CIPP (US) 3 ā Questions and Answers
Question 1: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide customers with a privacy notice. When must this notice be provided at the latest?
- Within 30 days of account opening
- At the time of establishing a customer relationship (Correct answer)
- Annually only
- Before sharing data with affiliates
Correct answer: At the time of establishing a customer relationship
GLBA requires financial institutions to provide an initial privacy notice at the time of establishing a customer relationship.
Question 2: A company suffers a data breach exposing Social Security numbers of 600 Vermont residents. Vermont's breach notification law requires notification within 45 days. Which law governs if the federal standard differs?
- Federal law always preempts state breach laws
- The stricter state law applies to residents of that state (Correct answer)
- The company may choose whichever standard it prefers
- Only the FTC must be notified at the federal level
Correct answer: The stricter state law applies to residents of that state
In the absence of a federal breach notification standard, the stricter state law applies to residents of that state.
Question 3: Under the Health Insurance Portability and Accountability Act, which type of PHI disclosure does NOT require patient authorization?
- Disclosure to a life insurance company for underwriting
- Disclosure for treatment, payment, or healthcare operations (Correct answer)
- Disclosure to an employer for employment decisions
- Disclosure for marketing purposes
Correct answer: Disclosure for treatment, payment, or healthcare operations
HIPAA permits covered entities to use or disclose PHI for treatment, payment, and healthcare operations without patient authorization.
Question 4: Which U.S. privacy framework requires federal agencies to maintain accurate records, provide individuals access to their records, and limit disclosure of those records?
- FOIA
- The Privacy Act of 1974 (Correct answer)
- FISMA
- E-Government Act
Correct answer: The Privacy Act of 1974
The Privacy Act of 1974 governs federal agency collection, maintenance, use, and dissemination of personally identifiable information.
Question 5: A consumer reporting agency provides a credit report to an employer. Under the FCRA, what must the employer do before taking adverse action based on the report?
- Notify the FTC within 30 days
- Provide the consumer a copy of the report and a summary of FCRA rights (Correct answer)
- Obtain written consent from the applicant after the fact
- Destroy the report immediately
Correct answer: Provide the consumer a copy of the report and a summary of FCRA rights
Under FCRA, employers must provide a pre-adverse action disclosure including a copy of the report and an FCRA summary of rights before taking adverse action.
Question 6: Under the Electronic Communications Privacy Act (ECPA), which type of communication interception requires a court order even for law enforcement?
- Real-time interception of wire, oral, or electronic communications (Correct answer)
- Access to stored emails older than 180 days
- Review of call detail records
- Access to subscriber information
Correct answer: Real-time interception of wire, oral, or electronic communications
Title I of ECPA (the Wiretap Act) requires law enforcement to obtain a court order (wiretap order) to intercept communications in real time.
Question 7: Which California privacy law expanded CCPA rights to include the right to correct inaccurate personal information and created the California Privacy Protection Agency?
- California Online Privacy Protection Act (CalOPPA)
- California Privacy Rights Act (CPRA) (Correct answer)
- California IoT Security Law
- California AB 375
Correct answer: California Privacy Rights Act (CPRA)
The CPRA (Proposition 24), effective January 2023, amended and expanded the CCPA and established the California Privacy Protection Agency.
CIPP (US) 3
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide customers with a privacy notice.
When must this notice be provided at the latest?