CIPM Consent Management Flashcards

Which regulation requires 'explicit consent' — a higher standard than standard consent — for processing sensitive categories of personal data?

Answer: GDPR

GDPR Article 9 requires explicit consent for processing special categories of data such as health, biometric, racial, or religious data, which is a stricter standard than ordinary consent.

Under COPPA, what mechanism must operators use before collecting personal information from children under 13 in the US?

Answer: Verifiable parental consent obtained before collection

COPPA requires operators to obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13.

What is the role of a Legitimate Interests Assessment (LIA) in relation to consent under GDPR?

Answer: It helps determine whether legitimate interests can be used instead of consent for a given activity

An LIA is used to evaluate whether an organization can rely on legitimate interests rather than consent, balancing organizational interests against individual rights and freedoms.

Under GDPR, what must an organization do when it intends to use previously collected data for a new, incompatible purpose?

Answer: Inform data subjects of the new purpose and obtain fresh consent

If new processing is incompatible with the original consented purpose, organizations must inform data subjects about the new purpose and obtain fresh consent.

What is 'consent fatigue' in the context of digital privacy management?

Answer: Users becoming desensitized and clicking 'agree' without reviewing privacy notices

Consent fatigue occurs when individuals are overwhelmed by frequent consent requests and reflexively accept them without reading, undermining the informed nature of consent.

Which best practice most effectively helps organizations demonstrate the ongoing validity of consent for marketing communications?

Answer: Maintaining timestamped records of when, how, and to what individuals consented

Maintaining detailed records with timestamps, the exact consent language presented, and the collection method provides the audit trail needed to demonstrate valid and current consent.