CBT Legal and Ethical Standards 5 — Questions and Answers
Question 1: A certification organization fails to notify candidates of a data breach exposing their personal information collected during CBT registration. In states with breach notification laws, this failure is:
- Acceptable if fewer than 500 candidates are affected
- A legal violation that can result in regulatory fines and civil liability (Correct answer)
- Permissible if the organization notifies regulators within 90 days
- Only an ethical issue with no legal consequences
Correct answer: A legal violation that can result in regulatory fines and civil liability
Most U.S. state breach notification laws impose mandatory, time-bound notification requirements; failure to comply exposes organizations to regulatory enforcement and civil lawsuits.
Question 2: An employer requires all job applicants to take a cognitive ability test delivered via CBT. Adverse impact analysis reveals the test screens out a protected class at a significantly higher rate. Under federal employment law, the employer must:
- Continue using the test since it was professionally developed
- Demonstrate the test is job-related and consistent with business necessity (Correct answer)
- Adjust pass scores to eliminate the disparity without further analysis
- Replace the test immediately with interviews instead
Correct answer: Demonstrate the test is job-related and consistent with business necessity
Under the Uniform Guidelines on Employee Selection Procedures, employers must demonstrate validity—job-relatedness and business necessity—to defend a selection procedure that produces adverse impact.
Question 3: A remote proctoring service uses artificial intelligence to flag candidates based on eye movements as 'suspicious.' A candidate is disqualified solely on this AI determination without human review. This process most clearly violates which principle?
- Data minimization
- Procedural due process and fairness (Correct answer)
- Copyright law
- The Computer Fraud and Abuse Act
Correct answer: Procedural due process and fairness
Disqualifying a candidate based solely on an automated AI determination without human review violates procedural due process and fundamental fairness principles in high-stakes testing.
Question 4: A testing organization's score report includes a candidate's full Social Security Number. Under privacy best practices and laws such as applicable state SSN protection statutes, this practice is:
- Acceptable since the candidate provided the SSN during registration
- A privacy risk that violates many state SSN protection laws and should be avoided (Correct answer)
- Required for identity verification purposes in all states
- Permissible only if the candidate requests it on the report
Correct answer: A privacy risk that violates many state SSN protection laws and should be avoided
Many states have enacted laws specifically restricting the display and transmission of Social Security Numbers; including a full SSN on score reports creates unnecessary exposure and legal liability.
Question 5: A proctor observes a candidate using an unauthorized Bluetooth earpiece during a CBT exam but does nothing because the candidate is a high-profile professional. The proctor's inaction is best characterized as:
- Reasonable professional discretion
- An ethical failure that compromises exam integrity and fairness to all candidates (Correct answer)
- Acceptable since no formal complaint was filed
- Standard practice when the candidate is well-known
Correct answer: An ethical failure that compromises exam integrity and fairness to all candidates
Selective enforcement based on a candidate's status undermines the fairness and integrity of the exam, constituting a serious ethical violation of the proctor's duty.
Question 6: Under the Standards for Educational and Psychological Testing, which of the following responsibilities falls on the organization that develops and administers a computerized certification exam?
- Ensuring every candidate passes on their first attempt
- Providing evidence of validity, reliability, and fairness for the exam (Correct answer)
- Sharing all item data publicly to demonstrate transparency
- Guaranteeing that scores predict job performance with 100% accuracy
Correct answer: Providing evidence of validity, reliability, and fairness for the exam
The Standards require test developers to gather and document evidence supporting the validity, reliability, and fairness of their assessments for the intended uses and populations.
Question 7: A certification body plans to use exam response data to train a commercial AI product without candidate knowledge or consent. This practice most directly raises concerns under which area of law?
- Patent law
- Privacy law and breach of the original data use agreement (Correct answer)
- Antitrust law
- The Computer Fraud and Abuse Act
Correct answer: Privacy law and breach of the original data use agreement
Using candidate data for purposes beyond what was disclosed at collection violates privacy law's purpose limitation principle and likely breaches the original terms candidates agreed to.
CBT Legal and Ethical Standards 5
A certification organization fails to notify candidates of a data breach exposing their personal information collected during CBT registration.
In states with breach notification laws, this failure is: