CIPP (US) 2 ā Questions and Answers
Question 1: Under the California Consumer Privacy Act (CCPA), which right allows consumers to prevent a business from selling their personal information to third parties?
- Right to deletion
- Right to opt-out (Correct answer)
- Right to access
- Right to portability
Correct answer: Right to opt-out
The CCPA grants consumers the right to opt-out of the sale of their personal information to third parties.
Question 2: Which federal law establishes privacy protections for students' education records and limits disclosure without parental consent?
- COPPA
- FERPA (Correct answer)
- HIPAA
- GLBA
Correct answer: FERPA
FERPA (Family Educational Rights and Privacy Act) protects the privacy of student education records and gives parents certain rights.
Question 3: A hospital shares patient data with a business associate for billing purposes. Under HIPAA, what document must govern this relationship?
- Privacy notice
- Business associate agreement (Correct answer)
- Data processing addendum
- Memorandum of understanding
Correct answer: Business associate agreement
HIPAA requires a Business Associate Agreement (BAA) between a covered entity and any business associate that handles PHI.
Question 4: The FTC's enforcement authority over privacy primarily derives from which legal provision?
- Section 5 of the FTC Act prohibiting unfair or deceptive acts (Correct answer)
- The Privacy Act of 1974
- COPPA Rule authority only
- The Electronic Communications Privacy Act
Correct answer: Section 5 of the FTC Act prohibiting unfair or deceptive acts
The FTC uses Section 5 of the FTC Act, which prohibits unfair or deceptive practices, as its primary tool to enforce privacy commitments.
Question 5: Which amendment to the U.S. Constitution has courts most frequently applied to establish a constitutional right to privacy?
- First Amendment
- Fourth Amendment (Correct answer)
- Fifth Amendment
- Fourteenth Amendment
Correct answer: Fourth Amendment
The Fourth Amendment's protection against unreasonable searches and seizures is most commonly cited in constitutional privacy analysis.
Question 6: Under COPPA, operators of websites directed to children under 13 must obtain verifiable parental consent before collecting personal information. Which of the following is an acceptable verification method?
- A checkbox on the registration form
- A signed consent form sent via email or postal mail (Correct answer)
- Requiring the child to enter a parent's name
- Posting a privacy notice on the website
Correct answer: A signed consent form sent via email or postal mail
COPPA accepts a signed parental consent form (paper or electronic) as a verifiable method of obtaining parental consent.
Question 7: Which principle from the Fair Information Practice Principles (FIPPs) requires that personal data be collected only for specified purposes and not used in ways incompatible with those purposes?
- Data minimization
- Purpose limitation (Correct answer)
- Accuracy
- Individual participation
Correct answer: Purpose limitation
Purpose limitation restricts the use of personal data to the specific purposes disclosed at the time of collection.
CIPP (US) 2
Under the California Consumer Privacy Act (CCPA), which right allows consumers to prevent a business from selling their personal information to third parties?