CIPP (US) 4

Question 1

An e-commerce company collects email addresses and later begins using them for SMS marketing without informing customers. Which privacy principle has most likely been violated?

Accepted Answer

Purpose limitation

Answer

Using data for a purpose (SMS marketing) beyond what was disclosed at collection violates the purpose limitation principle.

Question 2

Under HIPAA's Minimum Necessary standard, a nurse reviewing a patient's chart should access:

Accepted Answer

Only the PHI necessary to perform her specific job function

Answer

The Minimum Necessary standard requires workforce members to access only the PHI needed to accomplish their intended purpose.

Question 3

Which sector-specific federal law requires telecommunications carriers to protect Customer Proprietary Network Information (CPNI)?

Accepted Answer

Communications Act / FCC rules

Answer

The Communications Act, enforced by the FCC, requires telecommunications carriers to protect CPNI and limits its use and disclosure.

Question 4

A company's privacy policy states it will never share data with third parties, but it later shares data with advertising partners. Under FTC enforcement theory, this is most likely:

Accepted Answer

A deceptive practice under Section 5

Answer

Violating a material promise in a privacy policy—sharing data despite promising not to—constitutes a deceptive practice under FTC Act Section 5.

Question 5

The Video Privacy Protection Act (VPPA) was enacted primarily in response to what event?

Accepted Answer

Disclosure of Supreme Court nominee Robert Bork's video rental records

Answer

VPPA was passed after a newspaper published Supreme Court nominee Robert Bork's video rental records, revealing the sensitivity of such data.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

CIPP (US) 4