CCCP Technology & Data Compliance 4

Question 1

A healthcare company implements a system where patient data is de-identified by replacing names with codes and storing the mapping key separately. This technique is best described as:

Accepted Answer

Pseudonymization

Answer

Pseudonymization replaces identifying information with artificial identifiers while retaining the ability to re-identify data using a separately stored key, unlike true anonymization.

Question 2

Which data retention principle requires organizations to store personal data only as long as necessary for the original purpose of collection?

Accepted Answer

Storage limitation

Answer

The storage limitation principle under GDPR requires that personal data be kept only for as long as necessary to fulfill the specified, explicit purpose for which it was collected.

Question 3

An e-commerce company wants to track website visitors across multiple sites using persistent identifiers. Under GDPR's ePrivacy rules and many state laws, this typically requires:

Accepted Answer

Explicit consent before placing non-essential tracking cookies

Answer

Non-essential cookies and tracking technologies used for advertising or analytics require prior, informed, and freely given consent under GDPR and similar privacy regulations.

Question 4

A multinational company transfers EU personal data to its U.S. parent company. Following the invalidation of Privacy Shield, which mechanism is most commonly used to legitimize this transfer?

Accepted Answer

Standard Contractual Clauses (SCCs)

Answer

Standard Contractual Clauses (SCCs) are the most widely used mechanism for lawful data transfers from the EU to non-adequate third countries, providing contractual safeguards approved by the European Commission.

Question 5

Under the Computer Fraud and Abuse Act (CFAA), which action could expose a compliance officer to criminal liability?

Accepted Answer

Accessing a computer system without authorization to investigate suspected fraud

Answer

The CFAA prohibits unauthorized access to protected computer systems, and even internal investigators can face liability if they access systems beyond the scope of their authorization.

(CCCP) Certified Corporate Compliance Professional Practice Test

(CCCP) Certified Corporate Compliance Professional Practice Test

CCCP Technology & Data Compliance 4