Certified Information Privacy Technologist: Data Privacy Frameworks and Models Flashcards

Which privacy model treats privacy as a resource that individuals can selectively grant or withdraw, analogous to property rights?

Answer: Privacy as control (property-rights model)

The privacy-as-control or property-rights model views personal data as belonging to individuals who may grant licenses for its use.

In the CIPT body of knowledge, which privacy-enhancing technology (PET) allows a verifier to confirm a fact about a user without learning the underlying data?

Answer: Zero-knowledge proof

A zero-knowledge proof enables one party to prove knowledge of a value to another party without conveying any information beyond the validity of the statement.

An organization's privacy notice discloses that it shares data with 'partners for marketing purposes.' Under GDPR transparency requirements, what is missing?

Answer: The specific identities or categories of third-party recipients

GDPR Article 13/14 requires disclosing the recipients or categories of recipients of personal data, not just a vague description like 'partners.'

The concept of 'privacy by default' in GDPR Article 25 primarily requires that:

Answer: The most privacy-protective settings are active without user action

Privacy by default means that, by default, only personal data necessary for each specific purpose is processed, without requiring action from the data subject.

Which international standard provides guidance on privacy information management systems (PIMS) and is complementary to ISO/IEC 27001?

Answer: ISO/IEC 27701

ISO/IEC 27701 extends ISO 27001 by specifying requirements and guidance for establishing and continually improving a Privacy Information Management System (PIMS).

A data controller conducts profiling that produces legal or similarly significant effects on individuals. Under GDPR, what right do individuals have in this scenario?

Answer: The right not to be subject to solely automated decision-making

GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, that produce significant effects.

In privacy risk analysis, 'likelihood' refers to the probability that a threat will exploit a vulnerability, while 'impact' refers to what?

Answer: The harm to individuals if the privacy event occurs

Impact in privacy risk analysis measures the degree of harm — such as financial loss, reputational damage, or discrimination — that individuals would experience if the risk materializes.