CGRC Privacy and Data Protection Flashcards

An organization transfers personal data of EU residents to a US-based cloud provider after the invalidation of the EU-US Privacy Shield. Which mechanism provides a valid legal basis for this transfer?

Answer: Using Standard Contractual Clauses (SCCs) approved by the European Commission

Standard Contractual Clauses (SCCs) are a Commission-approved transfer mechanism that remain valid for transferring EU personal data to third countries after Privacy Shield's invalidation.

Which federal law in the United States specifically governs the collection of personal information from children under 13 years old?

Answer: COPPA

The Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collecting personal information from children under 13.

During a CGRC assessment, an auditor reviews an organization's consent management practices. Which characteristic makes consent valid under GDPR?

Answer: Freely given, specific, informed, and unambiguous indication of agreement

GDPR requires consent to be freely given, specific, informed, and unambiguous — pre-ticked boxes and implied consent do not meet this standard.

A multinational company appoints a lead supervisory authority under GDPR's one-stop-shop mechanism. What determines which data protection authority serves as the lead?

Answer: The location of the company's main establishment where central administration decisions are made

The lead supervisory authority is determined by the location of the controller's or processor's main establishment, where decisions about processing purposes are made.

Which privacy framework uses the Fair Information Practice Principles (FIPPs) as its foundational basis and is commonly referenced in US federal agency privacy programs?

Answer: NIST Privacy Framework

The NIST Privacy Framework is grounded in FIPPs and is designed to help US organizations — including federal agencies — manage privacy risk.

An organization identifies that a third-party vendor processing personal data on its behalf has suffered a breach. Under GDPR, who bears the primary responsibility for notifying affected data subjects?

Answer: The data controller (organization)

Under GDPR, the data controller is ultimately responsible for notifying data subjects of breaches, while the processor must notify the controller without undue delay.

Which privacy-by-design principle requires that privacy protections be built into system architecture from the start rather than added on afterward?

Answer: Proactive not reactive; preventative not remedial

The 'proactive not reactive; preventative not remedial' principle of privacy by design means anticipating and preventing privacy-invasive events before they occur, rather than fixing problems after the fact.

Under the California Consumer Privacy Act (CCPA), which of the following is NOT a right granted to California consumers?

Answer: Right to receive monetary compensation for every privacy violation

CCPA grants rights to know, delete, opt-out, and non-discrimination, but does not guarantee automatic monetary compensation for every violation — only statutory damages for data breaches.

A healthcare organization shares de-identified patient data with a research partner. Under HIPAA's Safe Harbor method, how many specific identifiers must be removed before data is considered de-identified?

Answer: 18

HIPAA's Safe Harbor de-identification method requires removal of 18 specific identifiers including names, geographic data, dates, and contact information.

Which privacy principle requires that personal data collected for one specific purpose should not be used for a different, incompatible purpose without consent?

Answer: Purpose limitation

Purpose limitation restricts the use of personal data to the specific, explicit purpose for which it was originally collected.

An organization conducts a Privacy Impact Assessment (PIA). Which scenario would MOST likely trigger the need for a PIA?

Answer: Deploying a new biometric time-tracking system for employees

A PIA is most commonly required when introducing new technologies or processes that significantly change how personal — especially sensitive — data is collected or processed.

Under GDPR, what is the maximum timeframe within which a data controller must notify the supervisory authority of a personal data breach that poses a risk to individuals' rights and freedoms?

Answer: 72 hours

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a qualifying personal data breach.

A company's privacy policy states it retains customer purchase data for 10 years, but regulatory requirements only mandate 3 years. Which privacy principle is most directly violated by the company's practice?

Answer: Storage limitation

Storage limitation requires that personal data not be kept longer than necessary for its stated purpose, and retaining data beyond regulatory requirements without justification violates this principle.

Which of the following best describes the role of a Data Protection Officer (DPO) under GDPR?

Answer: Serving as an independent advisor who monitors compliance and liaises with supervisory authorities

A DPO under GDPR is an independent advisor who monitors compliance, advises on DPIAs, and serves as a contact point for supervisory authorities and data subjects.