continue for many years to come.
In terms of compliance with regulatory and legislative changes, Anton has a misconception
regarding?
B
SCENARIO
Please use the following to answer the next QUESTION:
Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner,
Anton, has found some degree of disorganization after touring the company headquarters. His uncle
Henry had always focused on production not data processing and Anton is concerned. In several
storage rooms, he has found paper files, disks, and old computers that appear to contain the
personal data of current and former employees and customers. Anton knows that a single break-in
could irrevocably damage the company's relationship with its loyal customers. He intends to set a
goal of guaranteed zero loss of personal information.
To this end, Anton originally planned to place restrictions on who was admitted to the physical
premises of the company. However, Kenneth his uncle's vice president and longtime confidante
wants to hold off on Anton's idea in favor of converting any paper records held at the company to
electronic storage. Kenneth believes this process would only take one or two years. Anton likes this
idea; he envisions a password- protected system that only he and Kenneth can access.
Anton also plans to divest the company of most of its subsidiaries. Not only will this make his job
easier, but it will simplify the management of the stored dat
a. The heads of subsidiaries like the art gallery and kitchenware store down the street will be
responsible for their own information management. Then, any unneeded
subsidiary data still in Anton's possession can be destroyed within the next few years.
After learning of a recent security incident, Anton realizes that another crucial step will be notifying
customers. Kenneth insists that two lost hard drives in Question are not cause for concern; all of the
data was encrypted and not sensitive in nature. Anton does not want to take any chances, however.
He intends on sending notice letters to all employees and customers to be safe.
Anton must also check for compliance with all legislative, regulatory, and market requirements
related to privacy protection. Kenneth oversaw the development of the company's online presence
about ten years ago, but Anton is not confident about his understanding of recent online marketing
laws. Anton is assigning another trusted employee with a law background the task of the compliance
assessment. After a thorough analysis, Anton knows the company should be safe for another five
years, at which time he can order another check.
Documentation of this analysis will show auditors due diligence.
Anton has started down a long road toward improved management of the company, but he knows
the effort is worth it. Anton wants his uncle's legacy to continue for many years to come.
What would the company's legal team most likely recommend to Anton regarding his planned
communication with customers?
D