CIPP IAPP 4

Question 1

Under FCRA, a consumer reporting agency must generally provide consumers with a free copy of their credit report:

Accepted Answer

Once every 12 months upon request, plus when adverse action is taken

Answer

FCRA entitles consumers to one free annual disclosure per CRA, plus an additional free report when adverse action is taken based on the report.

Question 2

The Illinois Biometric Information Privacy Act (BIPA) is notable among US privacy laws primarily because it:

Accepted Answer

Provides a private right of action with statutory damages for biometric data violations

Answer

BIPA is unique because it grants individuals a private right of action with statutory damages of $1,000–$5,000 per violation, without requiring proof of actual harm.

Question 3

Which of the following best describes a 'legitimate interest' basis for processing personal data under GDPR, which US multinationals must understand?

Accepted Answer

Processing that is necessary for the controller's interests, provided those interests are not overridden by data subject rights

Answer

Legitimate interest under GDPR requires a three-part balancing test: the interest must be legitimate, processing must be necessary, and the interests must not override the data subject's rights and freedoms.

Question 4

A US company acting as a HIPAA Business Associate must sign a Business Associate Agreement (BAA) that:

Accepted Answer

Specifies permissible uses and disclosures of PHI and obligates the BA to safeguard it

Answer

A BAA must specify the permitted and required uses and disclosures of PHI and require the business associate to implement appropriate safeguards and report breaches.

Question 5

Under the Privacy Act of 1974, which category of organization is directly regulated?

Accepted Answer

Federal government agencies maintaining systems of records

Answer

The Privacy Act of 1974 applies specifically to federal executive branch agencies that maintain systems of records about individuals, regulating how they collect, maintain, and use personal information.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

CIPP IAPP 4