CDO Regulatory Policy & Ethical Standards 2

Question 1

Under GDPR, within what timeframe must a controller notify the supervisory authority of a personal data breach likely to pose a risk to individuals?

Accepted Answer

72 hours after becoming aware

Answer

GDPR Article 33 requires notification without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Question 2

A CDO wants to use customer purchase data, originally collected for order fulfillment, to train a marketing propensity model. Which GDPR principle is most directly implicated?

Accepted Answer

Purpose limitation

Answer

Purpose limitation requires that data collected for specified purposes not be further processed in a manner incompatible with those purposes.

Question 3

Under the HIPAA Privacy Rule, which method of de-identification requires removal of 18 specified identifiers?

Accepted Answer

Safe Harbor

Answer

The Safe Harbor method requires removing 18 listed identifiers and having no actual knowledge that the remaining data could identify an individual.

Question 4

Which U.S. federal law requires financial institutions to explain their information-sharing practices and safeguard sensitive customer data?

Accepted Answer

Gramm-Leach-Bliley Act

Answer

GLBA's Financial Privacy Rule and Safeguards Rule govern privacy notices and data protection for financial institutions.

Question 5

GDPR Article 22 gives data subjects the right not to be subject to which type of decision?

Accepted Answer

Decisions based solely on automated processing that produce legal or similarly significant effects

Answer

Article 22 restricts solely automated decision-making, including profiling, with legal or similarly significant effects.

CDO - Chief Data Officer Certification Practice Test

CDO - Chief Data Officer Certification Practice Test

CDO Regulatory Policy & Ethical Standards 2