Certified Information Privacy Professional Government and Public Sector Privacy 2 — Questions and Answers
Question 1: Under FERPA, when may a school disclose a student's education records without consent?
- To school officials with a legitimate educational interest, and in health or safety emergencies (Correct answer)
- To any government agency that requests them
- To parents automatically once the student turns 18
- To employers conducting background checks without restriction
Correct answer: To school officials with a legitimate educational interest, and in health or safety emergencies
FERPA permits disclosures without consent to school officials with a legitimate educational interest, in emergencies affecting health or safety, and in other specified exceptions.
Question 2: Which federal privacy law applies to personal information collected by federal agency websites and online services?
- E-Government Act of 2002 and OMB guidance implementing it (Correct answer)
- COPPA only for child-directed government sites
- FTC Act Section 5 for government agencies
- No federal law covers government website privacy
Correct answer: E-Government Act of 2002 and OMB guidance implementing it
The E-Government Act of 2002, with OMB guidance, requires federal agencies to post privacy policies on websites and conduct privacy impact assessments for online information collections.
Question 3: What is a Privacy Impact Assessment (PIA) required under the E-Government Act?
- An analysis of how personal information is collected, used, and protected in a federal IT system (Correct answer)
- A financial audit of agency privacy programs
- A public referendum on data collection practices
- An annual employee privacy training certification
Correct answer: An analysis of how personal information is collected, used, and protected in a federal IT system
A PIA analyzes how personal information is collected, stored, accessed, and used in a federal IT system, and must be conducted before developing or procuring systems that collect personal data.
Question 4: Under the Freedom of Information Act (FOIA), which Privacy Act exemption allows agencies to withhold personal information about individuals?
- Exemption 6 (personal privacy files) and Exemption 7(C) (law enforcement records where privacy interests outweigh public interest) (Correct answer)
- Exemption 1 (national security classified information)
- Exemption 3 (information prohibited from disclosure by other statutes)
- Exemption 5 (inter-agency deliberative process privilege)
Correct answer: Exemption 6 (personal privacy files) and Exemption 7(C) (law enforcement records where privacy interests outweigh public interest)
FOIA Exemptions 6 and 7(C) protect personal privacy by allowing agencies to withhold information about individuals when the privacy interest outweighs the public interest in disclosure.
Question 5: Which federal agency has primary responsibility for issuing government-wide privacy policy guidance to federal agencies?
- Office of Management and Budget (OMB) (Correct answer)
- Office of Personnel Management (OPM)
- Department of Homeland Security (DHS)
- National Institute of Standards and Technology (NIST)
Correct answer: Office of Management and Budget (OMB)
OMB issues government-wide privacy policy guidance, including Circular A-130, which sets requirements for privacy programs, PIAs, and SORNs across federal agencies.
Question 6: The Driver's Privacy Protection Act (DPPA) restricts state DMVs from disclosing what type of information?
- Personal information from motor vehicle records, such as names, addresses, and SSNs (Correct answer)
- Traffic enforcement records and citations
- Vehicle mechanical inspection records
- Accident and insurance claim data only
Correct answer: Personal information from motor vehicle records, such as names, addresses, and SSNs
The DPPA restricts state DMVs from disclosing personal information in motor vehicle records — like names, addresses, SSNs, and photos — except for specified permissible uses.
Certified Information Privacy Professional Government and Public Sector Privacy 2
Under FERPA, when may a school disclose a student's education records without consent?