CGRC CGRC Privacy and Data Protection 5 — Questions and Answers
Question 1: An organization transfers personal data of EU residents to a US-based cloud provider after the invalidation of the EU-US Privacy Shield. Which mechanism provides a valid legal basis for this transfer?
- Relying on the expired Privacy Shield certification
- Using Standard Contractual Clauses (SCCs) approved by the European Commission (Correct answer)
- Obtaining a one-time verbal consent from data subjects
- Filing a notice with the US Federal Trade Commission
Correct answer: Using Standard Contractual Clauses (SCCs) approved by the European Commission
Standard Contractual Clauses (SCCs) are a Commission-approved transfer mechanism that remain valid for transferring EU personal data to third countries after Privacy Shield's invalidation.
Question 2: Which federal law in the United States specifically governs the collection of personal information from children under 13 years old?
- FERPA
- HIPAA
- COPPA (Correct answer)
- GLBA
Correct answer: COPPA
The Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collecting personal information from children under 13.
Question 3: During a CGRC assessment, an auditor reviews an organization's consent management practices. Which characteristic makes consent valid under GDPR?
- Pre-checked boxes included in terms and conditions
- Freely given, specific, informed, and unambiguous indication of agreement (Correct answer)
- A blanket consent clause embedded in the employment contract
- Implied consent based on continued use of the service
Correct answer: Freely given, specific, informed, and unambiguous indication of agreement
GDPR requires consent to be freely given, specific, informed, and unambiguous — pre-ticked boxes and implied consent do not meet this standard.
Question 4: A multinational company appoints a lead supervisory authority under GDPR's one-stop-shop mechanism. What determines which data protection authority serves as the lead?
- The country where the largest number of data subjects reside
- The location of the company's main establishment where central administration decisions are made (Correct answer)
- The country where the data controller was originally incorporated
- The location of the company's largest data center
Correct answer: The location of the company's main establishment where central administration decisions are made
The lead supervisory authority is determined by the location of the controller's or processor's main establishment, where decisions about processing purposes are made.
Question 5: Which privacy framework uses the Fair Information Practice Principles (FIPPs) as its foundational basis and is commonly referenced in US federal agency privacy programs?
- ISO/IEC 27701
- NIST Privacy Framework (Correct answer)
- GDPR
- PCI DSS
Correct answer: NIST Privacy Framework
The NIST Privacy Framework is grounded in FIPPs and is designed to help US organizations — including federal agencies — manage privacy risk.
Question 6: An organization identifies that a third-party vendor processing personal data on its behalf has suffered a breach. Under GDPR, who bears the primary responsibility for notifying affected data subjects?
- The data processor (vendor)
- The data controller (organization) (Correct answer)
- The supervisory authority
- The joint responsibility is shared 50/50
Correct answer: The data controller (organization)
Under GDPR, the data controller is ultimately responsible for notifying data subjects of breaches, while the processor must notify the controller without undue delay.
Question 7: Which privacy-by-design principle requires that privacy protections be built into system architecture from the start rather than added on afterward?
- Privacy as the default setting
- End-to-end security
- Proactive not reactive; preventative not remedial (Correct answer)
- Visibility and transparency
Correct answer: Proactive not reactive; preventative not remedial
The 'proactive not reactive; preventative not remedial' principle of privacy by design means anticipating and preventing privacy-invasive events before they occur, rather than fixing problems after the fact.
Question 8: Under the California Consumer Privacy Act (CCPA), which of the following is NOT a right granted to California consumers?
- Right to know what personal information is collected
- Right to delete personal information
- Right to data portability in a machine-readable format
- Right to receive monetary compensation for every privacy violation (Correct answer)
Correct answer: Right to receive monetary compensation for every privacy violation
CCPA grants rights to know, delete, opt-out, and non-discrimination, but does not guarantee automatic monetary compensation for every violation — only statutory damages for data breaches.
Question 9: A healthcare organization shares de-identified patient data with a research partner. Under HIPAA's Safe Harbor method, how many specific identifiers must be removed before data is considered de-identified?
- 12
- 18 (Correct answer)
- 24
- 32
Correct answer: 18
HIPAA's Safe Harbor de-identification method requires removal of 18 specific identifiers including names, geographic data, dates, and contact information.
Question 10: Which privacy principle requires that personal data collected for one specific purpose should not be used for a different, incompatible purpose without consent?
- Data minimization
- Purpose limitation (Correct answer)
- Storage limitation
- Integrity and confidentiality
Correct answer: Purpose limitation
Purpose limitation restricts the use of personal data to the specific, explicit purpose for which it was originally collected.
Question 11: An organization conducts a Privacy Impact Assessment (PIA). Which scenario would MOST likely trigger the need for a PIA?
- Upgrading the company's internal email client
- Deploying a new biometric time-tracking system for employees (Correct answer)
- Replacing office furniture in the HR department
- Renewing an existing third-party payroll contract with no changes
Correct answer: Deploying a new biometric time-tracking system for employees
A PIA is most commonly required when introducing new technologies or processes that significantly change how personal — especially sensitive — data is collected or processed.
Question 12: Under GDPR, what is the maximum timeframe within which a data controller must notify the supervisory authority of a personal data breach that poses a risk to individuals' rights and freedoms?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a qualifying personal data breach.
Question 13: A company's privacy policy states it retains customer purchase data for 10 years, but regulatory requirements only mandate 3 years. Which privacy principle is most directly violated by the company's practice?
- Lawfulness, fairness, and transparency
- Purpose limitation
- Storage limitation (Correct answer)
- Data subject rights
Correct answer: Storage limitation
Storage limitation requires that personal data not be kept longer than necessary for its stated purpose, and retaining data beyond regulatory requirements without justification violates this principle.
Question 14: Which of the following best describes the role of a Data Protection Officer (DPO) under GDPR?
- Making final decisions on data processing activities
- Serving as an independent advisor who monitors compliance and liaises with supervisory authorities (Correct answer)
- Approving all contracts involving personal data on behalf of the organization
- Acting as the legal representative of the data controller in court proceedings
Correct answer: Serving as an independent advisor who monitors compliance and liaises with supervisory authorities
A DPO under GDPR is an independent advisor who monitors compliance, advises on DPIAs, and serves as a contact point for supervisory authorities and data subjects.
