CCEP Data Privacy Compliance 3

Question 1

Under HIPAA's Minimum Necessary Standard, when may a covered entity share an entire medical record with another covered entity?

Accepted Answer

When the entire record is specifically justified as necessary for the purpose

Answer

The Minimum Necessary Standard requires covered entities to limit disclosures to what is reasonably necessary, and sharing an entire record is only appropriate when specifically justified.

Question 2

A SaaS vendor processes HR data on behalf of a company subject to GDPR. What document must govern this relationship under GDPR Article 28?

Accepted Answer

Data Processing Agreement (DPA)

Answer

GDPR Article 28 requires a Data Processing Agreement (DPA) between a controller and any processor that processes personal data on its behalf.

Question 3

Which CCPA right allows a consumer to stop a business from selling or sharing their personal information to third parties?

Accepted Answer

Right to opt-out of sale

Answer

The CCPA grants consumers the right to opt-out of the sale or sharing of their personal information, which businesses must honor via a 'Do Not Sell or Share My Personal Information' link.

Question 4

Under GDPR, when is a Data Protection Impact Assessment (DPIA) mandatory?

Accepted Answer

When processing is likely to result in high risk to individuals' rights and freedoms

Answer

GDPR Article 35 requires a DPIA when processing is likely to result in a high risk to the rights and freedoms of natural persons, based on the nature, scope, context, and purposes of processing.

Question 5

An employee's GPS location is tracked continuously during work hours via a company vehicle. Under a privacy compliance framework, which principle is most at risk if tracking continues outside work hours?

Accepted Answer

Purpose limitation

Answer

Purpose limitation restricts data use to the specific purposes disclosed; tracking employees outside work hours exceeds the stated purpose of business-related fleet management.

(CCEP) Certified Compliance and Ethics Professional Practice Test

(CCEP) Certified Compliance and Ethics Professional Practice Test

CCEP Data Privacy Compliance 3